From e4905f1431e62cb0436edd2dfebe69a05eb9dcae Mon Sep 17 00:00:00 2001 From: Dakshitha Ratnayake Date: Wed, 8 May 2024 14:13:37 +0530 Subject: [PATCH 01/35] docs(sdk-examples): Added description about setting up samples in console (#7838) * Added description about setting up samples in console * Changed default text. * Update introduction.mdx * Update introduction.mdx --- docs/docs/sdk-examples/introduction.mdx | 8 +++++++- docs/static/img/sdk-examples/console.png | Bin 0 -> 205034 bytes 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 docs/static/img/sdk-examples/console.png diff --git a/docs/docs/sdk-examples/introduction.mdx b/docs/docs/sdk-examples/introduction.mdx index d3f279bbba..45e2465fb8 100644 --- a/docs/docs/sdk-examples/introduction.mdx +++ b/docs/docs/sdk-examples/introduction.mdx @@ -6,7 +6,7 @@ sidebar_label: Introduction You can integrate ZITADEL quickly into your application and be up and running within minutes. To achieve your goals as fast as possible, we provide you with SDKs, Example Repositories and Guides. -The SDKs and Integration depend on the framework and language you are using. +The SDKs and integration depend on the framework and language you are using. import { Frameworks } from "../../src/components/frameworks"; @@ -14,6 +14,12 @@ import { Frameworks } from "../../src/components/frameworks"; +To further streamline your setup, simply visit the console in ZITADEL where you can select one of the languages or frameworks. This will allow you to instantly set up the configuration for that specific sample in ZITADEL, ensuring you have everything you need to get started right away. + +![Console](/img/sdk-examples/console.png) + +To begin configuring login for any of these samples, start [here](https://zitadel.com/signin). + ### OIDC Libraries OIDC is a standard for authentication and most languages and frameworks do provide a OIDC library which can be easily integrated to your application. diff --git a/docs/static/img/sdk-examples/console.png b/docs/static/img/sdk-examples/console.png new file mode 100644 index 0000000000000000000000000000000000000000..4dce7de502cd5fe829dad191ef217ec30e1a4b4a GIT binary patch literal 205034 zcmeFYbyQqi_AUwpCs=T|;O_435C|>-g1fr~cXxM(;4TRc!QG*d!rk>&&N;V#{oWh5 zPj~WygqDL8W$(!AB_>Pi<6&G`;kHkYU`sn-?QmT)N=|XmDeRDKj0n1FtB-@N?JXqZ4&V6=33`5Wd?% zANlJNoK@26ksOJ7QOp!P>vjThv5=J}u}oxODs-)io{LV)h>5BJ1*Joe1WiQJpe>wz zr4s&!+}T0+>7pOCG*9uX9sUo7c&y^9QW)zgIXFb+zmVsD0;vHZjz1U>`i}#_2@KX# zL;YJ}1O0_ZT8(r?>_swVfB_!`iPg9g{<={tt!cbS*P~=297Kx42=RIiNVT5 zDm_IOyuhUd`x+<(dkH-VMdcBc3wEgwqq#eWT1e}GfKFETLnYKvm}|)Yj-{XKBDY!W z9Fis9*A4h%B;;bRhvw|@leTthFSz5Xg*jGwx% zhOQmvDK}Hh*==A+pvzCPpUxsMTeo7$an~hOk^xAiM3p1r%Q3AzRe8mDgnmy#&ZUt@ zTfsf3u0cMFEkxJH(3;USHtuSvg6415(1Lu3Nd!x2k?|q1FT+iOF@;MrtI(f!T3?w3 zM>J-juf}kWAC?4xA;$<`@Luc5n^0C_vicPafwg2B@4grg)=E@j@X`zhR2+pFIwQJ8 zeC|s?bQXI%=RE(qoA%4G+WFMwHUD@NOCia(0NgbGYr1M;T-wCfUIO8vo$v>R-c*Kh zhH9{(JFH#ck$j}#hS0TEx8v0-SP#(6*Y|DfOlQ#^?AD`a;ce1&JQ=DP$r)^%05Dnz zC4-cr4|`549AcXezS>UbN1qvkUv1gaQQ+W=RDrm0(ur$CWXX&RHzrz=b#mB@gojA?TXMnNzCr^bf0&+FO##6^LId)myvEgQkt$)HLecD@$NLDj;F0>#>;wdGa)KBKXwOgF z_}9Pb_Y(m+?>QlozKGcoyP>uOG6%l@i7vvN7x_KOF4hjWOExReRg6?Q#!U3u@63>e zIf5&zCAB5GCByC8qJo#)FaOXmsqjna779pq>UhUIa^Hj;60tY1AG34eZnJ&Gm1S!(&zx+j zx(Jpj(o%UTqn`CT{9u82gMI^k^Dau*G2h-CV%bWIyeiuz=r&%VSbJ*e8tz)e1IJtN zx~xxGx;)lAoo&l))oo#ID$cadF^4Yu1|IVs zI-U5PMIKMrHv8VVhJ1niVq9ORV%td6gF6<8%Fk*TXBnq9s(f|d62NDOhlp3cv-{4$?ekW z0N;;}A+P2KZ-j8DQPMTTB=LIjnxe8@vr(Mn#$?yZAvL-Rxe9hQ)2emt6%9&F#_u-Y zPwS?dx0cbDXO~y&i4wm6op{k7{?)LoHX%RI9@ zn?s5u%O#Tr<&%+U(;HKr#}hVjHn~@>LV=Qut~FjY-g>_7ydI{WXXmH5#;h`27Nezu z0($~{Ir0JoU2+?$8&O>ZJ|;eV-4@-Fub8h8Z&j}oi!R4>w+gqTU_dbQo*#a9_>ALn z<6%N{Odr30{7x^$OGQ#jx-b0Q-A=;J+Ripqd+0hAEiZ8Ld~!FBvvoj6pgDL2Zx5A& zwUS(ijE|v%^jSI3JCH5koQ;Ra>Uw1Ajm$@%>KXoLv zq?XLkv@bi#s82p}1@(?WfY`_Uc@1&}Qd7i{l;2**P#*A9*i(ohO<)uplg7PgSZ7d2 z)yf={7@u0lUSw-Exj1LUJJ=dUOXzCUF?L_JJ)y{y8Oyr0FZL+5-uF@#I9oVNP^Ryu z++m@okIPv_Q7#M7@ogwqKKxWg z ztl#E?W1r@>6t(L!+FUcKrQ8Cz7@49yQfF3As`P00032Q!R~zHaE6oqhJ0(gca#lC$ zv|F8|g#QXZN&-)6uZS$i{M@Neso`qe`S#d`IDjX^>9tI?>}IJlRQzahbXYgmHwKlF zVaYOQtb7SKO{U9SaYlSQ=Qk3~lI!;@9UgnQcgy`paSJQ9A6HwP9aqPqwZCcWHapsMx2f0xuhzKlVDDs3E!P=6zg*`& zBDV{=xVE_Bdt={!zfoQ-Xpeb_(dQfXyex8jRXLogGcBI5Xwzwnc7k!$_Yt^t2Ohp>3NwoxN99vDWT3bx+$T&SV9!y%t~N zZZ3{X3Kb^=6dyz$KfTVKTFx||+ul7oK0T51Q7c~1`uzwmE_rwEfd@AG6%6~_O9H2Y z?~NKhpRb+<`8!WUK0_6;DGL8)9s7F)Y zzB&<$ln=%#@;N;@1Nv27Ih)%z^a+SL^jY`E#7Q@peWI7A<0BasD5eNE){r)lmj|N( zm0`gk!EwQ$KqYX{Apnl|kFo?f71+B!u0w!rYaLa}G-%lf;=f3;j<#&&udtkyUqSDf!vx<>}v9XP#nXOY(Q`SD{0-T+crXv^_ zCi(9JT>8_;b5Q$>=BgS_8uD^HMz+=r248IrjTzjm?S8id#^=TZDq0&m84$Z!TiH1B zxbc(z@dOX3{QEK^De)hVI9c+OYRD@Qi`qIE6LT;yF))z|z!MV_^ErGq;rS#c@mF=w zFMd)pCnq}|Mn+dxR|Z#B23rSHMrLkqZbl{+Miv%&&=d5I?lw*aZuB;eWPdjDzuOTr zb~JJ@w{tSLwITl9u7RPgvlBll>F*c)&XK*ry97?~NE82`~W zs4Cy@t2|2PZpK!cV&>MMIRm{zfSHMzi|>yL|DRj`^U8m!s_{QnS-4m^{<-Qu-THr5 z{p@J$AZlw3da0AZ|18*FmH+wXUlsWne~e-A|Yhyw93aHku{z?!ypY{Mat z;dRCLecKV3wKhxv3JpRU(yl^KcwmLVAW;0kAc?`i|Fa^oFgzErQYLW>uM6&f*8&*C zCoq4*4%Gkn)qnLk)(;AWN}&gas2%A)?E6243>khw_}>ivcLPEYm_oT+;6z@>JpcLZ z{n-N)ssYb`^yNRBelQ3)4KRNIq}O@v(SNmmp!W*pVxRrDGY9+e3pivr+WC*cYSI68 z2%yD>`M-<*U+CWdUHt$5YW}_k@r5bQ5V^dIgY>RU*r%_BV#71>j`6BHJMo$LS-L|% zrZk%bK5~VA3xL=+@)LyW^c5$1)}MswEoJ<8fjiF96*Y6(w(o$Acl1 zt5E_2J@)OtP%7eAgpbld3G+*}Jk?g({)6$ZHqS)8bpg4v9M3*;-tQMJs33c9vs(KZ zRs(}7hlcTHSS@5(H_g~tKrZka^Aoav=1yKra3kGh_}MoaaYOQf^6^=+pY}g@`k|ZF!(ld%bz|GFB7UA#56Z#n(>9R;B?OQy#EN;b0{{S(V|2~%6(=9=#$B8ND55r8~ z{5O6-b`jz{*u|9xhWx>Pa(Rvs)nX{}(b$RO{Bh0+mF1OYDwQwSs-zt4sI+9AXx$}P z?pMl6ukj|p--_5V@hlI{NR*Zp9e2yLAGnHd2 zhY6NrmuuLxZl?l{V4r;KVuP|GT4xC`2;q}bwPA6>&Uu0g?eN{LLH!KVbQj2sHJxpT z%nyQAgRNC8wIzc@suD7Mw}Q;R2mmqY*&oo^$MEmq+**=Y7IAo)B$}XAbeJ&x&P&ly zE{@GwMA*Jqu#l5`)+)$|2iBM63C7?i%*HvuGa9=f9io3A!xu$hdnjRroN>BJ`tw{b z-QM{?$~69lqUH-)P+D;aYD|J}ZVE<)%8+SUFB@=o>?L38BAscQ`R6~nzS8RV9xdhA zu!*I%QkCvoza!yk?ov$C@Q+-VS^pzIJggM1AgbMfq z+!1+vk4B4#l#A>nXvzambrZxQ<9*}ll+72zfG*B@0r?)If7}x^?N{$Y_f~5BJaIX- z^xEq4SnR(S6pPg6vD5~@qJ`o9KYBizYBtN_v9=!um3`*hhJVnORpF$?)?Wx zyT!0Xu-ZyFD|9B8e2BN3P#DiB-G3)EFq9$IU1m$9)BJSl`;@HLaUNAR_N5aP9^fMs z%4ejeKQAfO(VhT~K1#P2a&wdBpY&~0WX_x7Ez zV}xZ1Kt=RdluFUP>%U}g_+;N+(LEiuzYO5EGK0xfhTcgj+_;#7XWhtBE&!s>;Mc1+6w-sbi$hJx{h%^}F=h=4L z(BVZ($|`L5A#ZEx4k?`JLT{--fZHORroT}<$q<$86`g8t7e4bC6H9)OgXG^J2(l2q z+KfF$tLe zIpnod7eY-{*_B$}uia(ru{{t~fzkFT6dA#o6c**8_&#v5@h3MGRkywP9%YGI{Mkuw zF{{xc5+uk11q1|AEH{INgsHbQ$8K$+pnl+}QsM)ilB7G^=1eK9SMtp;`JR_Nh<|q* zFR*5Nx}Yd{VEQ-40xLwU-9*Pye0d&6$prGrkfgD?UZ|0T6a3?Xa65=0Yk@-e z@cX-7rcph=ee&lc$pTIMPJXJhi~1dru*iYIW`D3pp=R3T;!QaliFOxTpc}l~!;l$1 z^!0B){2GI*Wi|+LdQdlY2|pG|gBYSlh?x|2_DoxjMg&_Q!bvlRGK#HEm3`$_0gG;n z#A+*otz7H`=kB_jY~7Cb^VE>&?^gwd1RQDEE=0&aaFK}>@>olVF~_sBp|={D0v8z^ zgk-;mT**b(K!2)x{}6dg_O!>I$ir1O)pF0Xd2}C5$YEyF;A!h^GZoM|6FFcY^acWP zM{n49K`u0#*#fjT!|ML4GrNVcUnE714aq;!1p`;PcUN+4KO3n;!-6IH%$=QN_JBNepy>uTDQNQRT7Gvwe|_mN++7eVTpTRz2_f^) z!anVuizLF5qFlYXxXls)lV0U%>fOHqmarkO2^)UcgQAjr{Xe@-_83$v0V^cL2;m_x z@$r@J-EOtuc<9LPD#?iNTjNwqAd4NVsmyQ3J9WCg#u5*)agQC<>*oW4I`e0>!lQsP zKhNb%CqVy;-QB54(Ncb0?M%tYK=7A~Oi69CCg6ZwN)#jOY>jq+jxOuyny@qA-a)mN z=x>eC6n!o*SKjH2b{+%*LEXM=U6AEH?*chOK#gDa1gj>EOFk$9py}$x(;sPe6>L@d zS*}nC2001ScJtX8{(-KMC0x%llXzlVcFy2>UmHa5c@q&eFo45;l#dV8iEoLmIioG; z)YU6wOj6VoQe!Jt#0UrSt*3v1=wCkU)6-Kl8*N&X5WxO-T9;Q`_r#Tq$TL2eMiW%u{O9v0H zmm0Z)4}EVfq9CF0NUYWWd!ZoDT>uHi3DG=A*aI;pM}c~bC$O}E%pjEGg*v(IP9e?1 z=}^Hu8_G4))R=f7`k}xc&Uw>3|87UOIc@6H^Y}GrUGRD?E8+lG@|LcmDJ+N(2(fQ;k2DsHuF- zpn&SGG4TswySY=Xp!wwy6f)C$MmJk;03XZX?>`==*RBojB4V39ZU|)hq@8vDYYCz6 zZSvpYGLoULu^VbvwdDLk20-*L1HdC!iv;`etN&FAQtYKW2aw6)*T-~T->_C`W&s8B zgQ<}P||j?F|aoLx(nHM9B1m4#2mLaLPW`EHaxii$_r>eOA0HelZGy(+R0UwF_! zHq8_Ua%?K3XK?~yx)ICP?B+(2c{&%#T6^-E+GwoWb1`Py{0AV=ol^pHK~A;CM*aY> zdlT4XwPHOFOZNAk1k7Ivyc5b=L_1gjG`+=t83)4=oTDHi5!7=Zx1`LhEV|RvYJQkf z=O;qUlEEFw&MedEof?_6kp@-QrKy#GaQyBM1LsFwRS_yaVgg!bs(uje2wc3X54?-U08A`5n06)7pH zRC723v6nXXp*i;Y)w!w_m$;G?SCK{QV=_oX@m#yS=h;GK{?;nX1=}gXqvpO5ms-?+ z4T%l)glvT~Qa6mOz(MHi4|(t5g#d+99YWPQ+y~dpN8)dUo*v2p@&pnwuOQGezridV;Y7;R>;YGv)|*7t z7bf826q^UY;5?mLTkuh~Fo?0`ot!WVsW@^2yd<)iNGXDn57{hFNpV?y!g=UPZgP3- zMR=AM7Zx$imRkha&COuZXjk-_?P*2&;i2{Zw$KnP~_PLeNj835hQ>G<2A_ zqf)tm@B*d7ruv0#MF?e8hkJ^`)4fUlfon}pzG~U0Pdp0{sCuSe znqYHb+oN%PKKt@LI;k4wWFr0HkpFs^xAeIsxl!J-`8O!viT)bq6SspIHRLtrcZ(&j z@&{-3B_^UAQ`PToLj~@T%G>eWC8BRcrRNbwUDU-Mo>_8JoL>T_=jHB zzhVd7*KI5!!}c}!H8R!KSqFw=z;%Ei&;QwEAFB%~3gbO}78@n`q7UKmuzFNPaO-?M zsRi4Y?I#Q9bFw>=Xmfcg2rAlwXb+~s|LZ3@Eq?1T{4Y>%u);u*8tNhyCeYwMiyVK()-2scv)S3Un z+VC$M=G=@)r&WBrVyU<=Ze1qS#TRGunqNeFFfg_fr>Dn=Kp~%=Sgz_&Qm(I>|A{<8 z`HK*7mVjqA5Ck%IJ_i*oF%d$jLGd(L3kSg57OU6jtAsFk@6VsKs{vys&~DCK zP4zn)$OMQikMSV$NttYKzgnzc<2hsa_}H2ap1$oBxfwd)AFSW3vi?zPx+dL9WUx14QG}^t|HxF#aNQ3es z*qG^s9-9>pSnteV!3!w`A&uV=?;{VPSrihK3;Xl8%R)KxQn_EkhM#CK@X9gn_+0{< z1h2m@JCMs+RYBB#>U3KQXYcc$rd6-e);0A?)9AKAbZ{P{a|Qn4Ess0fJ-69FWGCr# zJG0ronbsxnPzpp$LM2ctO4xAM@8`(kQBWl|VzZM51wY9AvCikx-ZyrR+@_QfXj zI~v#!1|&cAd`e9X=v`$u*I@jWj!J_h`VIB}tPmjB(2hDOIvHG}_$=UBE^ngawl`HU zI9q>)!sGmyDL?w9xCJA0{3tB>_M>Ri`@>P_w? zX-l#aFTdC65(xcBm7cvj=7g+-+ZoDE8qZ!V$>yvY!$ZH0yFKLK~LBmAStq z$7zjD1_x9zq;xxhAM%w)O!3JM(B)?UZE&L^%KT*;E6`d$s;m3Dj!J>J^#Y^vI=yCDj-V=ei zOhV-H8{Ct`VZSDx+LQ&f^Y$ezaItr6T7~HhvPY1bqSYy!{ik(oYqU+ z(<_9`4T9bq%^~vo67FQe!oqB3i`W2S{^3?mJZKbcw7iCj*f>=iT)ID~)P?JWuAN$2CaDt`^NgvT1W&4`zccd~~B6+IMpo z@&QMWQ7dNS9sTyVF2`&22vLOGQZ{dAjd%y`KBC)|^d2jAB9(Ssz6%~S${nF|qCb)> z9{73fr{&;b-#2jC`aipyzphfNc9cq zcq*>O998!Z$(*^$`Qs4LubA=YhdlZ>&M5ARj~^Vd*)O)nVAx#G@eAyk+3l+AIN(S0 zWprP*$qj(3hTMU9xDKk*;Jsvm~Kpd^)ax zl1e)M<8}84Mro$o1QxB9RGNI3gIl)f^?p9XcaNnr12x0y$M3C57js9PW~+e*2FZi4 z{~BXm(}Na0ibDzie(T+w<>CM=y>cQ2eYMZJ(jdt-z`$o+o&x`4l@Z?HE_MyUG z5eqG-u$|f1to{He^O?yp+PC4XdJshw=IQz@S|o#+a1}+!8D#R-By~&K_x4*3?m%*I z`}|?OHo6LapZb%RM98g8ekOMv4*S7g6|d@ruXE%;|6b2I$&1;SH$8_0{QaFTCFX;Q zjC)>S>hW`q!2NwGs7qkp9k{;}W9IRDn#>UXczv}B5lgk8Y%)f@E}4qAb)ge2&H@pr zt6>rQt{T0FoQ0}`CnbHO);cQ-mcC1H>W3cAJIybpe+^$kY0r*zd& z+2&nh&ZAsR)!Jv*7JWX5m@m5SKdh*yc(TRXbvNV=tQt2nQY>SXQHeMs)62U*C@5j; zY~C#qYxyWEQlK6Ur-C2r$X~GXECz17v9kDcXu^fk(a=Mi3 z00cRsnYAjp1mLb2HT^uW=&5MY9g6@0k_wa2FvwM>`Sb>cdOvc(JI(iV1xyy$?S>Su z2U)HRjOq~_Qc>)>wNd)83$px zG&2U()pBoFW0rr7=TN?*f%8LJH~4q^`GJi9)K>EeVJ_ywW6`kkmD{X&Zy@y7?)!L`ox0<&L?3J8|3WW}Q0<=3H;Y@KfKzOrZ?i(G;~YU6p{2@_OKiLSDSFUkMu zzSxYqQTT(?(rz#<5@1{&F5;`WV+SH>%QUwi``jUX-o7SC@A$Flwca-U~l{>jkSc_gk6K2H71>d{Jn?h94C&!v&w~RDLbYpxvY>UM>HBAuv!v)V$HCAGKG2WPHg&&%W?N!>v&%Z9Y7h~~*S`jDuBG^9u^f%Nzy zDGEs#DBSGS)67Lpq^IuN68n?ERE7^Hy%U)m3F@7bXI_6Xv-#e<8V0k!vpL#G=3|8* z2ij6{xAi8(i~)mcclXc3FNyq~YPif65M%oHC3EiXhGieb&Ce9JdEFC(WRfc+ys)&r zjz$t0gr8&DSxp&-d@rnt#!eK)-u1US>=w?`h@~C4f>H-^R~d>&B0euMZxvfISxH^NzoU(Wyih>kPy+A1o?Yn}v`KMilUckoj7X9)n5|d$Ex*<1=Vx|2&PrL3 ze<`rite-?vhPz%3l5McRingnfw-?{JwN9S_VvH!0C}##$Jm{i{YewVq3L{`LmTYc* zX&uG~@SHUa8yUZKy}W64the9a;q>)8KEJ$_87*{KI9hsrPUhe`>_rhB#be8-8?l97X{FXj#j1Mv^$-tNC|Fc&_S+m)8ZXG! zi(hr1n3YLQX>>}#IIlT0yh<_ZJ&sr|)2Fi+ z(g2n}>X+Mv&wIQIV1 zwsj8C?`ZleLZ87IA9291kB+PGk}QI?1&k zs0@4xX`+{t#6xrxYBA~DbJ_x66kPBzSzlt~NX#p2cED{=p%ds@Wtv)al|f0uY_Ls0bp0P|Q<+wrM-(2!cz#$vsFBO`L6 zNqp-KJoZ6}P-Vu!7CUJ7>Dl4F69OIiB}87sA#YF*)1$;sZke)wg~rAU=0EaVJZD3e zLp2V=q;lOR{m#sWkiCDcKlG37>gPXs3F^FT2iGAy>j4CLxOjM|3L^DfkC!EN+ipty zdW4qie4xDbYBQ&tX8dPN8HN}Gi?HY&8~NwLAOidbGJ=t7QW5fNd+a9eEO_| zfX|NH-I{><0>j*4b zE4COHzl9{Osg3B`}N6H{p?{$EW13MS3{@7Zocr~wUES&QQ;MpUJ zFd3G9MjxV?JEE<}>GTlnkQpCWU`egCKD%e`Ej4Y9c34+7q8OHm!nc`o!QUUzFNBz@ zdTE6HuE6HWANwvmsbUWKN=&Iq<6@BSvHbC^p+fbE`IJmM%UkA$uFX2hRG%*v+q1tvzRUQKsa`p!11 z2$a21jg)cp@Q{MT=Do+qeb94y1JKIN0~k-N2bhhujY&kcY&R(`2zwV!Uo^a?wMobv+=|3R2;v=Xe4U62OOE4 z=MM=Olb(0SB1RI3$swM=>X+GKqlrbnYqe$!y<9h7a(AiD(kBN34`g(~4o5vN%!F_V zLlA-`83mH6a&f*T4*}BCUe~(QrVAB{#(Ov?osQTi_xF&hzy89AYRp#X?7zr0u{hn}C0`t; z0+`IveBi96#FF_sny;K)@)VezSYgND%&%karZZTJetz2t!jcos+ifb@hVHY{_=HHW z*m4{4r&ZDIjt5Be_&8c#N?9mT{NUIAHXK%!)fYy&f@@lwAo@SX=QkfaQ7a^StV3L9 zU})TofH_3z+vD?mA9qW{B}aHiM3XSPfKcRH@)1dz>f>S@zQ{e6swC-!j3JlQv%?G9 z`De39uKgldyzascy-KB&1yRM{RP<*r^DUdBCSA~0cvXl=zYLxgB06LG8!h_>S9IF7 zcNarpya1c8)f_r4xm!qD*-c`r{Jfwz+L*&V2ulXWc&P(S^c(#*)9SHM)IUT^HM`sx zmg_av>GWMAvyKpPx{+>>m#8+)S9i+=)yz(ejtByWdCQUxp2 zj;>C{9g&vu7V|-1-mP`U=oBlEE|*MFF?F1DB5WiI8z^4ng0x1PRV2i$ZnJmGsLK^G z?L%{aquZTFs&TK(@Hp^hotoQOr*J}hHZdvu@^#KpAm)-gt>(&hr8Z>Vda*ofu5?4q zNH26ErAP)HjZ^8FVnWc10f!1cih7Mdu7n#ztUb#~ss~*?IF^i*UnZ1{#U1T=Z}UN^ z3y!DvC!MbO3VDkEsKWv98Z^ru8w%9$qx`V$k`CtWIw-OZ$?iK- zJiTB2^||Wdo_a0MH>M2eO?U?iRUaLLLVVL$Mvpx+O2nHYqOKz8t!XC>k+`{nU+Jjp z>{-JgQ|Kck%n9$bFiMqUCYcy&j$n5hK%TAT2-uTXFxy~k zda`5p)TocN;{3|+>#T>-+fw%nX_o|~|fNuAC$_jml7(!lY#PkLgiobX4jlUgx9NaVY ze)b(>nZX#5Z@SbK<}(T94cbEN{XyoceQ8Vu!6h1FQngytVSfI(6+0ErQ?q#Amdfe< z@>C~Y$=qS{ofvpdjRhz9hI&m>e^^Cilg&~p7rw{Q?V1@fy6s|vuG+VqrmLH_nZaA^ zAXo0vk$DhSwtH67KSv}E13V0{ca^1h>VY&Oz8I9OPBLP`94wkO44h#FcCvt-kEk?Jv zuP|p6jVLQ-5()1dip-x(dQAhbAc{uR)hXgyg_vPNZNn&GLKZH@An|`T&tAAJymX3n z;`BNR2*fz_yOQ_z%#c|;>&A?;-IkCPS8(9&`Ptv{kyG=~W(vC7iNDfqHC;{Q!htqH zm)@NWJajw-xmmF002>H4CeJg5K2mW;o0Zsi-%`L4j;B`y^1+0t&v_3jT%cPhqh?J= z$DQ1RhT@4en^Vtf@}jU!p^#EB<0IiF2DEuGn@P?x;BW@*gwd!K#^T#PUWILF%Sd^@ z3|L=VPkP0<5hMlbWThep)B6K@pPH4nL>_i)Gw4O?3kHK;c5^LDIM~d;ZJoAjI$}@`|yq0XJmT@sJ6*A>Qe2=@`2 zc1Fm)U7@p2H*T-HN7adu)^}<9CiQi?Z~MNws{)AVd++vmje|j>941)+%B%R7X&Ekz zzlr^??|dVDx2Kt9as;yYkSgBv6g!`g6JC~cFG`scW@#E703~nBO*S&DB`@*4V3v3+OH%r%g9=lVfvEH6^qNl61J;$tT-QW+ujHxIk?b_-+ zD5?Q>461v$6|Pi2ZG(1z-t~9Tg^VQnu_4oD9ds2r(&x&>*C->RJDz90+h4WspUr%b z8TFZYYxvPDnEXawo{dYxZt<@F*@v1Op4Z*;37dZ0z!u5d(G<6oHJv#b8pJ^Zb$`R_ z+h@Zn2p;t(0pCMEt+b?=gWb`E(B5)!F>(WP;$aN!D@+>3cZK-rL;{7~u(K4*@EH~r z*pB{{^CzB4&DAI7fELul_N{=@=V3)0g`HzMT0L5{hB-rb9XZJGrLFa`8Hbf;O;sN2 zc6S|6N&-D}xI4k~wPE$GP3hE2-RKZ)%rLQ#~f?`-M+4+XXFC&rW5*w zkpN(NMrluV)%keEo}+3tgmIbbu;JHhbPM|gIKd#EEH`*|pv1j~Jsv#f6W>qn_a{Df z-FLke7Ekx4bZ?crHkW-lrLvN}6Ex(d^pvU3rdr?vMom8tCuY$kT|TYzweEaqzr~L| z^G)b4;KTl7e+382AMm3axu_v+x_r#@>Jaf|)m|qxwv8vC*tBn&h*~^7@h}xm*Qa=4 zLVtKGk+hW0%YL7GTQZFzT> zt-i*vF(HTSR%A7I<|&@H$J`hwTP%*c8EW!o^Ve_=(;&EEeleX?r|&sdrAv9yHh!3Nry1Tf zqOUt7Mx|hnAW8a=R?z!?|3?+e_1(&utoiZ8%q*BmR89Hx;cj=u6(*gYv`()NMTilp zQl*X5wb?|s88Eb}!=}iPS2SRkW0|Ot${{7<1vX9Q;9#EpG6QX^u^GKHB=;g!(G)mX{|v z-+pc85Ukpde^eCSKD-!td@#Z2G8aE+k>T3#`jORSmt8awP^a@%-)Ni9NOlFjAypJ9 zdi=0boWq79Zt+t{L3@c$3bblj7YR(?(cax&q)&JJT>#~l4UKFy-R#}M>!BB8hyLWw zX?JPwsu8YQ_R^dB<>fg`I%OO5H|oG@Hmlrf2GG9_ZJyV(|2e8Q)cj)H`#fv1Jtk$# z-qhPCBZ`cXA)J=kzt&1BRH;f{{6#W-voSH5f1~_Yal3lglfuF8l)qCz-E-=DVh+PIpn8hY{?Pd=4rrwjU!s0WdK;Yqfk42L+*SnKk!@ot|gH>1@s%7bzZ&S+^-! z=OXQU$?76)d?!!BWaj^iy|;|2YfaXL13?oYIKd&f2X_hX?(Xika7h9LcXtSG!JS2d zySoK<2=4GrcJIEY&+XlNcb`AsxMQ3jFcvb_n)5Ats_Lnl03~6|w3@@Vo8_ddxppZs5K=PyDdta2W@0Vq>f&$uILYaVsV!Q*=IjIUFaJIB#y ztc^YH)ee~ydY(7;OrKEuc8T_ych+Z;+Ma+=D~D*ha>av`+(IsiyX0?}S<)Fi*w7*U zJzg*UEeamAU5}eM6mIh4m`+n1@bie;k_l7 zi>!}{dQ(3^nYua_=e-{sRq#~l=!&b)(6VK?%ZG4&O3KzQlJ~_S;AiVtLf^oR_w9bgd5-YKp1); z5N1X1w&iQ8ncZ8ulmc}E$;_@_I>8j${NCY@ZwYbm*i$$|Uj9~BVrdC-Qz3l$ushx4 zub@qX83_+C!i)ql_9t80i$&f0c&(@{TUW``-43u;FPAa&aFl`>!bwDBvTj~Kh5b5J z(9m}*w>_7^abPD^qXI}#4A(2!jFDIq@gPu6)%;tXgyTJ>qXTZI%a3zC$DQUcovTiP zT6e&!Et1E)54#^f3B~D#R)|GBnmN}S9cSp6Pk!<51Sh4sVln9CB^)*dxU)n8w$Td} z!jQo!tWj;8kgC-t>BWinwvr*Jxvo6B$^-%A<0xX%Hlev&0~W5WCYEop?!znAy0dEJ zcrvVWUBdJ@*cHK88YtEqy^*r7#R=buannZpt8r3f!so8tb6^q@#}ifL%JW$7bRZF@ z(sW*%)KK7^L^f91nrJJ(vw~N7$ce$rgIcOlk&ucj6OAPBw8UausF)F83~J>7iaB^& zuPW9p3#)y#NX?j=woJ1H0R!mhg$=>S$1iH8WSeR-LF-RsuXpn>HzyObNzLV!FD;`l zZV9ScP`a%Z$*9TZfC|CL{sQjqzM-hv##+X8!Wa#@9}R+e!=l{1*l5LHyE{8^5aEPj zP)HdDDs(&6{uuabJ%6g(o!sUd%R7t^Zh#dwQ4kit0RQS%oWv(ZAT*&= zzTRpcO=Z2|6}nRfk$1w!{AQA%T8s_PO9El5X`6)gNc?$G?dTM4C%GH~X3O^u37?ve zRvrYNN>|?9k=&tMHrhiy;&OUrl@^!LR@w9rSgy?ddYn;h-`;&g=pN&_sVNF^2k@+e zg~pJO0wr5O$IAtd@q%`zC#Z5Eva}iKL-?>~;L@qj7R--`&{9D<$cO z?7ujTYdZ!%@&!61{{PTGD<}6xhgc-llF7Gr=xNXyyqnU=-8COSVm2u+UYIxx3193@ z$07duy*AR^-FcGG@f!V%Vd6fN9&{fH_aum#9B~|lHwvaWVNgkC3S5@x-1j(HBRg4F zyq5ACxA2_{md9QIiWOVbdu~3}2km{LaU<8LYcLjwucgGL! zMB=hRg}8Gb8Y#tHP*(hn_>=^vrl6WoA2jnL;8ZDA^rF!IJ7kURy6QzDij>XFFu&~@ z%X5o6PlJ)*&uE1&Akts$5SydTwXghepD1$ZXi`ilaWfrO5We(XsepapIQN|M-R);B zzEu$lz2&aI7uoE`DK8sJtB&e^~L`eKAtnk zUPgOC?PD$i3Q>p`KEF?h>7WL3evX}T_{CewI%Ns(1396cW`aNp(p1%*O??WpcjI|7 zBrDvuHv>_bE4XuZM^uvxT}p*l2eprYrhf~6dZ;wVJQ-oLx#~FuoB#ZoIjI19X-&ij zOTDyEe{8_5nOwrnp)~4`+j|c?tQBks%8yT( z!hSb~_MBLx#Q$?wzR82@%ifOwmZ<>#R}=8*J+V(#zNu^qMLs6QD|!AhXDP!qCMTv` zOfgE*QV}<0pa97cqe6`hfSkh7=P@mDK?)KDg^mrM|)vduQ;Y z=Z2gOn@+v^fCE1HR$vpkteDlSu>8t531b;*1=hBn+CzWiO|mLiEH&9+xqGw_C${g1Oz&ia});<{iEFJ)a%pEm8TaBzMCe8w`Z9W?Q{1=9>&KIJvlb zxwo&6*nPsn3bxUJB;i$f`g@rN$8u|uw$^gp%jPk9jn^1w49hY&(@NW5j|Z6WRQ&~f zn?1oDV7lQ?iUCB!zojSAKN-}@)13Eq=vj@Mj@u0^mzzq?OO-2mY;?iem;BzhVXxxf zD-*E=c>{f0MTB|pSAzskAnwhPM6uz=j;OI3=Q&HKP@M1yn2_UVQs&xxeB&^{3v_gK zeK#SQu-=1^o3X^zFEVYnD7tcqr(fd+kaBj%md+gUV6C0DXlz*0VP)~=B;3z7V%FzA z$}BpX7BD{@#;>=udKcRF^;fM-KZTVycFAWY2{{q4kMvqOEz*}ea$d|d)?8)|F**0H z%Mvcgcnvm&9tl*sE-iT=es#eW%tWAJzux6Ptd*&tSXQoybL0B9gG~7dg&vHxS>4ma zli$>vrq@6>|AO-k%~Z+LQhjpB7x{|u0JZm_ne^I?n!HUecjel`p5eSLKvAA!Yp({# zgh=>cllBjYGaQ-iRPpO=1mESj2wy%V z9Io#C%+`LUY29Z`WpmfhG82+c8K2tBB>uPgyWnS@E0t~|RP7`2dEau&u!@q}cozwl zweCX{bO)u3sL+>mtS09J)K;Iz{)1DhiM$-cOf01WfXnnDw)rUsNlb0z@7$%S)_>+M zNg%u~wM6MM)y~Z z6V0IGjc)*bf5ZJL#)F7jxu`7gW->Y_==Fg%7p{j6wVnaU1E5MK&?O7GSozYKZBnqP z7U}9WC(S)R6CS>|;%>5(e@mijzS)j*v7wxi+^Yd%!dxtwb_|*CZtt)WYOvKU)rDY)Be5f?1*`IF{)HBqEL2ACxaE= zfjfOqOk;cM$F>+GP^m$mD*6nua<;MZRuibRDm2+L0V1xmTQ;sEj75O z=2%+G`5P`@#gK)JFXKPGb^qm-XB2Cx$F6AiO}_iA$ z=pJgfIWAP*m7~XKeUA$w?iogR7%_5 zb6f5Al$2i{uQu6F2kK5zzRcHH3UWFb7r@7w7RFw`);wC|e5SDOapalp{?M4r%2DV`@Eu7@$O#^kX&HgxL zF|fy>nEUJaH%ifSe*;f;+FbMm@o}o=qOJja=4G zN`t^zk$7zH2X!rkx)OeL&b$98eL?akp#_+S87=#r5aI%Gz5$w^fpYW-KwZn+thQspNDrRU*l`t`{RuhvscI$u zV7rvM0-&ecYXOIjs~}=d#5T+i@S-Tg>s2AVXMg&fcU-k@l&01ld>vl8r3#%px0K3q zYj&%kGB9jY_$V|W^`tE`k^zodNcz1Ub*c3VodM~vD+<2cm3k zm%-O$c~W!1lrr#i34}ZE>~`-?*!tS5n^L8Els~-Zb%qCQ5)j9aup9x!dMaJsbG~cA zd761-DSvp|sGa)3rbs<+ZI7!wqd{7xL88jct6t<0B&lV5@_3hC^H^>Qg)=h0*%{;{Go@_131eS7lVBs{ONq^@8T9gAs`)gu z85qMj8Mv{cHWCozH(18n26ZIx~ zGJj#skkfIMMDi&lY^s@LHh|L+{ns=mD0;uKj@T6$eRA4n=fTM^dKxAOjs8%GDTbrLSEWSfNFQuP3)Qy7ca?LgUS%Ueu!GLN}Rt4nZ zh*Hv`(y01mKB*5TQHD(NgCd?Bc-@Da5idi)44Se%!tJ3I;Hm3kpa-O$*Z_wD(wngm zH5<{1d-&btop~#p8!|ZdCN4S|N>s90OECKmp?$6eYWHfRvbk)pfYAVj5nKGJcH$9Z z9Lfxma^^bAF?ITpyUT&Nxp$w_f-I-*W7>+RJ|FSFhpMB64srirvy&1z6ezP`0kGYx z3KcGjRW@9NH(NnKC8c;GD}IsS2?)QED61K>98cyW4EK$LYnV6*%rifKQD<4LRJ61K z9jpmhg|3NddH`tp%C;WqC2Z5{+CAoAY+U#p-qJyb^gObBZrdNz81}e2@}^cR3UpV6G5V84XxU#*o6} z^SZ{E4(U+p9WQZ|ZGC9y_gzJeH$Gvv+OKla{4FF)t&K3rAKeDN^LKoF;Y(d-1f~m} zXBoL>%~7;p8x{0nqa!sPhY67>K^(z(AKTDhSxYZ;DpijFhji)1JI8tJ3A2S!J=tjEM) ztga~TRA6v8`4@lZa%gF>u3mdb6#X{$P5zTlGh~CeK@S`mn6zwO@bJtEW+cGmY(<@U zNy9|q%RKm2fMPrdl02HNNntV;H;WJRtt_JR>Dz2xxPJ2zAkZrxlh)J_`EsTKQ{ZF9 zy3^~^*pm0Vk+0{2kC$5utQ!$Q&Q?8Id)s1)WqQ?dr`rQY7MQsw_d#E$@jX5_dTJ*3 z{VmAWf*Ty{XU7=NBNh6&;?)Qje$ zyq}}qK0FknoA;u5X`Ya z1S;#+ikm*l@tO_mX5qM`4iH-bh?2n$YewTHIAglW^Xf=R2F1oEky<+Nc(y|}^6~Ya2v~k`Yu@%)=AOk}Hq|szm)@Li_Y`400%ntX z-QVF*w)yUt;@p{$K>2W$;W$&1 z*L@WiUOa(b&(-<24?uO~!?EtzVYtw9bwuiUF$n&f8gd+H)!JU+qd8$0gIFTQXtbf* z<03dTe#ZHEv%c7ghlMSvqLmhxM4z{}u`RjX=GkxGUhBn&)BwaF)0xtTH4|5u^srLB zdYHx#$(qFz2GIQ*{Af1$1DYepVWq+rl?3dGZl!g*J=B%5vcu~!k^9#}K%+AJ$Z(?> zZ+q}sZELtqO)gqIsB=_^l6_#UfxmC$cn%p2?T{r)hLCqj!brhK=u_+fi^kLK zB~OCMChs>T9}2ORdXy%*FDQXt)1HU>oLD45=ua*F+$^FI`NkM-IxVIiO1uFZewSOG zTI-o~9|G<$V33(u$TqnOOLYc2`c>CG=@1X}K+ym-Z_t&U!pllToO+T8vB3h_ct!Pl zS)g5ni1ur<{pem~z39V*@8 zTE{MgQOdWh9Q!XipJ(W(zvn~P0wt8mtGiVu^?Erd;>J5*Xm+Q63b#t{#%|-6|768g z{a!5(!N}?g8@^{zd;u`!6@PKQI~9L>bx0qf_sT`bEB&-KGZP^&B9%iYS;e~+nCx&k zLvXN9ZU!c~CVDVI*yNCLjAmJwh_kWE(7r_eD42pui=)T>XQ8l{9?=A5wT`=~c% zaHkS6hHvJXd>=VEDxfr0TxRcsRHxoWRluLs| z!cV1A0?Q%Bu7kn-S2&qwHy-thMcNjiqSKty?E>5DC?A$@z6_i-M%#Rr3w@&%()=Jt zu;yI49bXcCM#!SJ_JUj{J)KISqE<59V2Pv8dMX^bOuA5LLU~;LIG~y#nD=ZdykOUZ zc{QHz9*Np~)ZHzRWvh>$#LVv^S|_!5vXfsn^LoBfTzHF*F`SD^xs^%hW&6!_{WW_+ z$*NoiTM*`#GZs*PV{+ulD9XCUOop6X_7PQvAYB9r`0AQBQR}{RlrKP&-g@1)?%rBe zwJUp@F$eV&AW~B0ZqQ_2-7F3UKu>%{LLA2#`ikv#)}85yL0RIX%M$x;3HQ0Cikq0H zs3w`5Tgv4b@=2?ANDW^&5*s3NQrJgjzeGuwpF<`?3{j3%UMxq9{dshGOFoNujOtsl zil{=e`sep1B8FlL*|WiT!oFXw+4sR_EN8;AmW_>_>n^f{D@JwL06jJ~Uhf9B+0m?c z4m;Ptcy64`e5Q`obf#wS_+ql)>3#LYITO?KrY4G`u+8Ct{ov~ybH4WC#LIahZVqIv za&4+x$|Im5aYxVV`S@tGCiEyROO@6>hm5fljTpIz+S$bfDL`&;|Aqv1G$Q6!7ezo zg^6fktv}ty0qllB2X@2s?t zTB;sV9`bV^7!Vj7MoT1_%K=C?ReNN5VjDk%8Rz=;g9AD*gipSzSk0g@oAe8qNX8=@ zbX+;_I(9~&>EY68bt5nGcs|A;IEuPvHnakaAk5VP;VQTURG9FC+w;0KU?b6Q1~EIm zt}g|BUdfM`t-His^j%MCf6I>+)+By7LEvP|WuRz$J6oiiW3n8*ZSBJT?z;L%IzVjb zSfr<4Gbvhs&!@MrO`n4iQdZ{q<7+aDO}CvXdo!qq|J2LKb*&&8@BA^}VrQb%-Pt(Y zUE>fDlc)5M<9=|P_b4a#hr2Rlmo}@%-PTkmJJ`Nw8^@+rms9afZv~=bH`7Jy-2=Mi zP_gwM>vnH^EI*Ww{K}_!42u$mvumJ;OIDwj9dG512hMz+H*8#V41`w%?XyM!jOG4n z5iP9WR5SJWjUHUhXRT7oJ0F9%!ZN-=&PX;W0GmbkKL5U64%jzzP6jN6YKwr?L_>ru z(afW`I>?FRQ6ookWohZxuPl`Ix^DymRc!-?57g@w7YyAVkpF4A+!@v*_Ht=-ijV#k z%uQ(c?hm>J*IeE^q~wU{sc+Ad*-zCV!e0upb}xDe&9iF`6fS8!X?l@`(J^jHIPBkr zgrGq<_<6obEA;csCTc*&5K%z>AOK|y*SqX#_bLGLiH8%_ai;llzS+v@@c6=rVSOl- zePttt`=}3XUFafz$l_DI&XfUHtQAz9owlJDKD?hhYW`HZXeh) zC8S8)ld8>sKJ9;6j%N>-Uc*%#VrIT;yEy7Oovg0lC`raPAawtwTVdUql6P5R*OnMW z;3;b=b0-rMQ`{%HzS~Z>;1Sbi@eKSj?N;X5<{n_0i~*W!FJ$#hH2avSruBvnwu~fhV+g`gK^rGMgA(0QBU&b)a1~VwYh~4@kWCrw!Hdt$|_Hi z-x{GPA~W;szDHTsLQ>M(xo@|6%${xJUdM3ttbe96hPaI^$G-t`E#o}NusjTZ^Fr~Q5ut$RB`vaQV} z0^cFGg5Eu}uhCAEn4UW@uTqEOOvi#?z}AZjuGF(9)vJ1a4{toK=(P7=t8p7sASIF> z8jJiqrUHu}YD#S7q~xg+qA~TkDNkdrS8Aw)T^)9%(<46sk3P~*BMDV_ASj?6Ol?t0llQxY@wB=n?QhsBl3Ik$KN(;{8Axp9Opk?kVL6L0Xhhh;{Q>( zQle5u>tZ<*hltDGSG8HPF(+hPP6QA+7zan zRFkGgA0EfNF?Zai3uNU|SyWkmsfQBe4ryiDAz4jt1~@&j1YJa8h}+2h!XACGK8Pp9 z7Yd8#vf!S-ck@PE(9otCEJE=>IdwIgi@*Uj9fv&UD{JN{d3w27W&1Gx7CbYv10MHEs)bdDrPjcr-c(bcJ~T)3?vJxZbF$I%96 zv%Hy{TlJ8j+Y815&f|GauupF3!Z$|ixzKb_t&YcLIMZQ8vhIWZ0^D5iQk~eTsxP%F zrQNcM88kvc{e=f;Q)LF)M_AfpfC*TI{f92&H(z3(>bC%Cv$!SXi`*LyY3shyoJZK` zKv*qvgynWtyS>?MtCouIeN#((+TUJ(?|K^zdnXCLJ7U{LBs>XUTsU?BUpQLkn7Xyq zkKk|ZMdI;NV-&M71=%&NYPvs6nE@_kUZ>9S(-$ZNvzjGa?vc1sr-(Q!pY)}}d#xGq zj@{P>4luIt_aIXvPTle*UW5Gu29v8QiA#=`M`%P@v)*@~2~0ldZyC zu8aDeoV+CwI-$?q^b$>2v(Zo&x(!u_=vJXoV`9$MtSvj}y3Hmo`QC1a=poUh>lDCq zx$(mNxMQR=U*~GRMMG)qsdg~qtl|c|&m|G$*y^`jTR_-(!K>8b#@Lt0kl8wvV&k=0 zTswZeT43Bg$a(1u^RLfO;Dx_Amc3S%OpWKbFI3KlcDiHF`g0PTOKk5!Z^$w&w!}*Q zuo`yjnCQg=rFHm?lyELKHc=dQOQL#gIjQ7c;7*>e|8cVI)P><=6~8aZX2jb{D|9V= ztM46EhwtRtTUi}$>aPYWN&2QKE9lXIQw-n^pf{1#-v}4^sxrmF$c%>T-=T_Jnf5*~ za+|%o%woF1^nFA$F>^i6S=ftpjZ~)kA4Ha58z>01u^w5LLNgdv&F2G7bZs0GH|W~fhZ~#GM+{y?)qA=s^9HEBC7|qVf>^H zfXIL8H;9mtAnKv#KO3c*zl4Aq$Fd)|Tc&#u*9&cg6PEoMkChptW!J{nfnmP2GEi|q z&urSr0HOJKe`B%`D55K|;KgpfRoZw8mXb5syhtbPb70RfqpoRE2%)I0W#@LC<0%50 zxAG4A^{&CFkk$@cuyrk~OcW4s*?R;ILcQFrJe^DaUj3 zV%`y(mo%6oaX|MC_Fy^+#1~VL>B;)@UVPYo-92A^cTcf(y+b!u$M%3-@sd&_1j9tj zzoY8H@c5w9%Ewaz=~#Q+r2ESq6da}N3SYLE2J-t)A>luNdd_2B7*q3MQy#DjRd)8m zlQ>mkn_C-GyTags?i{iQXIm&<^TPQ=*V$fyedcucX7 zVcVC!cd3b^*7%W@A1UT`znf@$5@X_uZM$@#R!~Q{qLvN;BE27zw}jSSC_bgy#g_k7kJ3_y2U?*cOdh(_znmKkH^ZZkCc5z2WT?u~zbV;%*9_$3m@FvF)O z4Lf5hUECij%-}-sLDzf;hQ4;T7pFwA!cfU-?LM1$YBfVl2Nl)jIiE>ItZwiOF2s0- z-|o>qK|*rh)BG6;>(4>i`-xe-@HcO?NNTC)MgHn2_#tf(YfdIq$cg;~lKvivJ0+Rn zh<*w})MuEjp;<}Rp51u{$K&v8QsdM9WTmSJx2E+{cGVf}vZ|hubyGpI(c5JWM*+P8 z;@9wlV8sv0(I&~3n&LDfIvR|GX^c=Dh;GsLG8A=dGjdlb%#qm!y{7PRFJxPfR4mH& zSx_=8frlg?{$(C#BWTVluO3DI03j;F-9Fn{?- z$)#{R1mTE~<9?T_yt%UA3;#lN`!o0awd8v7%Dpn{886sN@k4ktGTBp8d4~|Z_|0ul z6q<6(EK_=gO;D4A?TRU0}H~xt*jsWL)Xn$l`g~XCsA@El6LjM!LAz- zX6%_;d&h+76y=(R(s?ku)Bud8`45KNjq?fFJYUeXr_nFZ)B8}nq}V_*UYau0lqCQ0 ztxLQSh73Q$<7WM|fgq#nh=rzwp{VrPeEq)=l)p8Gy;GJ)5y15p!GeTrQAmf z#MJj%Zam!Bk0!i197u1y?JFGPPdU@Xw59B@-R;}A;_De3UV1Z?H`#bl1=TEXRv*(T#=}MOO z=0(o$?M$ea)vpT=nzBL@J1%{}iRq!;?lMN5OOR0L&7M!A&3MS>D%rvbkRhpw^b~q^ z;K|sN*Hii6Sbq3#KZ3fRsg5h(_@auD(U1tN>ip|FqJ|!+tWmVnx`-kQHT9nE|5rtem&;$*&M<8Z)a z>9hYc{s%wf{}r+G_mWV>nDo?OP|Gv|C7%HlnpL1a<4ezQH76c$OO0EVSCy%0e*I3L z7-3ZCBdD#jv$NL@jl8d#0U<6f4!y!PaLP?qvzz^-^lIbQ3{RVg-DYQ7B@&1oe-9^r z{Hj+6h|_9uUftwnE8nO}i@+(drg2ICe3;h(jczKZH58@5FJcwa)jVVVlh43Z}v$tU(VjwyR?j zkGEuyCybR$PgPnx-#c{uJ2S$*uh*Bx={mJV&Q70Gd8VIBwmfd!@_ra(4)mg>+C+SOy1?Eas-SQRT%f4NytXf82c70SK4Cxr3HO=$Xa1Sa`vt}F8&<_CS=fqV zXsky%7d7jvlmso&glWk*l5kB=o8co9G?V>jg2*#Dd**!L75JF0Xg?hzE~NaDlLi#X!s<0-(8svaJ?-1d?rVPoew+#i34g8 zc(j14Cv|PJREX;3@a#T3^|C2Tv=$RaW>j8ne?C0t{w`9Pn$q?dPje7|mw=3-}dk7t%pkPQw zMn*+I-JF)U=oUy>S*Pq;4^nz>D4M@&yn%F=Yq!~M*1r;HyJu9)>u8OMQeUu&o;5im zwHTugj)l~n$h9E_jHehzB1W@^+nme&&QXK^M26ELZ6tfFPA>g{ENiyt`+G>@S1rqH z+Pm6~5z*PRvB_@VkMPG$`V)z3=L=5B#+%3UGKf}V4=tzH>)CwmVBWr&W9qjBo2+&- zmCj2=AoOL>c3mWZzU{yNiyM6b*(jIgToe-%g)En_wped9_YSHBs?<8YuP?}WyL?Ia z%+V5%nrvUSE|g=vAMOa~dq@wubX5QLdGz%-YYS!{*d<&!g;7ZoFY+pdfR4oTlrSc| zOtb&lGc>YqZ*j`V1&k?0dJ;lo>*&_g--MVoN3 zL(B+L5;uLm5&f05HE0P`e@G>B?v~ATd{e z8N`}2>&1&rX)VXid4y|jJ>_e)ZSQV1BcE72M)$`){J)$eT#&%(4|v65WB6*Sk0Bkz zlDKdUV(qWWCkPJbTg8wFoYgSJhxv~U@;4N6*RQUYQCl|^9`{bth|?Flerre4{@g*;vp9<04#84g3Yxx5 zQ3{5QU(RQ#LDXa9mUW=jTB9YQhFVq2L#=HVO*rjC`?us^^)P*-OaY@I{nF$xGt!a7 zRJNtm&BwnMlQ2M($PvkNJIOIMdqYk!0OVYovy2~ka*U40q@c!M0g*82c=rc9{Fb!0 z-0=dK-$n#Wdi8$&W4Ztq@)tvYbFLMWghuT%tFOlCNEVm_ApOX=G`_J~VA_o45*H!~G9LtDF^&4Stj?aEU<`4uALc&wubI*A zY+1Jn^-#J|1c-S3&G}aH>UAEs;tQu_`|EeM>=HW5b&2w@=%TB{Uf-l=E}_+9aL{t& zPR35+gg=yf43wf&nRTIq&ywCgV=J+%$J{G=v_h4duRBk`3b7FN5lzf8in0)vD9iv{ z@qr)VvM_Hm5r{7P)uO9M19;y-_OyK)Z6 zAo3GPfQpHI)3@w>N5;y^Dm7qsC79-0rImI;9OVg>bLf?*anleJp9ctyjJUFHMZ_p^ zC{~dsL8_626HUFP_NT#|N=e;wjJA7+F%z&i<%KROh!5$>^grcw;;E638}*vXZ|<5^~dvDMd>5uad-g?Z{6;q2Ae| z{w}6=s;Jaq(D30a(}us{-cvu7GdmrU04#>6PF^ZS^)<-p*F9lCk$6F>v+w(D_@-Oq z9z^QmdB^4~0>md_WgHiNVgGn}Ie=2EQLgwq6aM3G|MGf&`)7Z7z_lQWM4J2$ z&gzRJaLu`1u;bqUgNy!O0ss5L`d2H{2v;%l_JlN&D``@YR=%0j%VBQL7RP+1_9yF|vzZ2nm^G zI>fH=BBL8MIl9~*HoR_{{u`Q05^AOWbQ*rP9GAHS=F*L zqcoR0H5Lk`G`d}d^i_H8c52tCSikx!!2jO?)&D_6M4^ymmUXe?;g1y1sFEg?(3k@u z?PD7{RZgo6Rc4!UrL@CL{~`24HU)xc2ZE&25!M$P1&RI)pLle7y_JXbp)OvY29rwb zRBlPdOY6Zdt-gHXzoWT->ob1(0Pnm6j@&VL3(Z2~aDzD$3dpuw)q;8e5)f{J21%c4 znu!3W@LvLqe}oc5&d)%F{c8Xv3Z>_5ykhY(w8Hp8%hZsLR5$Ki2zW>fcWC;rs%rlo zy#7Q5-cqNEWJlB(n!09>zAJWK*p;k?Af|m;#kX$@yF<|OQ^0?KPyAcRk+HBSxH=-k#3S zHG*+gJ%8Y+2I?ADZe>mJ{x22&(;wT3<)0ge;$J}0eU0BYHiW9&2d2~ZUsxe&001xw z-lDziH}yQFYi_LdJg33;r(+fa9)F`WUi6*zKX6n;$FCZQnJX*!l0&>ja;(z))^_Ig z&e_EM8&KoFiWc;UoNm5$gfDKC{MiYw!F%K`F;_jNvXle#7yoVj6p(%W+?Cyw#BglF z^_c-1teZ+mNSts-1|I=7JiBxkv}~e~)!*oyXMc06p`FsTNMvt6V5srbL&WYJ06b&& zziZH+{aB7-Z{%wDI*7I_LHN8CRUXg#E{wp8NIu7un`)&>3#K*+9}!Z^G$M+Zra)Lo zZI|Rf@C{LPkSZn0F_6%&j0c*SnqvUMcz@FcPcmP%t!<&4Kqc-aq&HlNz|a7Uxc_HG z1Dn`xN70|=r}P>(9l4yt=}ETurvI)r0-3izWF;ygA%la1gW_m!3=Uc> z|DEb^3UV*8zfn)b01C;St)yfK9+$It1cA&@cE*=U>EaBdeI(N^8nrU`d>j{Ta-a`6 z;0m_{FGIAuX7*LT(lML$$9Op^N0nVkDb8J7$*r*2Kf05D?R)%ND6{-Kf$~x8=g-$I z4L8=zkh+l1#pvTUZ%$NoX@Sa_a(z;1po$d)A7kpMn@VJbABej44k_BFJe$ zqPec@tHCD^z_wIxJiD!vIV?i%>&=VqxYCAraqe$l?7I1QYP1+PYJ)oPV;ncc*{+D3 zN@z4|zId^&2^A@n6?@%1$ems*F_@M^Sej{MS;k9_-yJR7(^r75AFftVZ#=iGHR^qG zSGeYQ8RsJo4=#fPFKW36I`d?lx+e|N1n?)kHxyuI* z$P;@&-L9-ip`r~W;S-!qa3pit1X^){Eq7_DRBH-%mPR&bbS;;3?jduS}b4}q;=w>va3=M3EE_YM4?MKA2(c)%wIZL!L#D|mQI>lo1 z4^H@*_f4XFk1j5O`&J9z!de`yjH;IvNPexSJz~RBnar9KlzanC=~cORzn`(aFiGd` zi(=PBM>K>}jv(Zx&lP>5Y`x{9(Iw!XCC1n7!k@hUB+49s~ zXn*awsypO1xx2*2=2HByQO2$pS3cv)NQH?5v41!MrWHzH)=DSl_vZgmS`b-DrB`e4 zEHEyp6c$S&->|3Qql0dl)I5nZr-Ku5B&f5;rK%(TG43b1G!9}D>giBpkf7y)&CHm- z^;0UhNPi-Ol`Y6}k5LWQI;h6UarcKD|Crt_hpqT+_w|9dT7?hFf@Va~m$5DN4*X$G zDZU&1s2xO<#}L!x9q;3g(~ijX`=Q~}ny|J+bwsB@4b+xD@&X%i0+og$dBP`#oV6a) zp?>?&mj_D}cbA7Fbv~%_X*QGYmLgE-+eJ(1&Fpomi8G{Z!%uH~SLYo8$U>If=&GoM z)EhDu{TilM+fH^WA~ZA>C9{=eyN-Wql<6%CITCoQuW$dfAr>wddikd+jMom4QNR$U+^`_kBaXw z=vqsoS1P#^BMCs)+e)#nwdrtn8Zi?f?@ktLbPVQzrd;YxQ$<)RzWA+~FMF;Y-?8g? z(c&m?(b~-G(Mlzj*~^CX+P^qPW0v6s`K4O}EJywix|Hfe9eZ8Ro71y5ANM*Jj=kT>@trx!yD%4{4_={` zAVzRXeN_8{0PCNI3>TN&ARa!hn4@7rrCwXui5`m9m&riU)WhYZ4sfd6Nnk|L9`TrC z;0Po*-vOP|@Pc`K8IsKO5+kO3C-694`6PQ3w?7LSGKBd>$j<{-a4T&P$TSUw>!Z#uOHIOn zX5;UAm(VI^1dM!?(#f~=_q;}RgGroPmXn3lHVZW|t~Oc{0jHY>n-?#;r*!O?KRp}- zH+l&iE8bsaO62GGT5lxm z(8ri8PFWgHn+T$3hib4P{9Vmz6OO?*v@!#&$KJwi*OtyHyQ@jo+7a_H$ZyFbo0+W0{8nYYXtsN zz>ZpiyuAx%-ukZTyGfHO=@lz%6*t2}8>I#r;ti_go3kBRZf%P-IZG%L{pMf^Ttf!3 zq=3U*C)4SwXT_bjot5^4C!r6y5dRtJ-hd?-o^rTYdzfBKz+w2d`tm(|T?$>BN?pmflbf zuEu#ax7{UQn6o%q4?bqT@fLfW+2u*4ZD#s1Ps79cGv7$7xyEP$^-Nnxpz=856_2cd zgMMlY+qUky=0j)ho21lMqaIl*rTiMsQoU=MDf2bkM2*RQUaAt4ZB=8VP%(% z(z}X^h4RF6-yC8i6mx`sKC}J@Fbh&!m+EYS@UI&UH!Uq(PP@O_+r8>hZV+)QZYR6G{3`h(oiww{3C;uhdy5! zF2g-7t1G@TCx$Lg_pnT3O`mC@ic)(S;$lb0_Ne2Y82xovp-dgfe`y*}+IbJU}A9A~a&?UpGxC-Ta8O6}L!toa#N zzG{dUHGhV(1Eq4fWZh{scWEB@uxXsO0KcGL=6u25Hn=h@P3=8Z zSJl)H=+UMXu`xv}qn{%edKe@Hy~q%iiSOU%Kxu+g&MPT1Uu`*3!oe3k9k`SaJ#rLx zJ0v(n)k8NJBlkBo>|NhqU%Cnln%#h=u!WpEDV=2`5el`GLicdzudQU~6V46#HpB}j z2}WRj#j${F;~*ADKsF2-U|6tw{zIUo0*U0_*t*2eN$3idH1GQIhy&$yQ~%~=j>Y#%s_9ljizI(p z|63agw)0pns6^UnVv~9OFyAWae00N`j{|4^4YF0WIdNcpT|mOshSeQRY39}`@gK3w zn_caA#{F2eLO{!Zb;f^T(G}6XDn}isx9?^{-Uq9UZ0&VC72jQBUh_@i0rLB*m+ME+ zT7gIlJNYzg`~>A1{0Z``X{XQTLpm0q(TSL0rv9T;frL+~tPE)?LC|qG9k!Bb;p}{; z_>i!HydN$DS=DBq2G(Qc{Kgi1Ftc!W(dV^&Wlz8UWRHx+U|+{V1zgILN_C1p?KJ1) z4VIee%`(i(Br06hWn29OJv4)?w?Qnb-lco{8QbgBB*))iJA#;>ui;4D*Ab<$F#4Fh zrq}g0yyF$mhNHn!X2{S%RL&`k#@u@XQX06vSEy#CE?Q=ebk<=gub>(dR3(a! ziv4s+p8phYA5AhxpKl#ExPp zLWC+}vQn_j(Ts4>ma8IgY<1V4+WNR@6!P^!M2D22xj=@z*C#T;q1%f;E*sS0vodD5 z>f|QD$^f_g%S6RlXU*|nY z*64A<%@?%;#rPJtgVEdWyFnFvVCh-%s}JtG!`Us_nH^=1N3opmM?9-G>Zz*}|Y%gSMp7X>W{!jjh_T3$hu>GBPm(Xw9X~z1S4B_ehUJ)wq$XC z&CnuwH0LSpp4EXjHjh^YWF~YyLx5Si*HqH6f(>a@9Q^Sx93Dmo-zt&Akv@V`V}9E* z#Ltm1@h@A$Q%C%80l5V6?Lz{S;P4Z&j0L!+8c0d>ij3|UK+UgT06}iLoZ0(k$-Zj; z#SF0{Pnrx0#@1{l9MkSFb~4qt8*uq3rI~c6W>=2ZhseQjOB!eu=XA8gXy7TyPpPRw z-o%w7Tv=DV)PNJ<-+*f3*xDKzGg%~1Q1UdH5_1DKJSZ|YuP?_SQAl2!pbjWudwIU%fYzU_!3^y0$a|Uk4Rxr*u$O1EQod@)aV+R0}}DRdE518mF@nNVA7L-tqRarNJ@Lr?xWm@N1`ujhp(zRXO|r1ov^lDG z3m-z&uCVG%e${&9yP4Q_o{xRbn=3kpH!1%;^*WgII|Ai~wyv2UC+hb+a)~m&>}?i* zl{0zurg{udQUoMfz*a_-KgQe;b5i*Yif|e_mU>eLF0TuuTr*M<(gKj?$?S^iGQ96( z-N+NGtAx>0zS~U;TT_-?fwrN62Y(|xUbx5zGdY_`U;^INiSCoLylLrD$&RKW^^*Hv z=z{I~dfHM?XmoF*6|X2osWaF$G~!Ctp8w=g3(^vHpCn7T_UpN4Mq9o(FruJ786FkJ z48MjNG8uU#K9))ir_)}EY2btJH+sNF!DpeOq#xZbU0fm4?xLc))ZNb0+{1h97H*}n zPJ0p(MjgeUZ-4c+@LYEb*_&%{&m1WA2yG;mK-B{5=-!N9=;yfj>fj+|l@XdECEmot zsoEUS7wKU_>T&QOkA3wHx7X=Z0aI+W2EQTvG{^IdiEy}gXErmD73SV;+2;kwjh`Cq zE7Dxi(*WbTGzY{l=qOsP$QF8v3$BInwLgkcAg8hze9NG#^F-t(JvnglNTuX_f6Mu+ zEca#TmJOXN69dU`r=IVCs7~BmEV-~WTD#&QyLgj>*l7yFh?&?P{&?UvRHO7$ruY7$ z(i{BLR!0bFbn$cs_9o|!8P)@en+=yVZwOD~x3cF#&Kbrk$Hcotj1yJAVp;`j$O^Zn8ua}PI12C7OR*LMhPv^-7$jPIp>IWaBM zP-=h>WXs3ohp_)O6aP`=aY7esDYn^ygjabEcabWP7fWP~uzlQlKC^vAi85KN7DQ0T zF3!hH`?t*Zq7kf7b5gMLg*cIRJ-?Opl>G1H5IXpCuZQT;z;%DUqlBZEXVAT65d!Dh zP(b!&7j7+GK&Q!AJ7fdVV(U-=YQ4f4JAIpd#ru;A_Dc)= zmwWz+AHx5Nqt52ikgv7_)V3GCQ|qMjR8|_Mj|b=&q`(!GfEY98I|UFr+5zQP%oU$TiE?-*45h)u%i>&I0i^G4`$X zzvrLZ9>w>|YgOqAxo9j%s$fJ28YNz7EdSO!<5;T!kGbJq#EOFCLqR#@FM zWwd9hI6^k$hvWd%hKDGUI<&qp@;>>FJeax{!4aS1xud=!w~f^p6VJ_UjCC57DSs#t zGhE>R{+uLe@^q2s;mPLij(}!wv_+v^fZzw=C11W}=I~TIU4sJl57hKvpszY-uYaTQn;uSS258`Pqy&%iyNOUG|r&6A4s zB~*eVZ<^7%p=SSpg#z}n$#{bSv4jTP%^%j4gezP&qqsZMlc z`XxNy;No|nO;YA|{q*rHV|%2sl=E}ch_y=-4jwcn=LvEanmHo~DzM~}s4BJ2IaXj= z`&t5x=8Vj?#tpCa|B}?+D2lcv7|iBr^-0wn_^_=93!NyFIkt>cg-rL z0MWyi&jaB!-rTA<#c^;h*X`MbZTAYTUi2z?%sfIl_AbQa z7xey$UombrdF%Q*+@5UwW)q>ihRY`ENR%?)a;~h-wD@cRWk*qTh2q6*4f@crjU|~} zJBsg|5-T$&Qan_If zDF7{`Zp_^tt95Ex3+Q?HTVdy$E5<)~bj<4Cyx<@#v}5twWc;@z&Qm+J^0harCV;48 z(>nPS0@Plu()*qJstUtRv(Akmj#4&PTh-0PsW9uqA{d9LUfHX3Nll>_!vn9sFYZ8I zi^ZvcmG=mtUZ3BHOKfgM(a)D%cAwvfwX)%15&#vCEce&@xw@N4uzCl0gmX(-0ItYF zRdz{JR0@dYh%6b4M)+0N#Ebd~_4>8LS(Xo1ZjSl)#=WFglo1xbvMnHMtC8-!ibHj# z@&-v0@4d1T{->foC(uSaJ(=L;_=NDE)rp6dOU4qY?fd3U{IApPt|6>`Wzl0B`@ zm5QRB@xk_IV5Keos&EU%($%-iB6A8ZTkrUK)ID$>w!IM&f;}c`A)d;+KJ_<^>PJu8 za7y__a$NlqgM>FmT;KnKxAG;#@^@3yUQi26>-ti>@|2wnLqsKa@A5H&x}8YLV^2LB z>2#N4dJJj}nUn|lV5PGM$4v4yZ}Bcq!_-|Qa23%CP96tEIOhZv0f@Y4KV#z{86bd9 z4hLNoN%hp0$TPWCJn^L)YAJ_4lXt|eV%p#3v!B$j(-KLMUcRodq$=S;@L#eocEnos zNcktR&Tm7`srnIp^WWy(tEo1O*PwsPB-#g-qvc-$Mf`YsgS?r@`L1ij z->{^OnXcnXN!w2`%~=f2X%ty4#SK=3MDF(Nme>R545fP6A1RqtLZRn%Ue}!K**C<= zqg}|xufBDM^jsG(T5H}L-*&UAD@HyIbh&O&-Klthm%d(OK zS)!qP;Ig^;+L^u6@weYjuwOjpI6S~k23i$l^bM>uId3cAnWei1UDbR{*)Y`SY68<5hbeJbtO zXn^~2E9R@&7E@)e8m+A?iXoE^M&rcBA)O_@zB5CXZMh=Gz7o=49 z%nI91q(q|qceNFgefx{o)|Ts-Q-O+r^{S*Qy6I+|r2W(OI96nxQ?b^lh531)|MH0dp0R#9v0e@N=&% zS+e?GGwDjA-CFZjF|O({MCz2N*zG3@sCgBtwE0)o?b)C`4u7L;=JPLnSI^uuH%p|D z>Ui$&V?Qy^Hyoo~lMj9?y2hYP3q_DiCOukeuzJWHAbC3@Z*yE&PQ#$~UJ^4lY=4L5 zOZuG|fVYvvcexQY!U82S>}&5cT^c!GlsooN^f1mswSq3bMyV=vrwN(_5Q}!gcEoxv zmu2f11=>2v-^#zlo-&Bx$Mg?&oG(ccFZ~Mida)!Y9;Hz#ZGON3wHh5h+ABe|ohYHL zEC}=Wqwxz2=_(BsHY^g{w$YRXYF`r0v($kqF}!m9AiB!LrzKi5_0o% z+cnLRUTUDd(mf-*2N#l7qJ>AN*^_c*JMRpW{7u8$FNWW0RZu!W&SIuuqqVPJB9;J` z3EagQTBH&&lQ+B)O~E6wi=HhUg4P@hda4x(YyB%>a0fLnSju-HRQ`>3+vMCe%$x2h zfC9sm>ifd-ym<&kOBWyE)vlE0QG;B6o?IW;Zgg?AF!i78Gu%--U3}c#d9V?M_H8t8 z3^eG=vJfslh(kBubU~0lN_B%^Gvwk|z25*n8_uAv$$EHPyt~p?C=18WV1EC^y+imA;){sx8wQ7(2P>EYt%ZbE{0q6u@ z?8mTGF4_S95}9~&3`G>0CIxh*vBMmn@gGR3Iaq?ef4pBck(`Zkuhe>DVM#N!R6zLQ z%IltaonnsjPzr{lnIxTGHSM+Gs>1^|hwPRE@%-3wLVL;s&??ZNh)dg(7os3?+2UW% zbAy+FGIv=&lDQZ0NCt97uUI-u?w#_fXJpsyDS;M63 zPH>|kb7DY6zWAnEkud6XYkSmhhU$0QgNg@#cHX{@M{O|)9&Suy`?DNwyN}Hvpb4b5 zvaJa%(sprY2K%*?ZOKbUA>K8zwBgr#rUbN^sOWTON+CeVM*1B*ahC+>1$zwmGw``7 zhlSFgjTBMbi2c%rEqsyEteG<@nBNU(Ot?x$1#6h-e^M_iwbk+q+!5dNT2WhEEk6T! zsB}dG@hI)KP>JxVueXttdq1i&BcoHVmE9duyK{5F`~e^H8)tvC6>yFBSmj!%%?Vqb z(RC$%q`I|2)q8oI$w0yAB1@y;2j-^Hw zzpQEV(qClm<*Z-EZz53YYWb&r8cSe$ii(&L%XCJZM=(JW16iC)%=lDeQHg84UUppH z58gm5F2!%38;9RHhEk6HJLi8uVGire*7kcFdAG)+j9=!A0&RH67+l1(_EDS!YLh|M zo6cEI!i-!?`b7&{_yP*->0~@Ky}6hUZU7SSNgy){e!WmEU5z`zAn2w1)k4A;q_jfs z&#@T9T3=y{S1vS$hRSvOMy||#wFQW@hKJu~p1;+U)Ul)`*4TZUu+nDw6r;SS_&m+` zg<3srxZ%yr8$d5XnPtgK2W@Hoo$sU4Xr8@yD|v+-pXpgCZJ%J0A;d3B9G)75Hj8Jw zwvff`e~_?P2cju*74J{`5sNtHCMk zWPvB`3Gj+aA}T|!?=_0F9b0n-H{^S`{^kYyo;Q4PyTQ}EYZWw*HRdU-Wlp=J_KBV^ zP!wsa;z;pb9@;y844h&)bQj3RILjVD^s?~uwyx{YH4>oP29CC;lUbQu5}@eu&b-z4w2du* zgAr&ZAL8x4AV(4SMAiVObb&DVP+5&0iT^kp1^Qoi#TwPzaMs9ty@k5E%YTL9mx10w z$APWx4bxYv?{~Zc!o-^;bJ-3aFspJsDK09%4x2@iZ6<<3l7L+?dID~ zJnp=bsk)?$?}?KW_S$!XYUN%L-#MoJX)O3&q1%j=ZjT?w2^Myti~IYhQm zO8iPcD{#pdAA$3=BWl$jwW^8AD(}O@Buw~E^ObknLi`^3O%1iALt`%1*J0+orVjSD zyFZ@*kEOgV9?ENb$))*X+uxwx4dvBaPGd2lpxg9F zI-*(tA%de0^;ey8Ji8@F{QJwv-$cwiQf^NIz1$}XhVrz$;ZPc$34^S17lq)q(z!>N zmI)bA>Ec{=A1pLuXF9}ya=ta9^W_}(({j~gj-Ty>Kd;KXC|?PBHl6?fR}&Lbro(ujgPYK7eUK?F!S9{8q6ZL_qiYnn&%Jyjezi}NR~D>N^Jho zvwW^+dtG_wF;{OF)qO;T9d$B@JyKiR;w`vHy)!I;zBBBIuzGWXMP+Z4)~)ja&jZ?^ zrfDDB(MI58e^jul<}$D)CZr`ic>MPR%7;=ebzJK~vz^dP{)*db3|84@2lIMk?!O9P zqKm4*qX**42}JBwWaQ*}@FVP-9GY-{&$1gM5YwUcw`CI9TkG1zujcu1;zfxIdtqKB z@ilXn$gQmzvp4N|*NE8(VogO&Pco$Wb&(2SNf2;iH(%JdUNr9wtsE&ml6l2T7{drQ=H)XtD7Z&_pDCR2a5-vV0b5AYR|tH zI9X@IcZT;#Vo{CaF;lO6ZdxVh6$fRk;dMDaUEZQxE7k_LUJgJxVmKFNH6i35`AZ#1 zl=WW^NFm{A5HYZk#_z|S?O{M(2=tEgFXKbQH&RcF)5OyzBxu--;Y$I2>Pj5-pu2=~ zY1B)Z#xw*WE|hw^7Dz;Fh_1-HWe=(__H0|vHL@<9#Vnv-d%h3Y+oOL5=+ZF8*rZfb zXM9?|_=qy)K6u%^ZqcmD6X#|BCiQwm04I0*aoaW}iknex9tp&$yyMhoHCDHDTWO^U zGVjdqSmSB-ieS`NE8)J@ONRMR3u!Bog90hN_68}4Un&i#-M0mFzPU@9SAd?0bxJ$q zNdbamcr3dZwxM>V#}%O&@2vLTw)j3E1@JOQ+>BEldFlu!q>gcYlzgrkGiQ@8!v>4( zusj7Mu@Pt`0q@D-DYKzSWB2*58ck%=Qn|GWF_l>N@j9unjNp*(W=S+BSdv8bpMh>? z`u)Q5h3>rnWSa@r_ek4*CRgkvy!T?T&}n#kqi?VplM8es7vp4cNU#XxOB6#KqPR;< z^Aqor{kR0PlC8SN`TI6G0m-zkKy(ErWLWoFI)u+dqXg&YXG&OQq_yr)$ah{ph4uef z%f4#ctlFMldk!G2Td7)cmDb&Mx@w70JX=%DD%~&mb*Nvp79SmT8r%W+fJeZM-N>|| zo>Ogn%HAgbR)f}eBMZ@Kx=G)7;(cgGc%!pKa>kp3CY(}P54v)!wG8vX=eTzYSw>a#j%+VPrYtgVIM(v+OeFNTGIS;9D+QlI-E5C#5QG;z@bxWm z46G8{HpC}n-ox&$8G30={zb4cr`N0MRW{*mj>`IB59T=5WSGY^N-%HZ98vI7-uL++ zC4^FcVJj{8gf>LrK)maWb1j#WT)D>>gB{z;058-X@cp;VDr;-aO^nJ}^y{3vIeJ1s~=3S3;Zp}$a{>l7tHQ*Dwyv-jig znIUc258p}IsyI3T2-;)}saw(elfHm1k8DS>VMs5&p)%6Xy)OS~5Ce!nO(U~NKfO^9FtHKa3Z>*py=CL;DM@=p{^RoE^)tzvWR%`Ah^;xZg_~&Nz4L#VD^5wcw=1tdN?odD|eQ|wa-^&*` zk4>3oQPL6`vU_Qn{q-_X$Wdm=W|M_0kiz&e5!J51_LlSU>JN+AkR=b0hA=i9ld@mP zy98gQ$z!c3+}>L%TesYz<@yl);)m_VuQG*8NFkHA4Wa<#tsTd|K^X%FVG_4ZCmfLe z8-2D5b6@yN`pl^0?PRfjZpQDgceYrIb3B`7RuyNr(p(pn}E*q zTwqslVx+V5$!aMSIw{!MW6(N;63M=lJRp6Sa^~yzJ;ud@6s$y4ZRvxMk7Dpuzax#X z?b|sqhyu^W)Bi?%`BWgQ(->fL7l#}xS^QmZy*xQj2zrTG{pqLkdb(2T`P=F@Jd!gE zf@ciD0TY+AMh&mZx1ADB%;l=FZX_BGhaU<~eBVb>e&qGMj5qDs%u zSUsGU(w-4k$|Wj-8H} z4Bz|=zi5hevj@IU;ZkWr#w5d)3L!fA+Utk%CObw${d3XqBi(Ds1Mz?w8g%u`))meB zw8bGezSE`c*5;;=$WtQ&Ck+|~0;sryr`h0m1%GSh-u}8ZyNhCGvUi3{lO4UKdab^# zF|>XAyf<*4Z!_mwwv{^0?(BRTEu>E3CC)V`_#S6755OaiIffBije(weo_4tbxN+te>Q?EhR6Li&C=o298Q2gy|KU^`*}%CcUe~q_3H_9O?U- zcMj&fh*ME%(i(BtMWZTrLUCr*h$zGgqelV`iQRq$QMn{ouSiQ9NM={)bILf10UarC ztCv!~@&k$pI)?T6!uqO{8ynNDT2PCd7BlJAvDO*3 zTqS^}NS?c7_?N=ABJTjf*@^RjTNt`HUUA}#m)?iHL0UApms7I_?VAl|Q-0w9GgM}`^36SpZyBloIA(+zo6B`2?LDR{?;CjJfLO^rodWu#{VTUcLA^@2 zRJ=0GK|oQYiL{zyeeE;e;W%E>d{?Ox~Z_ z|6$^pI-*m1kBjkdT;14x2zZ&v7m)1RlM5~wh-6#?sv{&8mG*kNw}}3bb3)DbXu0xHsb;oIs*9fJhYkfgtBHQeu z;u7!E`0pIJDnB!c;Zg#{(r4dlDqUvOrydp41B@%dX3uv9(pL0PPJuFWL1$^VGnNMTQJRo&YzBOrdC&xqk8qX4SjphKsul z-&Y8E357Fv1LDCXnyeDTM4rCp_)#l_lfcPFL@3ee(TfWAgN@-jx+n;aZ14)OuZ}UxI8Zk8` znDR$jjx(puXt|_u{gq>CD|>k&6o*uskiJ=&uOKn7a$jjAa*yb4KQ`-86^+R1e~v+X zIi6?JPUyb-5HEj}k^tRNKO^!FUP_ljJUKJh$6SURB_|e25TFF0>u+*g0D9s3xP0Kw zBj(i72_f)-v`MNY@m0nMi6X~tCfXkD3zj}~S{>;JIxf4P!vrj+`vk zMm>QUBcmN^ST&(2E>$=$A!KKDu3c1&K{%WZTwygWSEnAoOFLfPgxwIL@D@VeAf(+bBEfN*`{oK~{-+KYX z^Sj-W8}r#B^-200#UXP@uUaJ;-`%>*eXKS0(&k8oWlHDPPF(?`Sc5du<+<@1kjWS) zbdN0nt$&Qc!@O#LO=xnYsQ_d9D@PEm5~L#Zuzci$UaM&M+i+Ohd5ytQR*jc3Pj3@H z8(E3S-7g#4$4sHt*Lb|^7)cocKh~P@JMCa5_4HVmv<4|FWRPDq?-JQP z-5rtikQk8cwEybtu;Qy?ZrotpA@9WL>FVzl&-8z=>^`(K-zc{9{FvFG;Pb2__wcij zNon;sd2?)$36^?+L4&$M!4_)|2d?>1=0?EjMXxj8Z1u`6Hd`L77=C{;Q-~?4d3wkf zG%!No1^0aMq+ZO7?z0GDjOB673t!7G3bDVz{_Zh_P^_5u%~qUub7QXI*KSG0vKp>E zT=-_3bhnr~Z{RcdtnG`ymxs3zZz4PQZ2jrNyGJuJFC39-s@%~km;&KBO3x8>x%9-vCye!8v;`$ zZ+b6-(S`+D)ZlCSEf)KAh)z7@u6o4j-D^SdoF-(m8)j&a$eqb?`#RV_OHb~`bewY7 znI0rAS^^QQ420ZQu_M0n?&~_8YGES~CgjSE_+-c7+ z6a$Ol7Fm-%Ir+K6IHFVq(SOnY21$;*`$1u4Jz0zTbYVA6i)x*(1_mYiQ&@j^6N-b@ zVVEzjeYu8eWM*ztmxf2&p1Z-GG7P!*B+sxII+%(cjLGg&XTs)Y(-}oS=0iZrY!-Hh z4--}y5vDn~rUN0IRQ=^Ixg(_;r7X)ezO4x(?S1W3e((id^6JBcRz`F~o&`0^?)uo! zTlJaa&k{EDM4Ah&$;WhV- zQ%p&zzxE*@u8B-parhxI>{;3qz5V31G-e!U@QrJ!7t43QhGKgl#`=R2GU+{>0|a@; zrH>U)MRx}VKfi5T-s`OopXm}7VIP^lJGC$!H$c$RkFxaJt7&`zIBwxi6~B_q;eP+z z9*NX=M}n8z@8@R95K%%pBPZ?sDqI&XZZH4QLqZ1)r{I3P(99S;++XFTUu{wcRqYs$ zS*;)LrJd%a=i%bJ9$G!H=+qdZqC{_lgFg?^6!N9y@i0KrjDcItHfp)3x`s@?7}_&2 zjAHPwy+c@tWoYo@6XEn{miWA<{XAb(RjM%JP3^Nwz5(W#GzbyeVJia5{LLFv+D5%L zY+{|?tqj^1Ri`%OU~((rHD3V-1f7`bIp!X*g)OB z!p>HPIB=e-nN63_c6OtB@LQ1&px^@+BL*?pK5{iswi8=KT5Bl3fT$pO%cCEjR*sVDw& z(}SW$1zY@sXWpQ~dA=;~Df=c_a)%}Sunsgd=n?enOLxq4VBzbH^`t)VUe#GaEk_Zh zm}(aW^3)sTgFVMY;3cQmVc`3(5!;^*RJM{B?ouiVV&FVSFp498URWXjtk;VhW+WK1 ztmLz-`c3hQ#HbjVhEizb7K1Ai3@T(vg^M?mnipE?jTbE+y(!)V6&86gu;pigD7Wkw zVj_KBy?Wh5S>OB3WsdS#sSf9oRCI}tI6`@eO|dCq+{iy+9Z8d;MVQsKcT#0sIL7z;qpHB`4;C!rL{~jc+>@= z!hT{_SHIzlZF&;4Bo$L0av1B(CP(<09WHb}pY)MsvdL;!X%8x|4JDN1?x#=9e%;oN zdBEN|6(8phDL~}l4%#!`zp}tro4Z4V6F^=$R{0I-pcU7O!$wDGA5ac_$8%xX*Jr!5 zWnkqMLUD6r1K50)??dai8b<@6AwtTFJL7(9q3Znl*;?I@Fz)1H2TH! z9q-c!8LtUqVTb2_>)c2t~${>7T1LFE>r6Cso)_$u{sC%KIXvUt( za#)Ipgtp2$E>LX z$TE#HW{QX9Q*3=Iq$X{X{wN<9)>sihLla>bg>9C@zwgxl2slrqX_he@Ht8?k3owp7 zk-olq|785Rhg7AVZ83PkEH z(yjjpgllnmdGL=ha_4SgS-#<-VGS;=7odM^FMyxsFt`Px-5(^ z_2a!E+Y80K-2-p%5_a4lP`_cgV_3K^O4>bdrXGfs5(&&m4oq#S@GV1#Mc;K2wOu{h zVXNjgv2=0eEq@iNK{f8eqoGpU6klw>#%gI@yJSP)i;zsE#&*T+9{s-bXR^7NyNo|q ztI(Wi#r?a=H%(-*-)RXDfTM-7x}Lnv2z*&uZZu{eQ!Mjx2x!9BONS$r>w&4?T)+LQr z!DlD|){Mg8ev{zY+Ej$9t7&KLn(K-1iQ$pH;!C&CbnW*S?QIHwbi9A<6bzK}U$x*P zYSc^&D-&}9nsv3w{;wr`1`cj;gZr0Ve{|lH&|b`&1EM ztX+d@(f$2NU4&jHnnA1jpo4hzA81x5FqoXMFrfL+v1Gd&^MDKe`d855?SsVPE&Xp8 zpSe;aw+1OLmzNp;6a4<&rA(e?xnPuUKUfFX)E{uGv@i9!49yPq6rMU3JS!07q3uT_ zfvkGz!6oU_pH|PoeyW+eYrQ#!V`i)I-g$3LCvvXtbW?NmW&Mw2(ltYD@s8(;r2fs+ z{nRlYs;q3{#d;%9nx3ayr}glM3OvlRE{6X2$tUUGCf!LNcT5htGn?+ulp(a0DL1jE zKFc2!%3;5Qi^1e?^!VnB%lK4#Uqa2uT>7@?$LkP30r&wKm+X?+V1+A{{#Y|Y)`WL~ z#%=a9!hV*gIcqbE{1d|e`y>I(->XIgH{Ffvj;>4{O~`|G?fNsz;k}U z%W;>G8i!5sm^21c4mCDWuzXLmAOY0DJ1gc0p2Kqe3#Jba9oeKOeI|Tf&+BSBJJQk| z7h?CpuPyQiI%!iDe%*_Su0q4=L2>QB4@JN?*b~&`ceG~&5N6!2Z*QYjfUF9_NtInI zaZ6j~|HpFv^Fy$~+2lat*vt3J`HrFdHHVksyIaM(OWCfa;OFYE-GL>NzAmjQb-b}> zkRN-vX30;2nh#x^PQD=gXWVa_nXhCqm5Y2lCY|ODB#)Wm+6}`G;Z50X& z1iWc&=DrrSS;rq8fk#lkl%avSn5h4v)L9nzPet*mC`YT<+oglrd`sQmsQ;co=~&SO z`jH|Le6BhrjayrNHI5^VW4UKHWiXLw%+JPs3;H&Cz5uRTF*JS}V3{@saw|LR%NCmbpsSFHT3*)uEjFraBocs%C(nPry{6lIlo zVkG(M;`Gz&l+JGNwy^B7wSs(n^Y146j|u*}2c6h&=~LJb_IZ0$m&9VbeCct)!0ai1 zJh)d)-FuXH_N<^Yv$d6;{&Q4rT@=T@sNs;@#b)tfw7Lp6UdhYVnrkBb-@EYdllkJjnsdyc%A zGQ`UH40-SH8*Ws`?uEr&IneH5*hT8vyWQCcF{>Z%PC3b?Th+w{sk$oM;mRY^Ab87N zdn$i%4naO}u$&6m+RE6RDR7J!m-^#7e)o}onTM0uC7nrPn_9u;;1sO!?M9Ir{husO z{`6{08E#J63yY9BN^DZQEmXy5Vp~$-pHut)^Ch=97*Dcjx3P~DS~Gg26sjNieG|Ct zR2Nz)(>pFoV~L3{yfAHPNL8ByR1e24s|rScMc!XP4L(OfPs z^Tio%C&7&=cD|qaRG5l#;6kP}ck7q`&ic~ zecYUz{@|hl$}WTvF8pzC{ufL6$KdqY&I*=oow%j=zYp)ju#L+L^P z<+nUrkO|C>up0H`50v2l?d(}AG`c!p2v@e7tcBC{dcw^bs1Q` z3rXLv{$oM^qX#{8U?Jq!)vo<_3vmH(Tq#$MCvX3akNjcL{^^JRoZ27F=Fe68C-eA= zE&XYbfAAljKYi^F8`+;>6|BY&ciKRC%B2uX&+AWF5-OArO5_Yz8?NRckm2@oMdfB>N-0YZ}Z&b()y@;&D{zTdxG34gfD z-fOMB_P+0`&%Lf#{%X*EHs<0dha%r*sXwzHrCm>A||qKZ5!04yuQ1j>M^f%_s^fgZ<{?BK=QO9U{lZ4cjRiP z)mNJstR8Iqbp3ccxx*XJ*H0uJ^eXG!G`LV30(Jz8_(`ZkOm$v6%gMM`T7yg#%9&My>&+t$Wc=^Ls>#2 zwur>But8oWM&ZCVb(GKwY+aK%Zy0k(*f{*NcPay!!9YA_N5p?#_K0gww6c+}6>S>- zU0f!U-RMM!QKZDj)lG{Xhhle(SnI!w*FW2TQPHPjdr%(b=~y(fg5BEi=)$rF4Uct* zGV4-+cQWQ6=v#2|{dmKQzsBQ-<-igNP&T!B8L!m&>s{qx^NJ31&{N(K2h9^U4_FJ6 z7_%6X4svfhcy%Y4D9+ZBeL@Iyh)Hm|x$hT^QcxG#EMtE7nd!7GXEg`ib!~z*9D4MH z8yBZK9bDvV)mUP@6h5o?79C$|*I1iwRS+Jpwfj!ZYXOtn;Dl~w@pFk^I$y=E#Z%%- z*xUI%STiH7%eDB>%^s|~vV7I-#QFs4rYd~<;i#<$$KTz_9KrkeXl;xgmtaWd5p!Mi zTgy<|_*Rje?^ptYjc8hH=~i6M!*8nkAT}0VByOBrct++Ysup0 zER;Q0BrHZX*Pi1#O6my16H!50`+m9L1PXQY4wGCIj5McZ;H9R{?)IyS)q{}4WhgoR zwzi2Dt=HwPL9)D8@6h-4bZ&m}a*9|5Tc^=Q%*B+4U!iWJVZEz}-K&*s8n-Bvy9O(C zhq&Kty1zW#sc7thc8_ z2|0HnYR=YMvyr~vkZ{gbOh$k8?{7ZI#ViT9(QK0n^XPs17OmSca_s%G8t{Xt4-*Ot zxEl)67Q=XwODAmD){DL#xcLLo!aQ}J2nzE^T#S5k<@Y{OZ4=woJs#HrM;Il9OMh2C za>RZ@$;38=L4He!)uw4ki3#tRzbR+~jRlaqF5vk6+uB~r-2=ZwOAhjotC2@^b4;M2Oo8sZh^XeWhy`$=V?;DAFAt z>%zJYxNBaEoJ~fH9VKQ^ZBcI2mn5ksHv+|*@{G#nO@eZ?A?utp+^1Z0mK22{3ZER%hflCt2^f~Fyo;^sRn2IVbGzFGx1 zJYVeV+U(UdzKEO5j=tXIfS?9$r9vOv@PD5emxo3+1aA&Y#^ep&+t&uRHby>-M_A4B zh@^=v#^PZ&0a|X90UOcfF1n$sIvLOy3?f9#M3vCQEJmY%E85E54U>XwSgfqK$@TgG za)Ld4)pWy}FsB0-6fHN6Wo*BCiGLTLbTE35a*#o(g5S+#oQRm0*IX$#d-h%RXOnQ0_x>Sf1-=PTaXojI&ZciUz4R4Ejw%A`mrV2(5koW{rP^nr#y1wCG;j=dvEOVsAXbfnsD!K6~_tH9L#7;?EgM$0q zVkpM(XH_hGNIYlZ=-p>3ZxXh9iZn+sNb_$R8MDl;SLPRu_`y}RkpW9*s?HcL{_y$e zr?3# z^m9jK(#&oi;)emVcEg&S=QnHh3_agD%ecC`iA2>2pDF7HtPtWj$v)P@@61qwj?idu zRVCSL-Bv(K-Vn*OV8Poe0S9m^omJZvBvpGV^|wqZ2-R_89NK54)$o zd<1b+1EeGQhKON$?@*X|`sci!xN{w+R zw?FB-o%?NcH;;USXBeBwm#gCT#a`YTj$eUwjG*?+B32+yxhG`!aeK>8ImXavBT0;C z(9pVX&xeaA(?M zWo~|#0@r_SI{gnQ8y*k*O_MLmSdW5M3$D$5q7zJM#hi=pS>GA-LWWw?_7a;1UjIgef!9D_!)vGV;8df_emYV0N&90=-dwg!h#;K?}#oq8u#T- zmnp?vO(W1BDMDOkh+HIdu@hKKD0`mllYR4+& zvWoV#@stg&Z_K-uWa^6FmT(Ij|vch_SUK;NPcyGc29w z7K~|;91N}t5s->_kFrMfcEsN8qPwWcv1BEjQ4{d++BF8nT{Yl+dKI%2!xXer%j+xw zBXsC=0{gT*gR)RR(~duTpvb1doV+&*sEuvpN?Q)-CE|2ew)QCX^AmAQ6`k#GZ$X<7 zY!-A^KI3ojSp16d&rk7-mL>ye#<}7a1{+~9Bo>^aY+c$7{LoP%lSr+ZIqUx6uI7h<<1+sDO#(G?&4t4sE`nHefu1avWREHFVx zw><&FHeSBmAyU;*=69x}I&5dos>E+lpGa~qz!-r{JAg6E&oPs#K@2=$d$`7s+zs}% zE$*acsc!ZtS+SH=r>Y0rJJ4Z5lz4=KzSdqacEhv4|Er9GPy5RJUdptKA5N&j#ewL|&utvn@e{9JMY zwoN!#F#E7@E4kg^Onph+#CiWw5P8o6XEUP*dyP29#>i*EXL4KIi_~k?0r3vC*}l?d%fi*nUCTw85gXW--~~-Nq9KVg{*5=kMBzjO8k2 zwN(QJT$1K|DDQ-fU8>i}{n-~>(3tyv4|jJBxb@`g7yNd7yqGjeF)=ZJQYnl$xBlX- z;|jITbVjiX|XtwDHCOPX@>1$0*3CrX1VtDKl6*WeuZ)5`Yg13C^N ztQVDK&!%W&xR3DL{&}MV``Q$AHFFk}t=8@kTGs4W+tXV7x}M!^2VHdb)?RCyuLt{L z-zI3*T!k1|77BoXqP@9w+_B0~MM{0ee7&I{-RGBRgN?->An@=b9Q1NkVefmu1i7Tj z**1W+C}AueS>_Eg;!9@D$ct-%q)ckUt&e?47YTFMa2@FFel^g5)wRk>KGWF#Gh=z+ z^dp;~C~l1eK=z}rH3^8w;BIr{MG>u6D~L3R3$hJv))C^;Gd32sX2hYmaud~QB;4G* zaNEF5F>{qiR##?1dFfNSXKN>dMqLZLe46cYe6!W4xn23pWb0h-Di5~*)#A#HjX?68 z*t^pkAEU%X!2#G52CxBhn&KeKJ>`dL!ly2E15?7Vs#ka3Anq)b{F|j^VFK=2lAL=C339*SyqQ-{?LP z9V35INU8sd(*P#X1K#QR z?w)wE<#qVJ0e4^CPhLz33qI8P;QDF-uk~hmZC~5tkbwWusrBDkvmO`V`m28kBK$Px4CME$iZ}7YO2*{D zew~C6L7~^A zS!FyezF5>N>3na};`tg=2Io^GZQ1}b`@Jx0++ zHxkgH%d0Q@iAVW##mLYm!y6q1xB)y{H1X77g}^4$hwY}}v$U{M6#=Q~Z!lb(*FmTa zdn=u))?CJ>t~tfX#Hx}{do`_J5N68vu|{u8+`KI?Dro&^+q9f6pghuK9nf3!#4SA@}C5%j>(82_Bwm8cZ3a^4-T@tM5T!Lu_niu6fD^b>=RL*AGr9Q70JhOn~xtuyRV2eI+@ zRJN6Y1wV@|7cEYO1cwKITNRGc^pn$E-A%3sowqj-xh=6ZVp2wlgKz*V19W=5ZuO5# zB;D7Z4u#+Khk0$T4E7%Hj|`w9H4%E#Y1R&sP_C4 zI%M<92*m4Her8xe-ulyj;Jbs`~wAn#2aGIx-YTZJP}aR;qSecwiaRTx6p%?S537K+-dE z*)FUTGiG+RqxN-{P|uS)LlRO zvPu|gAJmL|P^~S>^D30q$>@6W%*=Y7n4tTNgFEcOX#{oE_l?Q;?!gMo)rHua`&&Fp1NW-f5)$m z&fmpMy0m%K5kw(uMTR;dLs19{DK%X?6D4-sB@=#+Xm=qL=*d9|0j2l5|0&fa4JY!Q z#xdrrQa`Tp*RN<(KHN%Nf;7Ai<;^43+{{*+x|`%JBU|HHy(8W|eg3S8?Hwb{{{^l8 zoq_|*fkqr3Iw$#RGb^8ByAI~mT<*URS!FtmZBoFNP{^tR z+SuKRhdV#H+`FkHWO_^MK=z#jZe`fjyfIGSHK>`$Xe?C^8XbqTLh{D~^H(-zdRq=A zXwiNz216NI+^70!8f<>&W_ll)-0rn^+CoT2T9BL7Z!y~8f<_Hw!+VFVp7HdlD>nr7 z9uds*ff5cRxnJhDlrhO@d6XNU*%Aj{_6xbIxl*lYx601cFib>4xSjL=2zuzI&~arN zXQU}#JGM-Zd;{K)5o20<)>4hu+l8S5fTf#LcN=W$8_mn>Z7nD*KMStZnXp2WLgVvR zOjClu{pcp|u_JMQi(t)oe~mGCfQ5)-M7gQr5g}&AdLUjdX2ws`z*TKT@Jf zeenJ1%s?H~w}!aO;Kh-#Vb;w^2&O|phiUST-qPNE+*l{G>=C|RyM&X+dB$r;{cF_2 zXMw^ZNV502e^{H?bP#QosR@hr@_$2hir0F#T9Z6i-nAsm5#nACTO`(AKQbvx6MHG@ zV|e^dS+7Jgq{?D`1dw5X-p)Fs5w&-#5|LHNCUC)15e4fndDsHvy&!52i!;n1UT1X( zDRrpr%jeqFWu%T{^x)wm#j~m zjEk5TP8qi{h~t}r`(Ld7#*PXl_sbn9LnbrsY|y9K*+~C+;v?V18!r0X-&O2o4&BZ} za3no7)&fp>S{pZAMVU2xVyOi4bS6SaZRO;mvCqVV{K-3zEOy+e{jqKZ)%PEt7c6bDxWrEZ{mn3f)-GFMvxtCA z|K?9!9IlteA;A!(wpF+&fFG_Gfu6M`h(rRy>O1kp|LpzzOK_${oGz!X*w;uYBiL@$ zmxv^vs{WmmLvz+muQ!B$D?exal%pLwqnPddLw7Awt?WV~cY6a9tRNn5gXhNumqvtj zgONk~C5jG9R`qgG%Z*HSyDPF_&=)j#7T64&M>&+3g-(NieC-+T(XeY zEUmPZm&UD~G7Xg&SAGB&e+nPrbl&pb=y;#@AqcY+m!A>*Xns5K7q81O&yIF;Ick<> z#eJ+p~!vuP7?|ED|2k1cbl> z;{dALDL1vGl3ILacE&B^`6dxgTL3}yNOM%yFz|qQ)$dLPh4s>RGp@A(D1F9Z6TO^% z()7K0_1~Tt#{9zP)v*eO$s}+ z6yw+?Py>{6O{(SK;jMe)A|#-EjVE z1`n%?B_huy-}hZ9E=_YY7`|;r{aF0CQIz&H9V(hNY*Fj=f1@cn$4kC(c47>S(~6lO zt5#e5R?RwTs4Z_%u|u1ow|-j*@^Gg=TY@HRQoxLe7+GyXC{dtd%e2j+PPX76-aI>a zvOeK0`(=?ncct<2*Aww`g`V*tFwcug>2UvKPDQ-5aib+?%Jg|)ygf5o=1M*AZxTwB?W&~CszlY7a&AQu3Nk^OBTTisw)Ext`?Pt>UCq4}W& zr$Xu7g!j)ePMXU0els}7OhT!>U$yyq;3va6*>S?l_)hKr)cZ!QLZ@=OW)quSlDStT zH;*Q0iIGXzLvJJu3PvAjSi%oPD_|eE7B|v_QU_80%uUX;+;$r1G^T6YX4ik8`+D`i zRAm1ZidZ=fSo)FAPh2&_2aR+zYNy>__592MzSjOzy_Xs8Z~l_b8lgJrJHuPOs>hl>`>*Fk#umO%L47?eX^ur6S0_jbe-(bZ&^JaB_1CWc>;oc z-;BJ@t%_x|E8QTWTUbS9wSEC$ItH`%+yNKTeV>AZUU62Y7I-=VsiSl$z0fPdm{V<7Gz5f+Rd*WA5OGSUsSenzb%kTa(FZz-BOkt|6*7N z!xc@(Gx|B@Yv;^RY@tt~ylv-K^Gg_d(|$<6Th11xnHdoHWYy8Tcw67j@rwDSq9JG@ zJdC}cuR}kbUE$rlzCV1n{p`pO2toE+&^iy>a`|u`$?6bi*4>(EE6y!gO1jT@?T+`` zjGI*eb;QEPM~v-tLOZa>^c;5gt{kAuE~7GEV<;d2@>|)4*f~2$#ECa;I^L_NkkF|3 z@dgF!AbRbu|40(O^tQ@Y&GnUB&{HrMLCUFY#I2CCX%`C80t-#kYOV-Ob4r45dike4 zOLFBz9FRf3_vpZVf1~}gRy#Obfc9B_Sn)}`R%U_?P>XW(sl*L zTU!>8tG&NXQVbUCiL(p()fXF?91leD;_ub4aW}l${O9Y@yJmW{=lj{m7M-888<;($ z^s3nF_KAc#5~t2KJ5W=KP4hY}1PNK2*ft4fqtCHUOG*tqpF zH60D+?)mnt=Rc+;dRzoaka2~YYQ9?EyJ$cWUqqbua9e7>96ozd+3N?g=$99qs@29Y z`fwlO^Qvaso2cdVkPFae?F$Fxndv>)d6m51?6?PO9;q*-ydn+__DfGtzw-1ytwBMw zaAD8ASKBTWz9beYXbDyIUG^VH;rTA}dpsx$=g_WQhx~Gtr=xU>goaJ&#A_}8@iHC# zw+Uq#of2=O#`fDZwz$wSUufeZcb%qwUcPxRt++G{QUFFIdeTy1dhcY~N@}WWoiLl& zxmrypP~U>C4-NM2yKbyq>&ouX*Aa*-LS><71)Q3ipjWz(jZL7+3O*}*mSfnG6mOR0 zg;eh`>rt(`Mw&(Mo4>4mm{QfpMG8t4&!h54#&n$+{eq=&LA%h$%U~ELFRcJ~c{we{ zDRM5kl<*q02Nb%vIZOLG&J``VMEou!Wkh1F!^?&w-^0T?A6s?UGgvj=&D!FRv=x>T zP%NB60+UZ82WeKMot3e_ZO;4j&PI2cW9d$^YZ4I*Q9Z6|i?}zhBiF3>cF5xr?^iIf zwMbr90a>*aok~*PD`hx#d)*-%zF?BknfKxcSXZMQc#ycT+pj(qBr~|TlMX(rw4FF> zve$E*uHP><6$3PfK2&B1@*dn@h}LtUBtOHiE5~lc+GQ}<-8|^Dve)Fq)h{`R%)gkF za=SdF1D(BtS9SWtO>vle6P?8sIsc4xpNB*kx*aRb@Vl$n#(yI{_jw>UB-sW`EG!cb z@>s4XJKR|r0Uz$RoLGpKe!NKHu*E$HUCiIvvMvmaxkRW*AFC4wcW%Qip0Z8 zkGx-cXWvpaz2fpWwDc{UK(~zEH)!a*Fy(3HF3s^8)Ih;JJJUwXNfx@OQ~`d@inu?q z=ub2fWq|9r|KD}S|GA5L5a92tODrbV#(V$#Q9qm6O10!OIX%!dJcA%7bsb;{Ii3X zA^kUiL{!@U9Az7)w+<%%3UiR}=E0~d1>(qUMb6OOlVF}#&Q7i6C(d;{!{De`VP(ca zh6uc#G~sx>_Qjy>PnM}u=fsd&BZOcOqfFy+?IYY6U|y*%b!>{GwDw5V(nrZFqBLYV6B2SXg+BaKiuGlmGV35=dU7qiex0k8>=Ao5LywhG8#$maVyS0N)(7 zd?HGu-m2hXSFLzpPp9wFB8lJ2Oy;Cz^+Q>eW$frxUqIm!wHz_uoPnr&v+(ewm;tvJ zcB|)U&zdu4-OOjD#dfY;shO@Ik?)cuy>-HoX-V3I6RCL6yQ;RBo0MCqg#yBsV*fu3YJ%lgfS`KyOB4ks z;g3a)`S#Z@CTT|Ru40G{Ksx^PWeY|?iTl&+-+ALXMX0a6f^o^FADgP!fu^1y`3gbB z-rmFs7|7wA@4<-x*6V{zZ(4%OlKF<)>bb6n_pD0N+QxE;hzZ);ikwuyT<6iaFsiqX zgtOI;OhWtbz5tw7PJEzM7%E`;_*#~C~5?z z$!unr2F{x2)(>$6BmMtp!RYO#yugM*zO_sbesa+GYF{@ip;c9%wfiV_t@hi%;Mey)t_ zi=~!T&;Bt6Pq3RUO7}j=qtNtV#tmI_fsnqx?S|yi$mP@*v_r=o;;wo?C!C*lzRK#H zLMPj&{T4A=BKn7yl6BEFE3W9lw=qVya6syG>VQ(l-NC~>3|gG(1)Y1oHcJub#Nxez z#sWhL0fkE*3UNi3Lg$8WS4^Y{8&gI%W-*fD@msmimo3QV14*nKoLxTgrk$z9hUK@_ zf^ypSA20ZnGlLrK5cyLlj#%ctsRQONLHDnOh$h(sJA;&rc>6`312;ycaXPZ`x{F&m z^U=FG{STJL1j1*P50(hQru_ojnrvh&9Xwv8YH@3xoY;rxqx z%>2tGmvpa@ZR(msdtK02-r0B7E7+u3Istu*A>!jY8N`^9v#>w~4ey#g-FQb#h(6;m z{{DLSV$+SSdA;=loW_M9=4#zWlBjstmz{iP z3&o1I5rVh$2-DyBm*{>?#?Y8|x}40s#^Ww7!~EB!(|O2z(YiP#W8DfvJDD(89aBaJ z!l&)yQCz-PDS${mbxCa+L2q89E^e*h;+s*S7-~$wguezAGh)H-Tuh=P-|B1@l{ENG zA{aFogZI?7_{nsZ)%}1NFb1mug9LVNlK5-< zh^e&6=7Vxq{EX zH>V#-b`HQA$c-z+tA)9S5y=kE0&D`bt+>rlE5d|mMW>G8rjh|N8q~?bgyASv^zwMV zF*g__Z@b;XyFRc6K5{Z zt;Eewatkz?3ft@z?vE8uWz-eT9fCk{2C*mA3vyB)ow4kviz>-F0FV`NNC zXe%(*saJ&1#+`ss7@KMzhNv?1Z={1$@7=g8^2u0312$!M%06tfCjVSyOO=%d6HYAi zPA~C>g*a!JWL!{PkL>U>{>&-M%ziWR08}oyWy1U7mPN|QR((JuMeB1Anz$imjVXigRJO;38wftf-nivS?WG7P*A*!2 z9?mn0JHijG9N6{k6%edWH72)&bMeJ=mwnciXv#(F`NsT-{x6IE|Lwr~>!)vQ;Aw9@ z9vb;!(>N}=zn48eSrfMQacFz5(#v?XXGJX{k$Nz?Lpv0@1#w)D&JP+6lNFmZANZ{2 zHNELv?cE$W5*=`j3OqU%N`Fv+>n34}uJeBBoNx^*@`TN$_Bd?5`%fB~@Ai7C6n@vR z;CRRrqQpLM&w=I|SJ@k<=ws&RdcH*lGd&={`uopdW0lQ&Sj2*ck zKwT+GxgS2;Ew3S~n$4PcH|q3FNLbkzg)dP}*hIl>+DwC{h=0`YjA+U(nYAsvfa$YY zUY}YPna#gz81BAJNYmviYrax?HXviw&bNk2q@Ykr&BY-Ck*5wsdwdOi|LJGO%Bh>; zA+9scB?Q&TObyJNx&zUCry3j%Yc}l?3XCokpIp^t?-*~9aW;)cNY2t<6&96Zbu;T) z{}4zjNZgXx_lA=k*zH!c7_wXB( zgSFD>T9@ids$>T{8-bw-)>giFez7gRrBbxn8A#wv)@@wWMrp2<^|@&{g*i`KrW9;t z*#&gYnz@^OW=lp{u692B6#oqPfV6@Lfu!x>XE&|1R1Q2d%dT&>`s;Kz|6_$x=gH0` z&Tv6x_h$9EeU8|ZiWDEt7OjX^9}lI~>a7nF_1jx`6jEfBoR{lwp*l3k69GhC$LSDK zr)X(2yVo29nh2H4CQa0&^tMRS3AU;o9IN+wUdkkc-}Z;c+YD6LjOCh^X7(xQs^(o1 zd1cfgQrQ--NUK=qg**l^TYR+&F0#4#$)8j;RTmV)5Z^ZNhMbcX7I^RVJp+=^%nJ2T zWglOt>Q{k~m*z)-qv7_&jU55mC5Y7(M`k+j_<4EU_VP$VDoZ1C0mEvCv^P?)s?DV% zF_*!!Ah++Os2(`URnqJxS8L>kS_p@5XmzisZ03S`;L^}!txckmtVzba^5Wb&M$(17 zOp>nljER-eP2aE5XUy9xO z`sc}})#o+|%Ud-4U)(hjFO?5!Z9I)|S_s$uyps5j{9&Uno~=M+x_F?i(u!MK4l|kE zKuCDZ%TEaVG*{6#5m6P}J0}`6eQp&4{oNblVwr_#@8md*NJqwxedzTnzNfCVzirgk z_o`>*y}5!9e7ct}0L$rQ{p?qN8D|cFyrJ=P^@MWJ&{W0HOXfs?+aaoP+S+J}6Kxz{ zo!heH;dSh|Lr6&u_I-|2kCch+`H_lUfNd0mCVcTN>Ev~Jk#`Zi&A|FGWg*!1#G#LG zJ^rM+Ozku>`H0LMK?QJz_9BJ&g!?Wl>G+3La^Uo+XY!caYTk}x zP4@pozO2M@>dSsw{JAL6mw2yy%Bm=A3V{NDXO0XU_m!MnLbF3v#l)zt?~d0( z90v0cA~Et9Q*zZ@4h z#AE>!Hz?*yVT$s65R9xSYn(|M^B_d{qgBr(3PbCWd+S|1+)>-#A_@#0hVHB8-QCG9 zH$EpEYLKmVVA%oTX4`YQ`y$3R9a`fbE2OPb=cO+Lt)HJAd%)c5w}W5nxq<$8CBN?o zKgyfc-@czdc``<>;nvJc-82{vjh-!5}F3p~-FeP{Q7xdVS=A-z*skeCp%L>yZP9Qaw6&Pk~LN{Dyv|{zb(q#lTlxib8NiJ5x$ zL1yl5*lZ4-Y7BGfQ1jZZu&_$`hvecGA%aiS{fV)qEfND}g}1(SVp2Eu>vo8t?(FTx zb{*Fn{Kf2p|13eQpLa8t2459EDs8geDT#jP*jRSOTVp+d;Z+x_%3>vqAt({EbBD@? znowZweXM_;74!lCQ)&m~nL1)83o{(=(x&g+vt{Q)s)jLh>rSgN5+@uk*2zIQl4C0v;{Cj& z)CQ1>k>gU{L+~2aU!tM7#jaad`*O(9MWr#!D6xA(lM>Ws36s68`WF>zEj;sSnLCX< z#P<#vfPbAz?AKM6`MQV;8C@Ifi#~3oqg_^jDP2%X5z;(o(!{|KO;yHm7F;7b0?hAb zNMT7{-M2oaA-wzALS&YH#H)J%uYNquv~QyE>x~1h>R#%@!AE>ncET8=)u6l70O4%r9Wg#OAjbndZK%r@z^|+^PqJIhZrDu>Q5xy= z^p;kxxFdeoD9w+Vki$zRj$2oaf=DAE>{af~X+L~n zbR}azws+xu6?E`>{BF<%?+*e?jv`1$7|C@Vwb_|5=P0|PBZE(=gdk#K z#YkG>n`>G3Nj3rNPnsl zXm?a(q^=wza@W{N;Xk%LAC%Xo z{gc&Z#?U9cr-Y$<=PYdy5iPV*_XXbY*{el-v5nr%7m_a`b_!5~F2pGqq1%fR+vS8r z2JiWxr~IStIJ`Vr-qnEdDyRf|KcNBSPlvB}*a&LPne^XxMW?dJ(~O(HYsfWDgP?1# z$ox?et`6v!begFA`Y!OXZjFU@_fE*Iad60so8mF~Sx6Q8kU-O>;Q)=**V5uwxcmnf z5#1N79v!yvdho8i`x=kjZ;0J3x6v`+Q*(RXA%>Am+S@x8Nz64F057%urb-C1(pvj= z-OI=#i^Jk$9ISPoh^4M`JElni$Zd(bCrFeKZu75nhj5+)Oj-Fd7BxbTUe`6180Y zNu@V@CtBEF2518r$fzcrnP(}1BUp8%?P?hW@+;|m^QdEt{4rxKnqKcJs%bTE`y(I9 zw#uRQ`n{BjEInVLs-u+QED<1j_uUk4C|c?qhc+{fn(+L;K)+K-z!ietTTZqR9}wQx zHfk4m&vScj?~C`YV@tckRBhqMSd~1&GX))`hBXSy8M4a%Hl2l+qR0TghJ|9))xQ!} zZLA1bgcCM|6o(;Y746{a+?irs@mBrGw<_tDJpB2%{R%iOMR@n&WMfTYMm@+pJRRe{ zj1uCql99Zpv4hQGF&R8O6iqai(Ft#;%5oCgSG0u7Mt`YKUK858uD#%2b2 zI((LIb{ITVzsU2`rZU3bG`LoKlpe%*I73p&bPZz|TGhIw%tj<`P37?h9Kpd=MYBXxC zCyqLf<|%mODxB>7EMaodMC%+yoc{0Clx$VNF6r%dHF@0O>hme*jC5GW?at zGWTCxsA9`F#dYS_axUSO7T{N8q5o2cFi{q)6JXx^tM1NJAPqg$W*j9*oakp9kfYt{aFhk z;jK90q6*$GKYC}l&>CcN4oHZc^2V%`&YMm0Xqvl8{dG%>5*C)}?#8_Q`NzL<$eYZP z-KhB!J>MGo)G+9bU50;nXm^m+MG#BC%y+ScmG`QvX8(L;T$W-m;8LFBBx%vaY9|oC zI3ugSeA$NrTpyufM z+04rttTN*p+*6aG3^cjEs?tN_%*NACM`D?Dypl88tG4UNO7SVBAX|~Ow+~+!NtV*@ zVD>Oq zfU9-fWv_6@rM9Gbj{iKXH^V=gS z&Ghu{zrlCW$+w^}bnzp7IuLQ#Hl!_D{arM_=iQ$>;%$eoMG?m4HP^qqzo~iIlRpms zLeJL)XLTT2vpUzyduaveA(R(e1pcBD%d zUTY8+dF9ap#7W-!_9lh!qzNeY7cE zbc3m3gWhL#lUMWn!LkaQ9&NgegBWiM6*p;`6i z*N�+z+&m*XeOJ2g{~Q`!^XB<7XWm+DAvHd<;0yJLGz8qkQI4=){_n6OnhcOsK^e zJ#h5g&9(~33?V0RVS@7>M+ra4{9^Y4yY*#vsY`ENtPzpFbDloZZ(QaO=6kIeGyU8% zu(7+5(%}ED+!2Ve6O&3n(OVcr)u;qg`J-E6IjnB8v!5E9xEnMNud%V-G7t{a&O*(! zh31b=qQ3r#Q|VWN`-h5CYA7Gamm0bkudqk$g{&&90{MmxsrI;L*WZ)ev(!x8%fBfq zj?<*f29>ZD&hf?VPs6IcZvHALg7lqSQ)9PuR~qul<>QR&rh;$$B?vN&QRHOn&AZ0$_EPFvQp$&A!3J}v;TH_j=!RwPF@JAghb>6!#dphH6 z{L*~~39K!`Px3#2HmAP;r#YyaxfC2Y;ov#2-SWqr<6^FkICEF-sKG_7YgnoD`E3e{ zt;rhaU%op7+EtN~)9$;3!G10A#ejj*rd`^Ku&{Tz(G~?40O|`B9KF(M;^yFN&FwN( z^n;XrC=ez~7y-ky;)i|eq}ZAf+h+CmsbQw&Qm5X1+W_-4@L6Xxa{D*BsR?naHn zO^Vw3@X7V$drBg|merJ&dPDzo8W8%*xDxp#c`poi0e{0O3qt}GrqFz8AGVGEf=*<} zAUyA=75B?L7rH}ef%Sv%opf}%(IM3QILT?5Nc=zSeRW(^+uFZ^fq}H3bTk^Ov)6X6?0} z{661j?Y-!OmknnP-m=dZ%^G}O`wvh26W+R;0XV%PZ?;DJJfZ*dg+yn2MDG9u_s!RI z{~($E?*Q=oZ3B6M%{R%Z>aG{=lEYh{ohdIZ>aG%)cB_a{)QU=pve9iFn<2! zZ>aIdX!Q{O?mN;Bv}Xl{*A^>3(idt z{c&064U+*JI6jk-+I~II%n|Dk#&O;lk^_XmUIV@3(RFKf(9C*m=cQj^yzK$Ld-^#` zZ@~-6&4}v_S${5*Kb^yuYJkl*Le3(ym_Reg+6k=x{=R|6Ou%A$1YE7SW#4*Qpn@;NvWZ_gPd-rPHlQPmFBN#eYv%VnUhMwDoW;&=o4>9rm{kT$eV%6coVQQ^ zOZxd8oACkSeqipu@hj)cyH*3D(h1++LR=%>-@>f{&awDYGx!s`emf5Il=d4qGwN>u zF9)nY%~bjCrHo&o1FRR=%vS{L=g?Ui{FM&VcXz-dW*rp0_g-BB`|O>ji2aK&{zsF4 z_5magG|#ryy&masfM!6(LBF7(OCmW9G6RmVy;p27p!>GY zz%jau;QR>nKWbnDoR?irv-kCx^M0>S{ueL#pKtx?hcCNl&g(c=l*Iy?DXJZZ|LM2> zM7O|m9L6lboNoxaS#ik&&b#U(@ZU>W@~uB0=A*tDHQ*)Hb=RYq{(GZ(At`wFg3^$* zq4<0T&`i9?z|1emnfL736Q^V9HnCCV9yP!g*29>R+%7F*RV7 z%p3ZGnU#R=&QWOmitjGs;1DC;7Od6*e%P@-BmWCN^yUtrUA{-nq!Pg6SEP=mxxZjl z&Fa9MbsUhr1__dzy_NeGzoH^pz#>JnmoudRkxAV>?}UIqnpdF1S^nd!%|)mvysblQ zWTgCpoR^Fg9VgFe+?d`KP= zG@7A_MUzy~nv0H(Pg<{lFRS58o~k$qQKcFD_i7x$xhAyv`R$ z_qZ}{YljaX9Pey=oq|}(De(2vUl`#JcZ&mGkaAL2mR-fW0ukCp#PI#%WPT3y_Bnwh z3zy+G<#y#`mMCGfTYqgXhKw&jYiueak64(l{9%g!{YOa~U>+(ZhYCl7bi~YPVjjuA zB43&(^e;emt)CRCF5!dUF?OE*s)Bw_m<9^`dZ9;jJvs!GzNgW9P3qS*O%r1U3^Hsd zMdT-f0}IQ%7=`!Wo5>%<_8C|Z1r@hGspJJn-33XzkY6*n-$#;{xd0LBVqzE#4FaXF z@^v22{slF&*a0iLF&)uy;7b5Dzxih4uMG0yMGr8F(G~rP#z!n%YXlz;AN>{K+5m%S z*tf^|HsQeJ#UI|p`(;-=lZ+4!4YBBp4|gdqzJh;0C>Q)CU;c-ZUJC-h_9Rl>UZ5q; zKfL7P{a0)*=WGg9X+v$9_)<=0hc2#v$@=lRfKi@@4T`e>|GxE{!1+ri7Z(M@l_6z$ z8$29{P&FcY@ULhHbO6Yf6e=9Oa)+L{gP1$xuMBeG;`lWh;>M_|=N_*?hINRn%Fw@H z{xrM5RPyK28Fyb3faATr$teDko`28+Aui|@_$e@&?4xMEzhwQAC%}R_vb^-E2_Qlx z`N{D?e`P_qz##eGa+tOf@WDj#S>}I9wt+u@Q9=hI#9rb{vfRQ7RsJh>D@k(=7=`&; zPR>>g;E`T?WTNK@S27#NBB?iy&3;urxSgM&(U_4{PuPH0ku*LcB0?Is5JVx!&8_OZ zPnFQ1QT=8 z#mV}@T(kMM7Joomomm8BZ&5v9xw?m8Ki*$YY-$bN#kUoxsVRTUi+!IvYe` zq^jUN+2~WdHd(FV>~d>y-}0z!S<1EJ_2gWePVbk7QJ&4E+ww=7vM&y{WP?R&aqvwX zVsoeiE~$$^PclGjtN38^jvCNj1jvvjKO_F!Gy&8+t?W_p-n05LADA24!au$*!^BuF zSiz9b)u=kyeO7awN!S$KC$C#&3D?)h`7FxnEH5vnPV2s=4D2mdQbnYsq+|zFj6|!s zqo!yvYrwnsBPU$L`YylIi)$h@k>@3-F~v6#peU|WdU4=lHi*2Ld z@6HrqcY<|mF&61w8}O`_YYM>lUxG8FHUpL-*F`A1jQHw533YSvuQ3~D6d;YW7-`dq zQ<9czrGZL)mVSqG4c~;|rFm@(FjHF7Y_(UH)VZN_4+dF09->j?D(JRS7n{b6fuF^*`Q_#czqu=i)`tR#Y+mG2T97r z-sC5Rdu5EE+}AIczqJU_yI3MoHht3Q=e&T1nqvsW5?9Lb=le z@J?^`JRU^IJ7nhx5R2^sKhd2RYc5=BOEaxoAR?8Ye8)EZ#xAv7|I|C+V#;fKO~RIJ zK2mBwJ(t3d8-6G+;WX0qP|(lwEAvpW{==QYLsGvwnCg$0>Yu zzb6mZb}OFPM=Jb4A#g?Uh!(JQiN~yBl5qCieD0O2s=kb9;@q7J@q$poa1w}6`N{Cc zcO2L=!Q6EG^JXil2?!V-qT`wXxaE|$zMxld@u^v1NmSw@9caHvMjaV(RP(Up=m<|w zz#%V}OKk{2pl8&aPy*7c=+XWW@vI{%BdNUn4cn!gg_irJlohre+FiBa-S1&#nklUo zRLq-+y_NAt=JZhYfLrm0H(!@oWM+&|r(q5hMm)+EzlMR*DYjz--T^>7t#DEL9{}fn zEh`LZW0);%bP`n1jnm$MiglvW9E;2ug|AV#Jid{o1mmO1r12SZsJ$sf0DtIj1Me+{ ztCv{$GcEZY@AsVg9dj<2@o3>#SXnB#r|@QebI@v` zd0p!p!|j_?rm3uu%*x)`7PTVxNsC@_ZcePx0#TzZPfJW>!b&E0F+|Dt@`Xp$?3Z41 z>)acXzW})1g?pNfQXd7OaCF98;_&klqE}|)prKf%7a%2ybLT7hQIV!nIxqdfiAY!H zk5g0c!|9f;F=1qLq^^QDR^s$%!jW-lj`NpZe3k{iDHfWx>r9rg9-0d zEZWaEsO_!KW`H1X4ipAyuJhW#*>NZY9xJ~%0N=$2|vEwG4i_@-)2IdL6#-5o2*_g61ZBdJ^O=)F}$fecHaXFg|wRwsk4bK!U z2MeePfuk{gSO4)IDj9vemu7BG>vk=HMNdj0iG|i@e=RO!T7XfLg$b%I7=;y?esEnn z#9QzzS%Y$-C4oRJX;I)2^nw#wi2I#y00 zYZK*s4P29=g*ci8AmhVUuZles$u$!2S&F_fe&vyGeMnr?2|f+mK8z^Be`##P-*1D^82B7e0PF+=H09 z@?d2u))=DeST5XFLo)3@Si%Ak!blVvl?CRr1J&?3Fq61&5A;P?EykV3*&i08D6|R(1dSL$XH-Pc*3lWw$ z4=4vd2WqI$N9>2wM?~P=0{i#YUrCZx@V^Z+#>h`c(pCW##X68gKfW$Y$b{xl0}r(B zXe10_GeFh7kK+7)$oSF{TQe>hT51;0fzY?5<@o^wQz&2_L3*xmk^tVoTwd_h?+wf`!{%gWCQwssCT?lG8DW0X zMk>VvkZxCP-s9ea2#s1rY@W*vwZ#GDG{;JN3+hL(nV3wP>DuSF1Yn~VZ$^yBq;3F% zscLlJiaJo3EL02&1TqMZGOMT@oE-=Yj8`0fyPv`(yZ1Kvx(5_t8MuD0I@>{+mizV zRV>In3j}0aNL;oN1F(L%f^yY@OA!ZBEHW&&_^qCjVgcL&KF#2{hWPdiP*uc^;X0PB3xPv1Ux22qH`pMs&U*O;Z^PG6DtXUQdh@ncLRjB(L zJ+Z;Xyfmfafxfd9m+)o0vE(H7aMY4M@^fL~!G8ToEv$@8GFLJF!lq^R6WS}l@_$~w zATYs!;lQjwAMnM1QNQ0A!ag^09G$H`tA4~9&Q2T+sy5b}XtXGDFD=-8dL1YxxhXBp z{2b2g&92wg%%sCGnN>^%!Q_t5MU`>jOu%Gx2t)+m7|=Jmi}0SuZ(Nrief%i{v#hUg z>6`&`kF7LUJ=e{40P-;1*hN1ER6H=20PeeNP;x^OAI#t8n)nY58^ASrpYpVf} zBrgyNgrE2-`qKZO@(1WoI!6fyk)F0AC0xj5$b>j5Ocy!V@Y-#u&J#%w_ zAWd=kC69jAb@NAW%7P6#6+KdPuLhk(n9#$q*AKUO#x1+ykzPZnv`0MO#dwSeO~Sqz z>qaT~k|d?5^m_e%Y4e*KnuZ%Q|yILO21M zpS?-S$uuTxH-h}k0a^~CO)_FL4&Hf%T7E`_E_i$;qYgU&^L&+>6Wi44#HMM_SM`OF zJ*P#@{pJHwr`pf=cL>0CEf0wt(Qhot@J=0*bzSVjo=>q280YE)YJ)a z0|9REaPtGfc|ree41t^nq^{ICRFx$z-(T9Ma4GVt3nMrEBkdxJW(j$ML)N}UAiNy3 z1hNaRaA=WxfF}b5xl?EjNL8ctFtM(7IGljPeF=BSa!n57r-ZXNkeQ;s0>R;{?*zad z!`Vgr*C^9}4-%i~gG)?-UdF8(q><-B&!Kclk?XL;1fdzdYi;@r4vTU!#ldE_U0TkY zYZ2KMG^!RVcROK$!DfDA#$?NJ^-tyIE`Yz>71}}A7p3mA=w4v%PH{9Zi8cw;j&gmfGAqJ z*ot|}nSM%cGrV@AB)k(=vc>K2$-<12Qcz1GJmGoqbgmgKRNZMz-MY6;XSG+0Eh^za z0XSVKgNJ-G7!(0Y7g0;YqJPYy5-4x>`dnLgqK{dX+H{g-Fyka5#SPTI2bpL%Zc*UM z%=13sfK}WEV!t(ydrz<))0pO26cTdhv06WjtptN_2fJ-D6Cv$q6YYvkBvL(enNIvC z8hpArfn+Rb$;$r(DDCsum#!%K=FTMKj=YHcnG014KPvBi0(w=)H+jU*jRu~Ca*rW( zDO;h)xhi8mz^ zO>{&E7yehbf!x}bvY};7KE_+Fmd@+cV96-ZuhBwiqJ5X65h%=@(^$}Y0F3x~`FrlF zH7^3~hk^_X^0VU4CGwx+%UMC{Dwv6!pmH0GE^y}7{T&UINcRhr3H@VM0k(ISpE<^sDm`;nrwT&ps2 z%h8C*3j1XW!Nx>v1+LS_;BICGjyaUgz&DQ&5QTUpXit)BbYq+9@9C|3*i$100$+MvhoXtd6jW}&=I_Qv%Nc@JyZ<ifp-1?#*nBhGB1f269NqKg-OpnyJ5 zSmvXF#(BDrc(`_HMBkSGX7*dIydLVbg$ob`hs&=B9-i0XV~CQZ3x+StGQf#OY~3RW zzOS_%$&zvsH)iBc%>USDar$P!NE+~tm$ah@Xa_0YO_`8TJ&SdF1I(#YpEEObE9s%x zVQ9T#8C z{P>(cOPwRv1fQ=jIF2{S^~8Mg)~3s6ts86U9x3R&=h%%xGT^ER8-XnjyYpL`F{LMB z3)Uzu)(Q(iPvxj|rdDDrpp3d#?ec^f8+Iw;B1Guo7h#5Tfz}YATms0~!zwd9hnJ|M zsLJHttb2i{CF|H#w2mbkRFHev{Y1A!nwc1>R&VN6B$122Fjph_f26MhDa+ign`ebI zMMy~dOpCYrS>sB^Zo&WnJk{{Q!Jvsp6~N=2HDX5EuggZ#N8VOJ!~KMo{-Dii&?wK9BpKc`r-E@=L1lwlJ6FQ@CTpddGWaF zq2CafMdV-t1*w#if(m)i`Beu&p!7A^IB{Qm_(FWucv8m1N3sD9m@O~3bJ%NBSnrjY zc?f+#WVKS0N6%fo-QnX{ynEO7?wK$Os-$y9U*z%)h7GH3Y)4{`SAmAlA_#k5%~|5HLu3F(6r7Z%W%tf zWa|>B|KUJs3QSRM*NQXev@2geSY-Eso9*%`TT8%?%*Bm?XtY_bf?`^ak6d4p{e$V+ zQbR8GJb&)AB#wkuVd2b%Y&}@ca36+QYgKRur>mujXGSB74a4_a*wiu;U~C6CW5VG! znsdV@T$)Br%1JOWfBNuXQlg!{feNVxvCfJ$2l1Dp!T;f;5w^&y00wvnu z3R+Sy8?1R zBQcQ+<55dI(4RDeebu5%(4=dNHU4D71Tx3tyk)fC^9hI>Tf@;^p91!e?2{uB+joB= z&^rr!mL0D^=@l9sAOC0dlAm!#iuH`xblzJ~1*}w%I7^~=75=obvLbmVkE@Kt62w;_ zbwK(My8}k|jaJaoKgP5*_?Ena4**O>r10u#Y}g~&r)LNh!gnJ-m-f~%Q3&qj#PVt2f%fROZY$F~+1w_{nkZ^ekE z2{iDW)a{rWwwyu71;XdSOEfsJy%gw1Dm#N{V}xG4-C-8*vn^tmjLSF-?151o)$zC1 zx2ZM0E|ZaR>v7HdN%W0bPF74hua72AujZle8KI@BI*ZxWb6(Fl4+rEvRogAg;$dm& zKUKEsPt|xbfN&Sph!Sroo!t2Gt#xavbI|$w7urg$^k5CfMGtyt*U8?hHP)2m3~y3m+2NLXf9^2p48h&w4up-)+6Wp3R0C(rQyvGd%^a$F zW`qvvcMOR--b${q*Y6Gty1LX?+b)N>$Q?3>txS6%P?|uu-nH})heIqxC#0DxTKu$X z;JIg(Pi)oGIZb2g)3}jRBaIrzdDeZ2gEvYi%c73hNq>?f67}$G`d)mPgn7CURDwTp}xLERXPx^aV zoqGp&4XG#Lj6FHq^48Nw_OtKnl~PVpN;dii%@;F|srivr2S=mU3w>_2q}pr`YmGWI zUb-8oi|qm2?DpfHzOk(@@6d~*<8vRhgPWS3t*f(Yb5!8LgRZ(PMqj?MM9;Vl71-h& z{OlyOgm`A6ILs9Jd6MzTw1M|5Ju2WJ%>LLsTAapXc5YaEeEp-$ z<(?6*QG6>?1W9g|PSmVG0r#~MR`B|(R-Y}JbkO8c`;m`loue?b-;(rIBOm*tPeg ziye?4i{p8AG{1be$eF?^QaXr{@_lC;9_<1eBX{o*51kT#*NL(sq{{nKXWm=#9a@h& zc)iEmFjaiL$7jJwfh7|3)xP$0fIi0mWJPCdL6z_Gq*$qaz_HtV3azqIWQXC0=jE=# zuv0vH2oB6hWsM=r?|%F4CK=^vvrTo?%JYiy)%{(_oJS9Oe{Q4FzHiEHsKTB!>j=b_ zKK>fCw>fSFyl9m7N3JRF^Dm%)H1rsHYe8_RKX=G z3ycJCSvh*5(2ky`_GcmcO6)|lO`&e`wU+7l{RaTaHfUDPg#)9y$%O_Q*_ttDDXhH- zQ+PD}X$a&Y4|ZSiMuVkUYM9uE!%TOgx$fNAYmAII%6apV3>OO`B=e;8`&c~W0JD)a znWdf#%n3+ z6iA1_-zLO)n8#*s9?!B-T*rZZ`=XFt1H|yI=iM*Eh^Kct*|ZC20=RbPF8WVu33e_z z=1*Pi)9=Oc6)}xSAIXi+$2?^id4v09$f@`hJUQfMGIM6d{KFJBsm+SVEeeUY#%btzB0?eHQshjTI#_hET{;z>QN@|YI+ZJ zT*kQ?D2e~OitwBjXdN4t@-W>mPW{BzcO}TQirwu3kB!}6jJ&QN(A%1*`_3cNTQ9s{ z;a~nw`X_LaE=CUG`CL15q+FD}^wTv)(Q>B`x>l^>#X0Gio^5fS5h1H$V*>Ca=5Qqn z5q9eySCXxCL<$E|pUt?6NA-3Q^*h~4;(eg>(aeY0Hnb=Ae=iCr$0{AvVIXp#FxfZd z2%T1q?&029J42;}eYz0~G9tIkG0%;M`Jtal!0cMZ4D`p%PqU95+VOaIGSt+o%`ETC zp)ObYZ)9H{LXn^v>S_CK1Dm%bAWJr*v85g}+*dKP^h8;nEMH%MSyK*jrct{VWOL0< zK_~ZpKUfqndu4edjnwlLNEjI$6R1OO-ee>3@PX@fv8hSr-SpOWcQmB_q1#pSsm?$4 zj31jc#4JRgp|{mh_Z zqef%>Dlwj#s}b4z#~by^Q&kQGPI!p)b@u0{$EX(d7Wu1#lddI<#E`nva@n5FZ`=kR z+l|H3iL4q^HS5ubH?)`>P~4cBNLg+F3^Boi7o(eX?!24fcqi+tg~#6TTIbPf!K*V= zPlLAaLMDBQzKW$}7|Glf5Ym3HRkGUUOj$61eHE`epuvQ*r8k|jAS{0_3v@Et*7b1z zT2=Y{Ft+6;VPh{j>L$$FZX0pRAj1Bk`sN)0^&@fP9}6PI$92`|3MjAI{uF;2eAYmK z?ws|gXda*!GeP>dhCJZbF`k>%AbAfmg!&5WL7&!GSlzC6XSB}pDC|vNYWC`_i6!|n zUzeeYm2#Tzeef(k%XfHp8&8%c$}$O#t-u1k0nv3|n^-xbkR7Jwb-KSJeG?LV6E^5{ z)7p^}-yqnG^Nz{P``5nrQ6E(I;Lneg+iL(^X5zmSa&=#q@tX~SU~2a9kSa+;&dy3& z7QXa8L6>fo(oD7<{UG{jN?nKLp|jK5asXx2eJsCgetje~Z5Q}`EDr2lmLE)7^bk?F zwPjEyU#*~JF>(Q=!GhpOXO3>Z|IseF^ajAUXX$0wAB-GR#r2xOmg0{`hU>T2QVt^t zY8ton3w;ckffA?IcNj$=oI^ou#H*N)P)X&d08V7%EV5Ebu3wnraW8MSBJNATJdn_J z20GoSOeFKMyF;zL>N3giprF?&)!F`Fr7L(_=+8cbjN_dn)c$)bBE*mh>--BOsAfL(esSde>9HwU z!Q^HiO!a7R!c(dg-Pm4lH%4o^&3cM158# z3pyZ^ZmLUd82(8IIG#Aij1wQvv%;gZLtskQ2dehTc@6kQFlg<~_j@`7;MPmGgO;gi z556%=ThpAH{s|z&^>UL=}fcIR72UF4H%TgE(a0 zH}0(!*)vHRO^6V#$|!>P_Q_u5$ooW0xQCEbxvH$@pX}R-sk%hSN^Fux_1x8R@T=-( z_$9-)Yi-ET$T+dkTZ*mIj$11N+InD&I$fKK*Q)e_rbx4I>AGBeDW$2N1f5~QU6(Gy zd#Q(-WaOVcwOmqvC;3e(ELdciZkgW=y8n}SrHQ#dk;4erSJ)Y4H2kDv%{~T8EuYX( z`-s`$A@}GFP*^`AQM70#4396*vGu)kClGge(1O+d5zE-Zy&O0wc>bcQIL$UG7p`zC zuT(kDbi3`EI5hznw>`EQs2ke*)|*wJ2wKKlBL>V9AEFXqX<8> zv{Gry&yV$@wZK*+@l*CwU1NzoOC7X9n)B_amnoR836N(+pS4Tn@uODwF1<24HWab^ zBz*%G&+N~zK3ya5TZA~2>PsE9{Dztn-5u6q$>ehZQ@FT_kq_XK3n&b0A9~!I6rj+P zcZbvspgj~Ecg;Cx`&*ResEL+tZlt;4PjK-3^qotD z2>Ph|!}!u*M^=q?N)HZ<3H*kGIBDNk>FeM#2m|O1&`%i#$J$dt>Odh9%((yF_6UA) zMn`IBl}1c!C7IPK0y?Zr^GE`kMoUeWl_ykN;UOJ|CDD1#HZpk;12?#Yq=#EvOn}Zd z0ZN3oJo#~z;!pBkyh}#m`)JBbx53Gm$^9p+Cn{KLkYH1z2)mBc3Vfs;j30>z@2zY( zWsp=2D^VFg-~~bxp+Pb|WIYK~98I~ZTjhI}5fU>d_EFHl{)>dCmY==DP|hS1%4C{<>tEPDh$0vu2|)nA)#aK!kANb@??&L%UQ}XXv~TE zY(iB}JA(df2 z24<0ds3;#j$P+rcaC6G-f!3*U_0$6ogjB^1SkG-Vn--f6Zzy^|qH(d{N{MBs;z0MP zj*-n6GI*geol!BFt9JCVfs-*k9SL}sr@i^OA>D1cu%?yr!5jMOXa^=?;rbfy=9j>Z z{I*f>=O39KBxD&R-dMqUEHzeqvMgLXj+g&qC!l01p*UEJ=CN?`@h9ip&;z=h}&LHxLhqpXUjnnK5%71gJw!#tE8&NMm9kd*; zIngms+tv#IEW?vy(d@uM?njc~Rp(cW@odn`wy+8qDtC&IZqBpy)q~AG=ff67d{%}` z#Q1lx4GM$CEZ!*tvAG){bTeA7)j6z@+FV(DL0Ml%YqY=);H&gFf#~;Ivf$gSY?!r4 zPHu^zd4_*v{1oJ;+dJ`PMFr$!Hrhp8k4NLl#vJBY(h_G1F;RZ1MZMRfSQu#K!^Ogr9$XfuNRH z?lYl@mN+ba>VG+rG}BK#RnQjxY!A6MZ#SvOKYxa&Z8Xc+VBv`U7OOrHuL8$_!;Rx- z;zrh%mI~4A+=)Hh&2o47i@9?ZlH)jbmlUHFZ+zM&<%mNV`{qgpR{0(}Z;dSAO)d_L z`RsMWl8q29y-Vz;2^pf;^C|BTTSFV9-TY!)@gX)!mLqR?M@a?H!5gYD>;4(9Oi$fr zAhpex7k^19WA+pKw0BvW8U>L(?gEZZA=vrS#X;=xbY7duZx>>Ja)jRd7!>WZ=*zic z5biHw?6%%F_Wo^8zpeCrp!QEXLB!Q(FO2D5xpkKfoq6YJ$rcBYFJ}tWu)VzA3es<{ zj@m9Q8+#n5HSChbEdrJb^m@6{Q;*Dj&URY=@wLhSC% zBRFG7P42R>WAvAvk$(?xfFgEzR795;gzJ%ELr^1I;k}7>xxV$z71je(hudW>mYH{l z@g!7|xuK~H`d_1Snoi(+nYQV3IvDkXF;P@kD3SP$diFlM19t3O?UK}G@%??TUYE%G z>`@%wZBfApk9ZwWxFbO+ZW7jrzXs3sU|Gn{DsqkgxrNfJ=o~vgMnKV;-OWo$yTh=Qx zEX;1&+Hx6!`jNBh)D-7C>~GBSIt_U^?>FQ1TpSgTbDkSbhMst|lFs}6v+Bs?Q=_SA3oz#~!w?Dh`&7|DSOBHjxx1PMj zuHDVe7oau1D#$otEz5B{#tf7<6#d6D*O0IJDVOrd%Mzm~i5J$^=*M4RXQml1qsu}5 zC(lBB?|mD_npYHAo;~n?+Y;}#?)@@?ny*`6gm0j}t)^55sMgo`Bt%5f)jB2)HRx4j z7q91c92c=KFVj%1Pn^``n+K@Y{A$y^+F3JE;YX>B2Iz&9Q|MN>cl3V1^5cPB{x3p> z|JmKmAqtef4&&#O4zW5+R;9C~00_{e-`ZpPZ0t>BYp9RaFtf3#%5(eRY zMXw0Rp2fLlMp*JqnUNPy5qY3uJX4(h(^saCuHRy!xJs6Hl%`F8=ZA&kLlyxX7#9@l z8f@yD&~}@~Vw?l196#fd70X3kQcg7+o(Yx^kfB!C=hoxqCz?Go!P~j>Ujj30n5&R1 zM$w`Vrvz+EPouP?BAVSyrrjNqzX8oAZkK@FHJ{}$X2s(q`TG~yCtNmxp;nw5GtUz^3X5cXm#J7aYLDyi85fpT!MxLdU zpD?qVFCr-SAx-=?1+u3+f(LqE;)cCQjajD?V=OuKMf{Af)o6!JG>CoKdYo)XuMu!C ziCShJ4gGk=G48=SOdfI0qw|mXAMy>aqN{}X;iIIF6}vB!`1#jIDHS!kqhjM##8meR z@hFXMV|X6D*D14d*DCX8kG^*>JW`eeCEPqoG_mSWazL0^O}nCIG0gkyhq{V_pTMW^ zy|o)b_E>d;{s5!B+O+!m6zdL~7TQ6Oty;5yaVS5F(n1rq zqt!7!6kM5OSnpfjFEp`M-_mo(+QhE-im$R2L{~8%U_33Nj0QY{nAR<)_fGbw%J`s_ zu*CjLhVLBWV^BLT#`M_);9Z*PCzA$f-JUFVOwwLQmd$VBwV2NWsWd4w$ZM6DiW{Ld zjg0DJ?{gE&+9j_g;%pDt+azOMK@d>On4?dJD%QvyBYEEU>eS9}yCFyRBJz!AMV5K6 zIKLy!J>247CS|sA_OI=V^pgv$(-_p+;}x=V0s(o5U2+xeb{l2X=svwS{&{WM@#e1F zR1L1b_KugK>k9uv#}ChqQIANDGEkzNGf3OKYQyJqle|ZfrdEm2K?Gc}Y=VINtmf4;6K_KwMagHA!W)iEe%v~SXo*3=^(KfvZEtUH zfKp`3>FzFa6*ET{&!oCpt7kS@EB>TF%1H?2vLLg1)9?S{jd3-J9HvTVD>sJ<`%co#r*zWVM_4O3RYgE4vpdEzIi z^;KX6rkTCQpw7aT_ce-pc`nNc+md;% zBg`jEhm{4G)gawr_+tN}7LeLu_YH(dS?F%$Bt?+!)J80Cy890mU2o8cc*}bHPKL z#y+*i^;VnpEIzo1mB(Y`#i!*x;Two9b8g%pat+jYKGVhfwI5I){p*+K3@lr`{q|ux zxxVgR0eyCE`qI$#&AEzWx!a~0kq3}W55=B#W&8D$lJCH|t~)0^QOnpfN#&L2mDUsXz{b@FWs%QBJ*L zm|A_e+WWcVzMXA+M3rvA<<{pt81Fe&BJrb{nzSU{mJ`=>3ZGuJnxiM|pV~y5O?qzk zS*+G(T~1Vfx$9_WJN(T;!_fV@ReqLVY+OOe>)YE{B=if#bETC{{`-B*LvK%c0#lDm zFyG_37u(ZNAM6cUY)nBsgJTDs-OGIjIcnQc;%N>jxA+HhwH}gTeb!gCAWI`r83P|+ zuUgy($NYpglm}nNRX_b?kQJH~e4VX}jo3EDZ~&r3VOZr^nEs_Y%}W8(yr*zyM=HR@ zi2K1orv|TYTUt$nBs+lKs(^+?f6{J`{m@%~YVE?wFU$)}Qsp` zej8-M-mLEclH-T!&boQH1acG2i8T3cOn#WedV%jd11G5KD$p}YL4`2be6)0pGL2es6i)wSZiV$mfPbhG))F?AO` z-W;;FxuyFQ+c<$#bI;E@%yRxnx111MEq(H>t~RHt`#ZJGAc_$^D`}l408X37gJv9* zBMOOR<{?n+0vn72VHAj>Xdlv2_eHhgOG@V>*3{jU*@kfFwJ@xIFaGi6tg*s~!TjU3 znjvs!2chEkWiKm;kPCODoSJ^`@|bTg{OpPPPU$6055Hr2YB=4jZI?70Nsa@Qo`(a|?m>xbjLwd$! zKvVUl<0RU7FeM1DXkxPNDdgnzo38NN%o7&7f1@ZJr{W&GvYT;~ zMVKuPTb}wQpqKQzBNI%IF*qE)f4H!K$DnGNHp?6xb(MOd(&F%eF_0WH_vPP;%9Y=sQA zp#XD;pU*)S1+qi22G|c!?OuLz>|Ur|A2)w9+A)fXe!rmcWkfa~Ar#;y+HE?^RDh(+ z62Ofy>MoG|U=ZGKRp;5Iu2<_2^j%;#@s$tI$SzivzM-wG@4C}9QBZlAOGD2-!_P)W zUuL?1YQ1D>2`Cg-y_9N7G*AVH+sHU$acI3NO}8k+MT>^(g-3L6uz z(yY;>RP9;RD$?9bw=Pt7H(h-fEs;#_c+G^ZmWp|z;`X;Hd;~|bp;PmBrBq0Q1qm2! zdEA^kF1B?Vn)N0>*Kz^3h_t99(o;g|A4J*oB?Evco52UW)jXxd8_VV!_m|j}wN0cU z_6as4e?!l%-)7w6|Bjg5xYwnxT0BZdaBy5A*R4H=CdjQ#+iG8#`YIFqDoS0Z# zazS~^U13nY`r{TsiwN&+qx!O14BAiRf%>-u$S!}G)oh+PU4sh-Sz0gU+HPz+sJDRN z*0s>~mi2aPc__%-U94Cf{-6+_!S(E1h2V|5Dxdk;*r=l8?>QKfp7 zTo{*TZQLx>-Tnb{!4~SLJm@V&?ut!ZOGe;fLTyy*OSn|l_@^M@)rM-d?qqhv_I>PT zv59^2=8QiHAXl-%ZiBOQq@4UnU%@3O!*(h995&E`k^lp{i{MPlHSq--=z;MHWku$b ztOMF=2R<2=O0x7{O^x7nY9`{2AJST_d$2IKA@JKC^nLBN=Ur!;Ti=D+$w4by_D&LbsgE$|wP96|{|#LQF@2X3rtO|Pu+Lld4Hj=gf)+RQnzkWXaOjvE~Cjz1t~ zAhsnq_-4G{U4S>ASdAP{Vb+EiUiLx+n=T&}p_&;@{4tTyAYY{UeoyMIt=M{L{ded3 z6ADN5cLUHY7Wz4IPSPwl=*;sjEh`fPce})VV=pyrwy>&{23q*!RVu#P=F?A&TU|Na zx#mUgTLlVOmI;)YwHR{h21PU)@mAKDYG(gVp+RffS5!%KM^~uHArxo|;Jz&PvG-jT z9?D5OIk1n0t+L$;=*dN0^L%zSk}2j0P5Y_v|6eEAsgxmc8V|tyA&nF68Q6Gfp6YI}R`0sn;Rp)t?5oP_-#!E4zZX@tbFX@U*OE99s!J-x|d}*~ar3G=a<$N5?k$}j0FqkG< z$MOmk#v~#&q+eu^F-0)E(K!^1ar~}RbhhF{{oL_GSziNM7phO40^`tth~8@0ZF#5& zLWQ*mDO{B%S2<+~ZUzLkNLuIcA2v9fl$r~hNI`SnxfQ_~0d;C}U>~n~0Td{^pv;Hu z76J~w%5DX&GoRThSur|0Zt{S;VCDQ@`LQsgDBV~K`{^I>_13_p-u2@2!sN|2SxZ>l zB^F>Snstw!f$1YW2~0~mD|T0>w3@)$lLCswKBwi1C!Z@q`>Rt4E2&^m6_i5aG@r(L zTZ-KgO>^A%*_}P!S@XZckNNk505hmn_;AHLNrZ3qt_qjAoMYk!5V;6h(%5U^k<_WI zc1)L0uF++7nt`c*ZoU&CbIL&rdVk@6jf$L$I`|9<>C=w`poZtxCDR*fYKX-|tzYjHc_vBrmEz1JGZFxj z%KG- zQTN1*WeLvTVzuU~_n=h}Mfl&Q#!tR6;YKmGqnWC5Z;}iWr=IQ>+{p@vwlYH#L}#j? z>EPOtXSb|>2W#F>x87a{E)$sTwM$Z4g_@s>_7lbTqW80=a}$m#r3VSH+R_y)C;ndg zpuuNLnpckW<6cY7v2yH^lz&|IV&n9LgVBHKAuuJQ3N{Z!`)X3MQ+5K^rD$g+9C~`a zaP*n`)1Y1%Z~4L&ae1s`pQe@`Tth};m31$JjBWQjz#Xv>ckCx8^jycV5v8kbSuzL5 z%hdRk*ulwtlc(oKAdu{2@C^B_0;GaeA$^~K3n6*9-N<165P__YZ0mYUR4q3EP3hFM zEyBdFH1+$z_sqwN>{qpY{W&V;hrEhIXk_JQCLK->RPp94>;JgwW#Uh86~1VKg3C0WqzW#)zX4w*7D zJ3^TC-ck8*4*(%airSU1W`B73tHznKCL>D0H4N)yGity#8%o?S0`=Vzn|Cf9<243E z)h&ZMUw%4l1D4(-6G68w@{`*Nk1EP($_>swykG?rCPy z-#uV#MQ%=xVz7kO)_s}*o}!~t*e!D7%6$Z5 zSajxsKZ))Xd1d`xX_f&CLNcbjbEaPI`sD0_Aq2ixGbas%>a42QMZP>Pd2&oC0Do;u zJSZ)P=JT?T%kgADW>tltU3??kWmT|Ry6YZW`&vVe@F-Q-D+?fj4cUOH;6B#`zmvMh`(HVXpv$*afOLx0h_nRky$5Gj`B~xE#v3wO z!){QcEY^}PqE;P{iUT{N`8qKZhe_Fekq0ZpTLLO(7D%lqb>_$7rgPTk_TPx&L=}ua z_?CqDD65wXngk7!ubYl7pruNgEiV{9V*rSr;3{py$tLKOA#(K*->SpDf?Kfkcu z-FQ1*%M`FG1yLbO)QB@(r6b%8Bz{kVVQ#b|AzyYYGQfRP8Z|(gW;=j3~wplGJV}fBFhXQv3A3=$x4#s5BtXhE*Viw<6V!!h>aIKL@9KRs#~oxvpj-D&I4(#Z=nNE|&L>sO;XTkRp^PiU%*%ywiIjA5D z9br_7{es5}Bt|ZW+FkZh9I>y!eGpf%TlApBpnl|)+Ro4bJlD2wXzzvfPeR`6ctSH! zzf;0Pa6=DK^T1A@%&8e22e$b+$M3Ki{Hzmyd%ja%=1?8nc|yS?**35&bBf@74e$y* zgVoO<-=B>)wAzpOjm;L+@pYaFsSpyR*u4L^0ygPRjujNU*}bwxHUm2>)6Q4{^6L+j zLM5E>HJG73S${_(e!^kWxYV+Wc?cJ5NZDB#z=n^Ed^dIL(#gL$EMuwAUhEaOgH497 z7{33`#f(PFe+yZnOmZQBp3o`lD4bWG1z_v@@>SEqv=sK`KU+o{EhPbXLScV_-@$r9 zbI)&xbDTUOwJ*eNR-jQl*x_97(|dEKN!&Xb@k8pC1;sx}=?nVz-jrSZ@ZwYDLu$KP$n(tAR~0t<`t^&JX$HbHyL4-w}-fg)aFyZ#*f2 z9Gp2FPgJ_}rRcQul7SeBC*cn1>g#>nkorat>MQNjj)vM6L8p!X6oon))-2|MKJVBJTlnSQAPNJwQ&A5uM`Wq5`uqx9*!g||ED zukt(Yuuwa@38D%|EdN{WowrkCHC+K5*1CH4sL7L{^3fw{v24nA@YICdvN#|o7?J*oH(q+48{ zfRUE#4UVyZ3<2_HKy4$+_erEt^}{S&Ht*{Crtsj-&=qjqnEcXLou^}@%QP=CyRU=I zz&sP~j{K7SRYP^#d~rP?|B8SVk}616OtlF+QZ1mNjP7TXnamf%hm;5(%#W=WivkF# zZ+yoI4i^4@hVLwTtlFhJ0`Bt5(&e$V63>6K-{rWJ3+t-*1aCI~74DIE`yW7VtKlIn zq2C%miQ4O($H_P{-B55nTb8`ZB}3jbXC$|GcYQ}sF`c0lugc;QolI8m-&z^YRRjpt z-Cn=5IcIQRb6%^L%T_=JW1wdy;@cH({+}lOfU3d|yXiM?Oy^+)W}ZszE?))41`1H8 zDMr8~2_9b`FkzYgdy95TxfNSw>OXS22FD8+kQ(beQIKkZ;h&L6TmlBx+*dc_LvlA? zzX%nWmVC=QgflBF|^t%eom31(zqEzen z9_en)#?6UR{efz;sZ2&Ip!!%dPzw9lH-WQ5%5qO$$nig9eUh<9QAr@2c7ldv&7&QWed2UJZ8Qn4DnzsGRX+C*~_rfd`TXOMupc{fimv+IR z2UA{%(U;Hv9a;ScSc{nll$(0^iXqQ@e8N_bsk?eKs{`XmuZR81(UjV<%`IS)e1-kb zF7Pi?S-$Pe+2#$~F-)sy_Eg8%3LVYRqhpTi87IrQgFY1dYHu@ZV%?x|8bL;w_~g_l zW@^W7q9)`BL3rp+0Acj|cVcm(Q_)w1fDsByoUiX5Jl?Fl>7P-_lhvXZ)Z;{AWPW=I zIL*m6ikX9nVGviAqU}Z~=@aa&l3tv2ET(tE?j-DuqYrUAJ>=#rP-& zlo%`bbc)3PTn49L=RIpw1wQ0B)xX}^s~v^;XHQJkFKgqdOF&#ITEmW;USS{b{SKwG zP~r!$>h-?VbyLf-S#$O~5uQrFEIV5mZt#;dQn3l;pg`UvUcJODF~2=qH`^6YTMuZ! z@7q53nHOhG2jkG=8ShPx7K0xF8zTV+TMqD8M%Np*lGTMni43JxHYB%nEw8Co>fQ~n zu2W`#yN!QJy4m7Uz9i%}FAy}i>3#OZU1s_x2{*@K93|4XD&w4}noxAF^bTTcAh(}^ z#M2d4JTkI(NZ-Q^ewl3abmp^VpxcLk&CV#@FTxytUp=V}9HdrLn9LN1-EqFw=@NaP zhaoGQ92xp-7@Qqw)H&4O^?iLJTZ>tJtA3|UKg&mh^zC-no4Aer*X z39(=2F*tR=)Ew}{d^+^K7op|v-;F&uUdIkxlT08MzDX}P^Gjy;LCRr^`-sqHvBUZy zyjh7aG#h?NPuykv!;Rb^Z1to=u3==S(#YLE&!T7X*8N@)7~e8{*A+k`=aSPnJx}6T zmiY?#W0<5BxB)_tc6&OI^>F*&o~Xzc<_m@cY%`ssH|#0i{(;= z;v(o;epVeG3ZH}5W^UT4QWNEXY?(J+4#}8tv!!h4vk}wSV})WgwIx4oHy(P=&a~x( zsIyfV#JcvJSjy_Bi{Ww!b$7o+`QNDY`NJ>oa~s}<-Yu?r#1H{ki<4u*%|764Bf$4- zdXdA|*&iB3OQNwm)w8JRrC{-t7{E<&q} zdkb>qdIR8zWLiD1qGNcTC0`w@wf#5`zPEBdc)Lo@oGwQy7ipOaG-tF(efawNLqc|^ z2q&j<*4yhTwu9-*jJgd9u4F&9IQ{5!AME@-QloKA7M625)MikiFthP_DR(a>9!G(w z$hwO;R*_95CbgUb9)QQmm+?|FgHTy)*>#Uu*x2gn9mSPVcY#EVK-14MP^(4x(Uu>g zae=%LHqp=;xa_l@fU_Z{z{6W^N4&9qW>O5K(e1oKUf)iQdw3o`N6X&h^$Cd2vq|RS zUYC;@9@7Bd6{x79b1`mFDJ(q|ecdsJOfH-k&@zgc5WJfl?qGvPV!c%O$VY6NJHp-j^dvu z{x7+(zMrnA-9Uu>GxoHCn85GE_jv;weCl)n23!faAlkpTB@n%g^GzrUH|s&}VYuM517-V(?++(R^^!R8*hpC&1rgjdqprre*eSOFgMe% zy1F;rnIA&=KxakeLrwo`pk(PC2Rp!|IDYCzFl$|%uf$5VWlY69Ixxs|7Rfg-#bko@Lzun?2*ft z{y3F)`=4@4s3lA_%DO|e!mkc}tEMIJqHKra7^l2L7z3R?O~}N@Jwf?XGdQLc*T>~f zM-JaA0b=_7V@>~XL4BS$!ITn1qx)XcZy^8|#3T#G$!yi;e8Y_tI2QC(neQZMJTY7D z=f+%36XxIF5>m3cN~LT0kQTGu({!|nA^D}4Q|rR&>2!e`>+^w=C28WpBw*1V{NT(= zX%cZr4;C*IqJ*IuUSNyM5H`BnRgxktsHmG=6Q#OIQ`uOKOX<}gvZS%2fB76?2?bXD z{^;Msxu!mz+a^_ZDE$(n@-$8ww{XiR(%s?D759ISz@HXPH*pD$ImP$GM}c zb$$7afD!bS28?sOq6Eci zSi7J~QMxa8NyDcB{r%>(sZ?93R;_YZ9Xo%lk9Otm+u0|{anGxiTc>+XwYRbKv(El}`O8?Ck(&A5c8+m%OvZ{Hk*6+T`rN#S?7a z3@Mk1O%v39Ox_hzqd|R3SJ?kI6`H}vdaSl9XT>kFe@pKtn|_FCImPqJDmEOXrCTqF zp-;!dj2AUWk2s%(j-vhcq7u&q^2r+P$e@#vjuR6LFOZN=?xm5dny`=aj_LC-(~?-* z@YSxhr!%PrMBrrBsRhf@>WY80-avlBo4yo5uuN2j$Ci&!U=T^|k;49KraUbnpo;ax zLM$`i>Vfq|`qFAK`8FmnV3d@?HxoO*K3eta%&fF28jjKjGf>rwU-<>yihCl0@gW?i zl$@Rj0Gl`q`klgN>s&*2LL+fqnqSPf7#6kqyK2>>vo9$T_KME9<^`LF43kt~H~{Y= zz*qa)UMLO*94q9<=a(luHAs8zywST2D{zDISIV-qfef4}JBK(gh+jdz|4KVvFDoY& zvINc!PK%mfc^cOy*HN(Wc$(CUbPZ2>VyxG^*sT}$ zwiqHktELqrPw}sE#81gFbVEj!c%Lp(?8XagNO4=|^ao^_$AWXb=ceOEE6kWMcO^fN#*n*g@G=DfUd$Akw|?Fg zG%kD%!-E;Gcp_X#++EKl9DRy}xi#9KG|wrdmE52WJllV|IVC1rt>AEhMag-%Ciu=5 zFPeR5^xq;{riO;^26&tUcQ@A6gE?4;0-8C~enCq{V_gyoo9=5vDI~05cJDll1`4@J zKDabu0dn8J^*N28D6{Zkp3V*R8^hdL(FFO?BC~zTDtpgy?mQ#TDnlXOhq;Aj3j^8v>>4$7dC*oIbfG{}%YWnwxSwClZ29ZpOjGXz z-hC?Cz|+m<(e;n!lXTGFm65B;o*}tglQv6?TmfgP$}2TGeF!ra7~?d}{^^5}prw~` z)Ojonmx0xt;1_>gxO`jwKQF~97tOEHBJypyD%QzU&mJ~EoZkNRP?M@!e!QBt6ai`~ ztMOMzdn(A_{_JAs+2@hZ5!Y!5QnR?PLG%|pAxYDdOtm`?B)PWf>8bSG9}6>ueeb92 z7WVXib(d?Bl+#afW2sA6%P}+{_)6$to9hoDXRGcqsbOeCW*$t$2CvSp;wZ;z_jM+q z0xF}^onn$>i1v#9dEf0@ny2Tx>`N@wCutm#gerG%rT_7=*TF1>iyA@SX|>X1_ZfA6 zy_IsmunU~er_sl4ksI8b6L9GG^e zGN%UKY!=wowi2Tb3n0&QGGOp$w+4hR$;d5wCQ(yeFn-+U-@Q0k~bJX zA6rIsl%uQ%fBI;bs_OI#awS#@NQwz|Piolw8v{jh9n zvcg0VoaG))l&$c``=e>{ZhcKXu5m%@D-~;H?cIc}xw5<-4YHS6K9Ce46lJ{~h5r)P zA`Ybs_Qi#<+3T@wIu=ZZyBeOZ7A=mJSj~vh4Q}bfjCffjaX0TJi}Z*19=*;Hmy-iU z(7*8-D8B!FXOWrBA0=}z%ByG=iH9rwy3cinmV)(Jgt4wPO#V_$SpD*X?7BV1bUC7x zf$QuHh0G@`_!&V9K!>v)AIOaIrC*$EmKsLBf%`;L-ghTZy%8`G?|3HMVq|c<6;kzK z2sB9%0455}g1nDc-s|H;2iQ4b+V*74no53rn1S7OK~z9AgbI|Xf zbh3Fdz;TPI^mkdn~ZJbX`8F`l%o4v;LA5X z-U4m&Cq5p3=Jn&mWCJv1Sr>^?zcaR(Hy0X9Yn&Gp+{Q_}+NY_hhwD9wsbh+3O4n#j zYE;ciMvB9q>*g-$6L3kyp9+}Sf+q!4mR-6t4Q?Th=$5w!rF5^GgQ=57&7K@!`jNfg zXNEv+bsBT6+VxISo9?}O@da)+)d)6j)Px~Yuvj4E7^4=f;a7rmTqQ5%f@QPF{r8My zJ*$Y-9+fV7S+k-b#5GzPF6?-lIWlXL{9!ZQVe#Yf@lI99uUiH39 zjW?qoq>A)2ir1%H_nPMovaBbJFT?U{9?zLP>s#GBYos{LfA``8dfzHkbkLpMXRca@ zf|0N+7EomBcItW1uAF_k!>P61D!=cpNgX$)$)6qM)g5D5g8s$0g2SkwVy;w^J^UFh zk2I}TPZEaelCA|F10z+mGLbFNP50k-+_0%dJ)I0$Ry&izMPg19owIc?^(=9vG!ZAu zoitIB%cj(C6$h#5hye7+o*Z@+pYEJ86-HGJc}4KuBebaL<(w4lA&w|%FpQnuX9vwK zr9a2A10_r$J3ItxN_=4;i}26=C&}Iv5zua=AR;CqFGgzcAVyUDJMT5UdI1`w{J!jb zb8qpT><#sUSM<4XG3W>b*9^*^z>3%_?O6DEn$!6ZdhwUaB9gc6;x*A`j?Y=J5XJ4gzuSEkR zT7^zsR|`1adf~wRw*6>ut6w~Qs^T0M_GyUt)tb9a+?-6BXw<`uCw;HASJN>6Gi+CR zqbe5I4`U<)PQJmDLT>dMjx0LK`3LWLqYJ;MSJ{ibPx%U?FWidZ>G8ZyDx&DmUvC_c;L>$JR}>ygYng#Qwn;c;LD1#h8`* zBUcBGMCL9QD58BeD_R%pKEC<0v+R8}f_mHQqd$HG72~is;}povW4t(>(sN7ZQgv3Q zxEe`Wg0Mv2R?QY`4cz4bMC(>-mFa`mmZ4yZWBjv_NN=TnS1aY$%@8N%%LJCET5AKT z>(fPI{@t2QF9P%{%p`}FJ~BdB=j*9M)$t?)uHVHFuW*9rI{)@f9=l}}%?+^kc1?wWsbavg9i*b{$Q*C^}n>tbHgO2O_yozr)ouP0Vr7Tia`PuQMf2>=taa|7@>Bz7ihvE_dngj$e&Q`8yUVDi(PM2(OuZh0Ym?JB7=^ zJ-*M>%hDaL0=Fc^rnILDQl$*cJ}G<)!x*B&xFUl3hI*T?FlcTr1YpSfT_S`Ye(CKx zBp=&up2YH>-%_mfEDN{5&yYSi60##rL_9;jQXmiJ5?bUbbrkh$4V$a$x!r6!mF;~LAc5OHn6dWE zbss{Q!cY2)vN63EAX|*)$L{RI-w@YE^KBSrnrgSfp8oyw(DiqXTL=az2*_t}@L;H! zO%mJaq|Pj642*a>vy74zOqv56986&6glcoboy`GVWz%19xIkfu3exun7QkGiMY~V& z1K|M%qc?L^Hj&SrM`mUrCaTssC#jrl$-9Dr+!Pk@A%l zNE`$Gk@&>2UMxx_MC25L(x$`4oX{C~vg{Hsy3Hp-x-4!yGjOA$5K2DKkE;hY`| za_>cWA=@{7iN!O^X0ghWYWspSjRzX4(mxw32Cp|H$h*ql$9yy?79V};s;`k%!<66g z%c4XQ(RsHFVd_uI6!=U^?Q#TP;}7&6ZV-5nZ5IyCeoQeFI5pB7i5aB5<+CrZB2y#-w&veH?Ey+^$%e8>bpqIG zG|T3f+e z4$gR)yIdOQA7`C7P=Zh+;g8GCMi;xWe!J^N}@UgVV6A3r2w)1{91x&uoIBOr~ZDSD;)YJSJ}?>cTaf~Xny zlY~9CMG1e#G^HO)M%fAALGQ3zBVxa!hMHK|T5wJ16l?7}T$2^EQ>I7Tzev=wvvWs& zCe@B*%7gHNq1m>9P5Q*P!CYr26u7N;aGqO0{8=H5BW?k|qk}c`rv?>ixm?e(m>&PS9daV>fxKcXn>gcUs;r|wR472KCRof2!m@MwE-D*Kir_9WuZ?O*v z7D)ctwMuj0bOBjNcNqO6a_{UzeJeA^B<|gL8w=YVQL+!UY<+I8gWd28&3ZO%x{XLI~y%vRjg%Ll)f^V(W)#Z1q9WqKe;-)3Pl1hzBW0*abo#N9$MzYO| z2t2siOmOnMOW-CxTPNz-pRuvn;@|rUd8Wsq(JMI^mn1%stfGMZ$^p{8-_+spP#&9p zAZO_oTltwr;8@=Z>4sn1)exUHf6^l@(=3_m2?E@m*JwFIB+eKfYHdG1zD3z|MP@+Q zzat&k{E`I8#EMW;_#fT6qVe^l=%zIB^3;KY!GP!GX8+*!9aMc%?N$@~!f!9MuMriS z$KQDx(A|;lOaWh8i~3g-)~pRU2>V9yUV(c(si2{O$h0Z>SH1uKP33!2^{gyZs7Ch` zNtZApVecxpF!SXt-X6AGKwC8r#BFibDZbmsdmz^KwHzl{<`CyJ2 z9t$E*-;@JPx1RAnfyE;cpNzhlr_Un0Gg%%9(rU2ixGJ=Rtc(d5;}Apprrd$oiS!yz zEan=R`}bYz*?PKEUXSJ!Y!w=pWF6|e6MVJrN4@z0?|rqNNm$jqlr{_3q}5xbwH>ug zsIbZV9Kr}842}gx5^ID#{q=1AAa;c-5$@ zIh1&D09yrzvG|sa+i9I8SYWG0$_SyI9xP#O&?=&=v%>R<5YM62lq^9U`Y=%6h-5m` zVY7D8>>cU*ud5Mx&>;+?*YQ9z_7$?scl$b+5f+Fg`I;e@N)g`g0)B|Zg8t3!Qq$kc zX%G$>?B*JBF{l3njC}{@N(hR$Na)BiF(;_I5gy3wHE^d3V^HB_dtF9U%5xqq_->Q_ z*SK&oCbiRRXVwOhzadypJeg0az{N+%@2er@1UR$3GbWT+eotKZ0ENLLvql0}{=|}O zBdNu-$~u76W9|{^Uyo8;Cca_LELOk)%gP9smOrDIm;>kb5$}m|LE1g}N-7Iv_HhwA zS2^sk#|qhViCQk#fRrrdf>5o1FWp@R#q71LKlH(#8bk{LK=;Et#HE$7*ab+$|7Y9!!7^T3%sw<^P@;e_c>J@AdRNUWAufe(&4tH+GW@ zZ8<0PKHs3lJguanYv!-c_IY)b{UMoLBEPSBIij;P$Z|eRQrEOxgU0Cj;FsmKyol}P{-9|#HvMG5;XcBUV zD@N}r_OMjUk&nXMJz;yg?v>J$baxAk@F7N>0y@`jOLXrRg5=x}` zaO+~HhA#TYyYH7eeXlAIwnLk0CEq>w|K+9h&X8QwniW*%N!a}cu792)pUceh_&#YF zDP$hv@7dO16S+3piZWL+g9{f1oUMM4z+F7P#eiCpQq0@Y>d}L?Dqdv~lza~c0Tmut zY+E6{^83=xMDG}~mCp+;^$XuN-aG|&TPM%cKJ8)T`j>kCg<{Wby!?_iTL3ZjS>zuH za3+s$a?d)*-^{srSys8RJ9Lg0$ijtMWiNb{@v9&npuE|08r|15Hb)y1>;nTwggMjY zBy##UKN@4GWPWDp8P;31Z>xR_u7j(U3DclG_c{*NP-J)A^ey@QK{0dw;0ZRu!2*G; ze|3vf`J35nofH3ZAmgeybU(gev{qTJTNXWa4f<3|1rd)Q*4NS+bcLfrSs5r;AQ{UN z+xkO5jr6}nAsEcvYBw0;b|L|3Jhs!UnRqDyd+0xf^4NaJBg8 zK4#!MN?|_QUJ(W(<2a(3RI^EbugL+>U##$nr|k<4ri-7p$6;?YW%XGdpGSuJ-C`Nf zmUDNrqvxMmx6$j}lICNB zbzw|gqWu`7h+5npmtZ3NULJ_TxDJJqJ{4IB_@7+>gT5Y=F=-T5 z=Yh}RJI2P}D(9G7=L%k)ep6hG2lPgQ!kgW_<8bwNw zIt75~O#tH$XQw0!e6_881KSW(j3Vw*q)OW~Wt3(G}_PN^rtSilGeYL>YD+K{D z)vV7rP^_Xp-P@oAO_ohAxr6N#C)Da47KcIOXOX8nPpM!2DaKcAle4I3l|Lxjyz(5j z|3XFMb&W9oreCjET#z`dDET@3crg8(99U3?QqGxv{(8bH20yCt;ziJNmpNTyQ73^bdf#7>sLo>#upfVQxd|S7Dc�u4wh4^9bQ>|6}2)3DvU!=+IO zVTQfRnGWA%qQ6Ps_PXn4=N`4+8!8s@wi%U_au?;Zcc0U?!!#r|vdU`9P#!x3tdpD zkJ_eJr)QOFNDsn*hAGteK=-%*@88XjL8SRQ^N4!KxH#$sZYfcx8^GRc@11ugGx;S^ zdWZ_R?a=m@)mH6)&}~LqAo7L?6#(<^9&ET?>>P^OzeQOH{Bf7m-N{)S4BBpW#?~vv zBW`_+3@5wE9B=N2XGv7+^{)kVU)(WlbW6(k(ANkILJWGqAb+a~8nqllgC&CSk$$HvujF(=ppaQu z)J`?qRREHVW&0dhNE{v|_}jZV+lK+Vs?m{SEC90X_LI{qTrYox_D|P)GNFCfp^ey3 z)ONFC1p<38=0i_r^RS?d>tAFHu zRHf`XTi}W;APbEt1l(zFIr-ZKky4FB4D3IlJT&Bs#YfUhYS{@$*36Y1o3Gg##^Ooq z%hU_Bqzp>%GmsU)!yCVJg8VkQCC=oO!}y9&GJpQ2S(!|SiTtcwyACKo7>DL7&jv+L zWw&svOcZGD1kPmSWme}LL-O4h;=8`gY~DT3s_c*Nqx+dq&O6Zt^Z1M5z*TG7YsAnu zE>%%>1PDNJq}VO@;gA@?rN;+{?QM!wiPQ^FGcl3h-#XU3=14ix1Y)UvstVxW$8ywXU+|DS&@-*)%U>ztF#7HzxxmTq(MfQy!%I_wjO$@*0OnTBg}olV5A#X)3o zK-={DS-{%CsOi)pO)CJAEI*^Zr-nN`-=XzfWr|!=(Re}zp`Y`r7d@?Xu4a7y5I~CW z{8@K|DV2@$7!@>%et*b0zwhI@0X@4@rx2M~GG=>4u;;D8`JI0`!mL?pJM(fxN8xM3 z_Ov%?s)$l&EnzA$FZ#W& z<&(@-FA^#9(1Bs#P-=IAWevj+WO=dEoF&h0MgX|$oewi7-XbAh^5l-p5QxhrBmJ>@ zj;4sEp!^EkViH9n^if`S}`EE5su_cnQ|DMn96<{jUEU6@fD# z-^O7ENEgT}XckrHP?oR(tIsy$=~C&P06h|#f2#j@>TGHj;W*=FMK2E}$w!{4{_)d$ zurXJy>2>*&EZMCg!|#QUSs)SHT4Ogq`rY>A@4c0yYQeg?4x`4U1IkzR&*ac#IZ0ZE zy+lwTo1m|fK1*_iNl~48IqM9PZ%y4PK_)Ip8)x z1`hTRO!==+2l6)gfU3$hX7wQwzcw}Jb2xFc5>z_FBX^r6G0I~fy7Tvuzuzg1hOBbH z$v&7M5I%LYGdgXL+oayvbDZTpdpu)=K`Hsi`)pU~S$Wq(Q8Sy4&^Ed63>bHFiWh7w zZm}EdaH>mq+4W;g=h73kRX7D}f{Rkrjh8fI0cczmXLi8bUAT*iuICm`VqPX{Ynn(af0<1DXn5vlfhvgW(Nul z_|8KpX>nVPvFEz2vfkq7$1I$mD_w_!pwTnrdE2~6)@m>^$zeQ2A%IP+z1Rt`^Cwe$ z{Si4il$URKZ3*U^2K1h4SKHn~Jj;IrC*nhp7-tkfF|F-4Nfu427M}v!}LD`e*6UH9ri zw`FuHQFrZ=msqy;lq)#2_zG^oR1fQ}=AOCmZ8p`&s1K^oIU>KNBP!q5-JmnTmU7Pj z{Dr?dAWsQ^hFxoA=F9g$xpzE^zZyj-N;M_{jy!;o%IiDO$~ofxr7x4p^y{;jJxKiV z*a{mDtCft$wXO5VzE0%AW_ap+O;LI z7<3h4HV)HZ_9W+Zc?S5q{q1N7AE^Dx;Fb1&(;-EgQzF_H6(qmCBHPOXi3R=1yy6N%c)%yQaX&HoIBj1Xgg_qYKU@=aGVX2i#Mr=n1xc&*`*#q66gNm|PUCw_ zcv6w=;MNuiAzxT3C^?uW(k;z=^eoPkqV>Z?s;v)aa2afJUlMPB&1RtT^X6t}jc>AS z8%_nfVMJEic9T16S;dQU#0@UaJxW67s@FZjPyhRYcj&9BpfDlT?j%DYJ$CM8t~ zKl}hlzUpO)oz7~-MiFAA^82?gM+iUCnp+!=EGSGfeQe&}Wy7PJ0b=FR=zdyR_YYQD z77;4$7HB)Ea%g~gZO)lvXR9yeT6$&W_yHF29RLUIJfyzMMWvef=VIg5-Y9h|N!F@s zabFP>XOloW)C9h#iIZ5CrsLY>GuqlqHb7=^FQWtATnSgpM}-%?9@{0nwo@%h^YpGD z?qe}kJ0P-P&4dG5m8#+B^-QHrb(HUKftgB)gX;%(WA6OE`0sXcA@o{v-W|Xwh&Jw& z0?+sPOx_IlU2B~^HVKRVGsv*V^n&T|b5XXR(QXSc?vtQ=ZbSx&-x$c+58HlQAEUQi z&mQnQ`CrBgF8a;~FWdXaz^8&Cx#?2>TIQ7&lu_FU3`QHkm|x74 z=T>~6)6EdHG<{VZcp)x%LQexq(EaV1SF=>&FL?}L z76aze?&H@|MYfpe9tdzZx8M~(=>eDWmlwNLD)5~+OH%)=Tx>GkSW%Ch8aq#8LjZ)w$rp0X+Tsg27t>g`9?OM;?wiqnh_k%bcxj%m?{5 zeU3K2B(YBK{dIa0EcOcdJQ>_(Jv=6pWfzC`tOS_{pfd+{QiqAm_dbZHElEhxm)}bii1c!W+I>HkoL3N z2Wo%JGOFenBDGDyh}{akauzw&BlS+_{#c{Ng8)0}PmRvC6z9iYgJy$rI!?j}yWuV0 z(8(@PZ#fIAI;zL9%OZI>|H&8T`sL?9%r=LsW8eOGzpKujCM{o5 zknS2V=pJIoL8M!{TR<4Pn}6du-}@fVdzRn(t$!`nf|+5S=h=JTy|4S)gGHg2I4~Sq z?|1W0WpZP?^2eOJ%IE~EBU`^&Qz7@6=x&Pt=cLb3UrxF%gMxb!NVmX|?dUl)k)k$f z{Eyczw9$hk0mvi@|5A>bkD*i!0;?1`)enRbr-i*RSG|a5ZH}YGj<$_UZnJ0{-yWy& z+FOG>$@06F&(;DXo_msl&1;J3Pw!bFxaIToUk-zGO5{3*`gTrbs3Bc67LXxkZAv?@ zV>#9C5(O;7D=j5f zXRgZ=`C&h{nSMIwErM@_{UYyACtfUr{yPT9ZHncQmbY*;JmO6R>#U!9Sg9%-mYC4r15}XhUTP+P*Iy#pjRBs zTExsaNCt_F8E&l`k{h`v;0e+^ezQeDF_>HFlz4S;Ab)4-`je(+FzTbvYYC49uvDZ;kEvap;5XW z{f}v)5BP-g57Xp>UV~4^ZC&P%MVK0`#Bd^cKFn!MfI@Kxmrl3vTzGk*k5nW6D`l}u z16q*myF;P!A8v_Q1P4KtUq4EHGTif#h}6nfkhWvUB~G>r5veXO2-h(sWZ?dp%HIZ1 zlMf;8GLI1M5|6DpWWaQlpv`wg&#>X5zAt=|rI<J3QI06+<)7**v3 z2mmX0F03MzB|J!H&1HIXW) z-g0yS5SU(-Rt>2;yw0K`M?cO!gdzuXhTDtD)}B%!L(6581O5fU{1+JWbMPCYt4$e` zQ$V*qVi7tqT=aM^e#oK#$hxTJUK{Z-nZ|T1*!XeL#xiX~RP-9D!W;xYi+CRbo)n1|3#-=3>Ch{OxsFy? zg>0#Fwj6P+hKxBr+P7A(e#*VZVz8=k@d){Ce1CrbtjZH!#Qs1LtFw4yH9(ejRMpP$xl{qR1bKc-3lics%is!*U$PhLLRd6 z499yrH&2&*@2SgZr?^AYmNRH{;S;9^?_RsC=0NYf>aR*4$a~T7Y8XI84cDsnpym&5 z+7cD@FzMthPQ~+@!rbcV_Gw`2bcqf0{~$kOn9h6(7F4$s>h*;TY#Mmcf&qXH3N)<8 zmF}5^CN3TK!?}yQmRZir6w|FME_MK9APTe1CDzj~`$%q={^WwK`9*BBg+?Ox2mPOx zX_prppU!H!B#eOCG1q9ZqWG!vh$rF}dXM7CTJSA&9y29EUg)D!j`?tp)Y`nt0_0Gz zHSee(bVagREys4q@e1aFd zOO4UWd-(IrdpQV@O*b&c8ybucM-V-9dFOiM{p0(h#n2e%1j`HqojMJ8ZJzGI*w@2t z%`ih%x4V#p!BpL9lIFN!SL%{6gFo~LfQvE@tuXO3E3Q@u{t9ILo7}(2MC+qh$eYC) zq!7~D>SfR-?ZUH6b56j*6Up~!B>7nR3a{tBLbCH}EC!U`VQigb`*E=6iMDEIB25ef z(X;Zz1YX9>NW)x_$XWrglh+u@m~N&WlOtMO35NOcag$eK64agZrx|dPPXm66V-of2 zzQ6Yvo@n$uKJ&ud9#X~9u zP@~?Fbi>;S7q!7FuEhWSpq9}4m=!F1xRs7%$e7kY(K>~^1Xa-*76C0?Mem*_*W(dR zb+AR98KrrPS7xPjly;_x@O1kfepmeGuZ{i;BHFUHwu~ekcTASP=Ze}Oq77A4@9PuL z5FVgtgE6I(-}*zJQ3BpLQ1*evsT@g`8cDVp(GA#OYKlM$TH8Ck7L|X^?WOFWQ|nz30RT6HZ*wzpQ9 zeCPA3;_@oAgELqoZ1!3ZJd1Mc1_70)tpB@yQ?ODsQ)XN<7TJ>-0n_M9VP{Wb<&L`I z6L{f~(3A=o$VLg;atppT4u0ljtigHG7TctF+yn94bJGj>>CCElR`2V=HT?E$YLyF> z_SLh>_b6)Pz4dFYt_7@t?eWcG7IVnz-Z+v*!9opIm`ijHyO4=mv<$flI&2JBzqlr1 zZyv`ilKt3PA1^|kuQrAiz|u~D|tsiN!eLbwOlaHSWJHh`bV$D?o9&L!vziv&Sl!Rwp^ylm|Pj% z!E0uZ=f)yqv~W~>rOTNVKg_kgNJ(mqx=h38zO{R!Ho1BkaFG-flRM_Nk^eL`DnmD} zVqoKscT^8r4$V3;4W8VEWUqU7B82A|OHOzOomvj19c~-$@BI<{*%*iIQcsh4&r$o@ z@%>^u{$nlWu??luMxF?(%F=;K_+TfQa9BNRlbuTVVKL`Tyd=0(+DP=XDT7?!?ufDc z>W;4vktqMD=4a_XPgmp(+Oic{Swc4Tvqmm4#J47!z_afY2gG$Hm@0$9*S+ibc;&+e zZ@s(t-A#nK8ya1?4csQJ9Q+Wz-{W4oKb)?i(uvqoiEtG-I%q$XMz}~+ef+~|6g&fc z*9V|KW42NIKOXs)0a1pau`?^=Ejz@k2Lw4(j5yg~xl+&Zgq%*TpmnQ|M9_eE78lPi^Ao5G*ZjZza}Gi+<44(JC@9 zelv0d%SoYx5SYHZNQaZX)e~{D{+3$UBScN#orKX_&1%N`xoYb{TMIGJ)=tOxpRv(g zC+RGG6(edBz0VTtKRwc4?Hm-pwNbSA`s5QMetG5kx%1IQa$L7GXIaPcn$JFsGBO=u znJ4$W=LYs(%B`(Os-zc3$2J4(^;AUM<0j)Yf6?Mm0dI;m6bR^EN)>YkVC~Q-U-Y1^ zo!#qI1y3#c18)(HBQYHjwaf@T1IY)9HT8$mHW-G73&arOsd{>ZP_tT)0A&NK^`FMs zJ&X2WADExvq}==eia!3nsdD*&vle9(h)CQ`2&Nxcup}}2aC)Fe+2Ri{k{KMQ(E3rutM2EYsN6Ja4Zd#nkP>YQ z72Hm|Z&Z?2`~EC`YP!M_<1!clMdqL*;T)cTKNZ>+DD=Em;2J04%pPNi0PD@f?n7x` zIq7+t#6PB=le~G#oF4$A_pUQP{;l*pOA(d8#80a7P)VzhS!Qt&z6yLN0I+dCR6J0} z{bP!4e%Kh_K1{r?dm^mk3pEvKOhV zbr+(GjOaAG4K(w(-`uI;Pk-3?GcB_*4q3&YzUe)O?{p~Ovv*>)vzcFh5X9zZFj8vzfQ#|rB zEZP6aiV`?-gkIC41qpq-&WZB-c!UEL{98YPjVY%0T*ag2^vKmQp@+G)XB7hrs#0x> zM-0k>U26(o4-zi-i$7#L@Q&QrKklX>Jzfpc@YzyfI}y@w>N=E;wQs7qHJ_`$?*>~R z`@;{>ns=%MB5~*na3(utf7S#3Ng98?=SMG^#``>rlm2PihzwcG!%>I*sJzoo>^~f0 zeM^!Dp}vrK(fIp@dh@J!Nn!{=$#j&%@cTkTDYZ`IBLstS9WAopPx}dL*7mQs4-rgHa1+j#StpzizG#6aQ%(Y-U)vt~N>7nMn60CwODqHp;)*T9Eu2%8T^~ zF&8MM;)(j6RRqtm@x_-vCcDK({RM%ye)C@q)IXW81u)_cW_CU1a#0)AWK3y^_H$O* zL^#)qcHMa@?_f&CVEl(UX|6ktS05%3WhVrgQ0IBN{b8E2j2d6KEtQLZ1z`QxNCu~T{XY8CzwBrO7Fg<%QX`jP)1zlp(~0!^TBN4 z&rtr%6k2UmXIE$xv}dc5N&cbw^_Kx)QUM9Ul)FbxrI7qKCHAfC&%C$4Xs0i&?R_EV zkI$S|RP+DeM)b>lan|s>Jf>WfI><>#bZoTdc;4qQQB}v-UDr9x-1_wNboP~GwLHs+ zZO?MhjG@z6tS7+QHwfGM#KJ18S&B>F6}gAJcvp(o?xy|)v(zxAz0con5E(G4VBRzl zkp>bcpO->P%<~-_IuQ{!_1ujN;jW7rcOlT_p!XJme27@)#JGq9qIFrLB@l)T2ifXj zg5Ou)QT>zn{`)xHNQ|BqGBSn*A#t%Kv7*u-V$PdW%xhkCd9f>`T zl7`BK9$83; z@mmY^D0l`@cOh)3wyp|5)fLEZHPe9#7H)XIFV;xQ@OC=3Pi)t&FQ}&121L1gp#??V z=wA5C8vcXi3o?J(S)c#x8eFAHVj?Iacb-z#{PV%hN(&iNST;<#oEyG!ZJ&^(s*mq~ zDIy>%SG8wrdAnBgN>xUpM?t$zPpK_eIRP|^`H>5?+$hE07@=W|V;v=<3tbwyzSK+% znWalNAZ}LU-`6}YP1uSN_J|2(HgZolC`^}6TAMc?3`$?_-$W~o7PUcDV6=?^N@2TU zxAE_({inYWs43kW4?<3yiX2%?Umm>`6IvT9Z0Y#E&>^=kbN2cxdZ6BE zs^1x|XT{$Z!5#hHt`)Nm3)#!HsVcLQQ-_PNA#TRy2jAApuck}anyLC` zB6u}pFZf%=$}!&NA7++)4CdpuSdu8wBs|Ph%vUfQwxnzlaB9y8N&1)_XeUUcprB6a zQdtSJ>cSeWaxsv;+Vq|^>}Du0XTTN##*-XOASYPQ8oYTifysRHi~t3lblzO1>HN8D z8t=@bSy4`4IzGLaC;h#bcuvroo&4acuAmwW*52^hZt7TR=s8pSfL3?wNzVAEh*BXp zYvh!)jEvE4y13EO(A?xn`-$2{QF$Ig%hcpj$c|u7r>%9Nc+YCRFOyLkv=u`ywA^*FNdf8Z*_*O(n9~Go5jN!n zFk{pv0@!$^>F;Oz3M#*X_P5XFs~2D1h2k-KX)*0w@C+7*-L%Fkt$zE9F&SUFL9VVf6vVPJQj|inW~MR2!NUq!;bAbRD8ZLBPdMJ`d=zZe*8Z`{tbBP5 ziV0>{QG|Q07qwYU5I_4tIN0t9zi~1TW;rN;$^i}UH3ekryp#OL%G3n#CP`}^AebU=)6jz z<<}4>(Dw~7-H^&&)sl1e)W?EPszORzKDRTZOxxBsq4RVk*?6t(-I1}hPWwp-|6>p< zICBM^U*>Bt8r#&7EqdQ2AFQB1sT;5!QQl@yp;0FFHO`S^reg}Pnb4-6Dwb7cfhcmv zm9c5#u^CfU$~3D{Yw9w09B!NS7(T5AC9d8u-CFGCI5jsKj$ zd{(e5y#1RA`P)l0uzSzFUsbij`fUb4DUIR=P+%`|b*?TucIkP3(D!(b5j-rb z%W~1J!Kf8y9X%&25MQa@K>fOx19yo)Ig;TfcKXwCe#L5Y@jA+4M9r-`7kl5~FwcFg zxFKHO)S=k2kMcGa6$7{(ECh!G!LC`#m9T-)PZ78bL)CwJfc{)2@;j|v9Wm`Wb-SI7 z{LgC~9U@j0&Qyez@%W6X>R(=tG3IiNyHAYEeYau~&Q@Zo_1#_4Y1vE2mVqiQfdI{6 zpV-9+wTXB%f8zJ0JJD!V1OO<8K(i}$B+k-ZJA^*w#q>wg7wOfTCG5A$vvAx=%BQ>S z8C#fb;LX!{XZ}!~{CI$aV7Nd_9*7qA3av7!NXT2zZC=pVW zzYQ$YC){ZT4FC_wW?x;K@2IbTnv8xIVskB>Kj6xrFWF7pn}})NuK;|a_mhZCbnx3+ zLhAR1w37&v5NwY@zLmyuij)R(u1xE~U^VxsJ5N1f(|V?++4yIiGK3+?3`wzhtOEE& z=E)d&%;plQ>mx-F1{5S1k4_~tzaq_5Hd|GlPBF35k$Pr`J-t0oakR$flf~Gk{Aga| zF(R*^SXIy!4*ag;bC;64kOjiLCJ2~)FC{Z3qL=P5T1A9j-lgP_ttCuV&|LeHpEOt< zq#ca_g!B8jz8)3jYSS?^#6nj?loc)wUG1&)A6WnP3@d3kg27EWZo(`ElbF`o;>YG@ zcb9-6a^)t>rdLygr{tNcye6FhoNxmH!*agX zyuA8b?N9T;{_$mH{d-ZhUqr_^S+^al-s(*qs@68r?K_yPh-_(e<{yHuEHxMxjm{k7 zF(NlB+`f-o3%BIDKD>mN@x}mOon$CTgQ<(07^1uUsO1@qJCC4{ljEx+*epkrQMdW| zPK=)pPcZ>Vx{xHEYoQT_mg!iTj+f2c5;UgJ>>Fck|HE9l$XviZ70_Q^2gdqo55hmjf_giy zdxmbTs7=N`(}DkQ<#OnHf`B_j-3QSCNb8(=jT4tyXpEh>0!uw!=aEz{1p>hAc&WnAXul}JX5bZXfQNsQ!RZT@Y?u1L`}cPs z^6u-qvNcQhwH`(Ox-%sUJRA|ji-%Z%jAY;JBJtW2ZOZDLLErR2ZJyJ@#&iBQ03s) z9>17i%Fkd;!k^#=J^==fS~L3hwUJh5?@0i^PxanGc!wF*gk@TP6S}(!=h?j_Km9P| zSA0k*c=%>9ZD99XVxroAzt*6g9oT(19xp%X;j^kcpG{8A6u&lG9*fA-pKwtWE#8sx9M&Ht#A!EYW3XPc zSBqmEru&?AZ!*rp#Z%|1`U_bce=T6@5`2$kvwO>c7jp`S+oQN8~4o$Gj;*U>Ph zZQmnbA_}vs6?%WY<})wwq|4I*(5kCIUsrD3^Zo5K&(M2cxvoFiOd0T% zcQw2Ec|bE-CuUN}ZB5D_VkOtee@S$_OYtZbl2s=c&YJP)_B|mT>rH7dl{g|rDRLS+Ycvt_>43% z@E3^IRaXMsL+oIzaJZcXxc}=i0kNTZ|Xal z|5_Fh^#R6%_HM;T6?uRn+~Yk6{_V{FO*O&GWfo8gopk$VaLE%@eCq?>?;qqpKNZCU zVtW4#FKGghfz}$jkpJTYV1CvFW)%QH8VW$#(ZC-){`=(iKc(|M5fJ7ro#Y7;fTq#5 zF8F<6`9G%svylPJfvQ-y6Ic|-*G0c~A^-4wXI=yl_fFyGr+Al3INL~o1VYZJ>SYK2&qey}Lxi7$FZS2n7IMG<`&ENv zoY#J<9lzEZel7>**asQ5DJ<;5F*m*`&=X7LgSCrfA8b};ro4}K#K3#EAn$i zh}!V)5nBGAukZwvv9RVYMX?}R`Ts1#)Y{yGr@8^p z7JZg#*9+mqkTBu1$3a1=70@bx80|ZFGc{EF(kTCNd5l5mJ!-8z%D1CdihvO>`MlkBIf4rGB6oW7<_{s)UZ}kVqz;_sV^5xXTzt}YYp^sO^t=}=T6JByP?zpl z$bO?h=d(r$4NQN5ftb&%blN1{zM6IHe>bqyT3{()O&q5HG1DPX@v7H8TQNPT*kJ0^ zA0}Vu+kP9Ss)rsby#2@p8A7CAb&}FASm4&j_qHce z7qkw-CnUTJ-cVuEn#tpki9%IJ=3}+PhB$x%m3Y+3$lV;-5s51-J8@3+Eb8v zROmwb96ZBBoYa1#p53Hd5U>ok9;zhkamfPi!Ij}c+J=D}381gtt#5;c9DtmPOpCT+ z0ZrP;zU9I}YMp~RA!s0b+r{5rpi@nHa@Fz)$>HE|<=(#A!r<`qE#0sO7pvJrY!6m5xrq}Sa1>tP@LnD`>;^5-RNtu#&ZoU@0IoE7O?28JedRhf&3}v^O zc-7+KYh5j=>uQu`0LkI`>T#i7{M{Nf;K36G7MG^K1De93at*O7-iMg>$T5wlVaHz! z+0UACL7PiEnAlaP_hkQtdGiMPh*3WK3?CThj$R*h!48=wYs=Z>y3bETRz8|oS@yx~ zP8qt>5_ebQ`3ExMrdwp6Nqu_~0D*eWeJD~Xfx$lSK)Vynem0RFS80(tppjU6$sW?r ztk&%z2kkmn;D*cW;HaID6LRP0!iPUNPFM^)MzmPl03XWnTHRXc$@e27$ietVc?0?3 zp!af}Nw*DtM|XE5II7@T%2=89hS4QHb!5ILoXdQeubYF%9hsW%b1=*F$?N+pBK3c` z0PZn5P3cTQ-X(shQ0wt9JdC4ImmNbG1aQ9Us~-zJXkVhZ9p&laMlx8w{Ov)W26TS% z+DfiEYCV8^y`3YFF_zZVE%0Z5Im5O+{M~fOF-MKc<>D@naC0(bQRux)>&K{kr(q~on8wOU_JUCklSvXzV zIr%oj4Nzl;IjBTVzohilZJdX)Uv}F;J#IOya_~@PPYbrJvAqB}Wj-TIodQeMjKyfF zX^FPS8o(O#L9Ap0JA{Qu@}LB&tY|^=kEI{pNAm&w!P&=qM_cy~q&*kh!C^LW3ws|L z9uLG%G(^;R{m|G9Kpf|BTK1`5wk1}sjMcYUGO3BD`C#U0@yYKJ74B}2k!-Zy`@qdN-8e$&ACGuigG)IG-%l|?- zBQDz_Cf;-SfQXT$1_1doc6U5=%mq7-5T<*MW|lw^j*<*4Lp z^4O1)9klJRBCG(ZB#@KhYeAXMk4NMEmEaN=jfc?5{Wu9bS}l%ip@;i!d~12ZtFjI{ zVceV5@&{JzW{tF}DFTl8GUIY5tw06yJzO7-9h1dmg*?BGKQ4rcf3nX${toBa0SG^8 zy{JE4WZgk2ynadiv;8*l`h>RGpt(`OcHnO#!Jn}$PC5wW>1KJmbbuSHl*xKyQY*C5 z?zT~5mc04BpS3j(oS5X|Qfa%=*3tn?h4jI?PP$nP0}Pz%PR!%^al&?72L~2`or}u`==h|ePgV^QM9IvTZK$pp@XM}%y~MK1 zetU4fPzVpeCnD-7w;UfRJCChi_fS8F@{O-?7EhlH zH%PY6%L}ve@$uOXukmz9nGKC5mYGQxW4&E*yrhxd?h(1r+#4uRkzuJS%IhK?)@~s8NmL-kJW80MJtQ z*Wb1lGo}r)wicbfu9JZxfrkl(`=7j@9Y0<`=r+2W34(&1q#KOMjD`zzyc1up!ZEaI zTkCgJve; z6XXU60>wc?ezH?Hv1)}^Lvx5Npg`b-E-iAch0&6Fm1;X~9X(Y)D{NB&?7;0N%|i?N zrqh5D&fNdN8nM9A+rtB2Xl=M10}ijB;Qb7-V?ms1N)`)PRlhjS1>{s&!?PScm5t6q zqt#kO3m$aYL2iC0g=wa z6b8A&nh4w`bKG|OT}w9iUL*)9I}(BZv=1zA50tPHZ>U+_!~%uH4T7ujS=iDDXs}-hG?25YzG(nq znja#ymgtD<0B6ox)?7HPev^|E*?YoQbb-=*k^%^5J4fvX-HvnFSE?zlmOmIk(b=dp zNu`-Qn3B;fGrO;`;>D<1z%H!io-SPXqvw$~q1}z;gUKD%sy;f$cBzYqB&!PPd)!$j z7OXnu+UIVAvM48VM12rSm&5w%_uCKCABs)iktNYN1mq5}fWEqkx92?UX~@0Ss|Qn7 zHS65U^Uj&B*29Hf#~huX!bHpkO;#7ykjHzwbJ#r*2#npx?i2y(u6tbXd#El+i-5yb zoN~J`aN7zT-rM=$Rd*)gh3G3>(<--!7`0n$I~1YG9v z@D3o41GG~byGz3+srNokIaSMum7xNvff9Ei_h@avg1Tt>M@Q!0t6aYn3jQa#f1sc( zeC;v1;F{iZq1;WBv)geSlAgwX813ftkduSyo3`JJGw~syLg;99!Rzfz{ zN|ofoGs(TaVX|THYot1j#_&|U6>}(33yo&Z!k^|0mqf$>v4(|)}Xo$!|roq$9?zO9$~j}oPDG27p)ohf?YD7lgi@W5X-CmqJL_} zg~Zm&uH|P>Mb9=@Wr~*4taZG~WzqLEy$csQUd_{;yJJ0x2sU#cS5U!TKisX2ZhE=j z_{PK4@dHcBX-k{_k@LI$9Jben!{yU-GK=r23NOMMmSJ0S-kz+j?Wd8?MuX0+mf3q& zTE7k$)peJhXwPsnt)5gpmaTF-fXWh`o!ImE`7=vQonH;e-gxt&)M~E~pH2Tsk}G@t znY#)MhV!mNP}4;E@;a{M zjWt$XVcXpr5yw+}m5XxkgxHb(JaCkNTb=~?d6p)-PD)k8aqF!G+B8QZn66t$a z)xKU_b;;4q^*%n+FNE@?qL=5od*ZUPCUh7k9zeS%T}h~hjo4+#_D-N)anBP4eHXhE zEe@RS)K%;`_}`nW%;xWnzl6JV0*tGSL~sORA;^zvX^|c-5xGy?q^n&OZCq zU&TnkY2y>aATpa%QWI|RT>RR#3Q3sr)_SemWBVvNy~jz&ZzR(71)gi}ldI(FCCxmp zD!5DR^dsXnQvuuG%L(LRGXWO~d?87jCAP1P;3kBKD!lK96)e@P6r**6Pu*MQUAA|# zUx$X?;|f}dYzY_ex?W|wSJjSfMy=6D{a8D{2L=0cKB>W;9j}(PtBw%4vKU)62keVd zfd*tcIJ&NNI0rdC+)dXqtOZ|Jh)woaNl>A#@R?R>aa8J~ey1`#YD+*M7sdXd;;h57 zQ~xP~1tBbtX5u5G6SzC}dUL3$R`mpZshASNuL0#l#NpA({jkq6X3G>3OK|C#3q8_( z8TZ1?NBitMksL+Z;nvxtR3)pV+z@jj*XLRBfDO*u-f@{~=>r##~l#f4ucbQ7ZZvqvgH3*9rYg zUa8+cu9_#(vcFH!1CMDf^~j|75$7+nXVp4->?on&J~9$Dx~y?q@S39^H+K54^~7Tb zBpgR&`e3JlK&+T{D4&IndpfMs-`B-6v3!-1)L!BPw%00~*TMRioWRj<9K(H2Wx@nPZ=bm84uML*y6l}7-tCh zf%c;d<73M+nq!3C3?EzFk0$r;L=QTX)$bxhvv_%tW<8;MU-Nb9ta5q1579X@?{9`VMiaMILmyOe+_f z?~MMyfS*M_Tkl)QRj$(JddRN#Vt6bD+p@9FHy{M}7Q*d-3_r7|%8}(Id^#ivjzz0m zV0XOBH|ySFRCPDfzk1T^hy1Ey`+YCOM5%k5_QRJ(Te5x88i5+G>B2?A=#tn?qitUq zi9Id!6n|2AYWHLF#R6*Q`*;Ej!rtfcoFSf^!fVV|1tBR((nH;DZoB1%g$MWz) z#=s`u)w#)hI{~xtu?te|FtW0!%x;<|uVE>Jy)|#I-6WGWXpt|@F|)hafktJDO1^doBVTz`miBo*~9{Q{!wvZ56-KZwv=gW>gZ1`xpqw22m(5%U~)kU&cRf+IBD*0?z(Lz!msR+urtT`b2LS5}G3;iNgKiZ5Axf}9WIWEM` zZbi{5_Z)iEhYph-qTiiDViR=I=Bfvc=MUkCfU{3VrFpC-GVtjm`@jOoafQU0kiN4P zdPuh~WT(J)WoP3SA$tdrk2BfcYH!4fhgy`UR$YQRDeKibQM6OYO zOPDgAFgev;I0?PFaaNbFnMXQ$bYQ-6qmn5#33l6Mx3OxjY&c7dY~gFS$IhYd`I$8I z?a0I9^D_(vOM+3D9^XQDj5xv8S^w8V56WTjg5=RxTRsW95)-^R-SIY2O`c2~z}zyO zEIznEOq4j)+1&Or#?0>T9ay$|2e~9#!}+g%yu&H4h}k?-IP*L4OXGdHopN2U>!T*& zk-JKcA|+gj&|C-cTA5D<7FhoF{*@u$b>7ugrB>Robv!Ccs~(>=<%gdgcnAwnqNMAkydpqpE4BMVFPNe zbJ+Q{4^66X+`h{~j$-`NHn+uT%F2LsLEmB^%b}3V%6l8u5eW8Tc``Y71#5Aj{M)Is zYyHvLB}S3E=PDV#f$LT|YCD8tY{6SAToz(UaEsvp+PNjU^#_Ev?OqmZx7+hcXrJrh zE^nvr7%KAiC2r_xWCr4>2>JchumZ}vgU_e~vP*sIsuelP4#)^+X)+TW;kJLt|} z#y&1MCR6Kq3*xF5)uBSlWFRpmzYfHcb35aHX$B#IIz({!h|r) zbd*~xNw_R!a)~xae7p!bmqQz`2F33Y`L|2 zR7o5DR85TEM(v0?2eaxA%1lq=KTxHj_u1fmzNOrftml}=jeTO|v7>gQGqiFMgrZ30 z0#({?8-h?)C=W5e!;EWL+G~2{{3zeCF*0^uz{Vu(BXWnMK~t z`24e69Gwfz{cTlZIjTjI54F?uHAJa`Fc~4WBaL_(1FJo%6vV-(TWH&d9|x!c{3RtN zHx?`BPhS|&^nSygHzXhxyMiYA-~3QEUKdp$oeLDnzXN_hn(jt}8oyu;Hq}rzC)i(~ zpiGvieD1Uq?Vv+|zmu85nk-D26d_cPr50$wYpToc*GXz$|7!lNgK1~07*(nc$LRGD zh99Bfwa2$IQZvy51-gd2yB(L=msI9%q2@&H^4Y- zTE}97vtEBVo#Q;EKkycRx}0gx*Ui$79A(J$`8$dVmZ7SlvYta`(?DmO>!_@1Fhho zkby7IVzNBS?58D9L7tK4-8RN`^#9{%F6=WcU9vX?Nznj+FhqAoqv$+0ee z&kaUGV@X5LgtrnOLm#*7Grt=SzY*#OXTqy>-15VNmvopf!v+nN`i5~#wx`Bs58iP2Q@=7f;bKhw<4FaJ(UAtCRX}?M36i@X^M$gbqukITEfl4jNi*&n|p#iv> z8m`GKr$DzB-@cvy5Hm@CxVOg>9mjoERrZ(KRQIu|-8+GkRu56`Y1`%~8Ni!8h)I-&CG@_0%N zqJ`oU_UcDk=#JkEX=RB=$f7n>h_wmuOFq#HB( zJLxbILxfgtp)FQvcU*XYahu{r)pHjW`0>55GB=T};HzTSfgOiz2|X>=Z&DV2iDF-e z((vlSyMdvHl#N4su_V!PZPcV7qp#uGfl`k>;R@{KuwVrh=ti3;aoS`S{LKv+|82lNsNt&P}v=C@*HPhxmpei)>*tpi?>|wKDsYmo&n5TW`wHfp|K>;ZH6{>dQrA}` zfmhI)P@dV()-Ny)(>Zy1i52DP5f1X>;qTCfdJlYlA;gCU4>f8Z zPHT`1eaC%VcEkh`@6vQAT}B32k!1yJgw3lgptVKhWB!8gK^>`;902n@ zlvIg$Ud>2nJPRnQhz2shb$t~XWu?$~<8aXIqH?g9KOW6xf?FFDg!GvPvhBb|;$-Id z<%ZRTZQ2Jh1q(ur1pnFste}9K>x_O8?rW+C#fDU2=`tP?GDPUS5hddE*n7$7I`|z+ zQmK3t#gq}^sZgCPnM`h~?vJlLi)R5P7Ots$C@ZjVp=i)KRG-a&rm6(?bRJShNB2rb4@zvkrU?_#?|?PwhLLDx67)T+TaVxTE4)NfV$=o@0Xse;$@U|py^ zz6-M2xjX|Nc6JpMVQxyExK9`rJ$@!6;;ayg)&$jt^AnjMWg+w3Xa(*!F&wR_JXP&p zm-Yl>HK%4rwcucT^2Mk0PHKpMyei-&_z>^}ONtD3#Ie4E+_=Z@PRb@P6u*I6+o|C` zl#D(AP7A0Wgqd_aABX3?SOE0`O2RyTtgsD;Dyx2HJQw7h=Vax^Q82-3e3zKled)R| zvXFXhW2loIU#3uHL1z#D(OlA?Oa3lvLBne=oOWmQQ9P(#@nL8Eel+Qj0 z))xu4J-Qkqf1TN<5qLsnxyNg0u>WlDC}hf%%VuB%bU)u6V6y8MIAw zl<4lkI`-X$s=@~{X&QbqFJFqh;X5vJ&^D`thhM19of<^M$W(BWI$TIE7P(7hwILt$ zz3s>0ELl#x4)f8u6CwL&c^SZOsyrCWq$R~XZjZa%fsmwkWb$em@6syohdU%?xk5=( zJ$rT#^(O%;-_W~NeOR5)psHtD3&kYP0ghetT0=}L{?~I|jq4EtUmrUfnwU5ekL0WH zmsCHvHd)#ou)WwuUv-2mB#P!VA{;d;LTmC|y2UuVTe*W!&Qj+aEX<8K*gKus`r)He za(6lkIh3-OQD~!v)}(e8s?-_JhNi2gYugKRMfZqT3WJQRnbK3oR15O!0S8mAq> zVqXD_^D~w7s*4W&^@)Rhw5H>;=Cf+o{2Gj9mgR{dQV^~BJfI7`dmnYHDq63zqK(se zqo6}~_wSms^E~I-``PFH@BNGUz;Msp*L}rW z-&pI*y9cWiqYEEGtsu5kA0NG~J~EmNIQWW-lfl;*Iy1{w@TR>BS}1!3^GQY&-!*p% zH*lVJ2%ynI|GcKVvjV1%TncNv*<=AZ6BKu)_bYcbHm_)ZX4BU`KKJhSi#o-1W!(@x zJZ5Ui_^4Jo&7gSZwEW~mQ7152m}(C}lE&+C(`rju>0ZcPA#qgmnbu;)#_R?uJd;ap z$YM!*pYMHgZLW&>ROkm@y%9fmj>qA9g`!OtCnWOc3}=Q3pRsUA`0LXYy^^#K4W0B< zsckS^GltQh1W*8oaoSSiVTc^byvV@&yP;ZV*Y-GKXpdhECQsn243L{SPeta~CyKUI zF6DmI@&sUfEV~qy!uE=D@IEdRb^%jc$w-SiZ;@(EG*-z*+)NU;c^UZl@>TB6+&{)p3@ zI>w4Pt(4O}t$~8ZXvGw7qUTfgp)nH|ZMBJ1NSFPkCN;NHh`9B%Z6V26ag zNJZ5u@_gl|AqjkL(ZD?YPSA^Y1;8eX$r$0E)&ic8$N`KwPu!aiuU#LLJQR~V(Z6;Z z2^qwXuVT6)Fs^np!e$?0A;Y-pDeh06e4`MLP+GH_6eYP_>H4XJ!>Fko1@oNWgtZ!V z3ezdpzojuIGlmiQzf8S3z2pg$jHjU*yKH{7Z}>W@rpO|sd1nPNLq|8o$hK6c%hAtX z*Z)JNdPW4bT)JYP!}ZWOpHXpz#hwM7%09hv4f5{lxiz2vsD zAL+CJ`_u-x)>ZWs?BE_XzlDu18BdHSpT{9$?r`exPr1;3r~OrnmR>hlj#sJC_mqZh zUst6<;Ra9(32(fjpi5)*O2l}5uA#K3OK&tIe^Avl96@Dw9&mPgE0%;$_*^8`P{Lst z6W4=R9$;EIbuF|Sz8C(q{eE-Fg!z;qNs2NQAGfoN>ru)@gVP>DXAmaD;DFC-PgMIS zm(H&^vkbOexSVql5sTR!RL*M+{}W0YCgo=&SG9C6&<7O9*hW6bnQYvJOu?^Xc|psn#F<-)sTwosIm3=+Ys~^<4O_b_+CDMjZN`u$4i}=q@$xrhgPNKJ(hkD(&;o-b*@@;zSe#NPr&UCU-mZ& z^$w)5@melcXg^R=uTaV~(MY&wr@G=$yI3-3lV0qrho`pCVw+A5V7f-T&Pv7fn0xAc zoNvCo!_?S(oyMNu=AtlVtG4?X(9@b+-pN=MeO{8WX93|ET#Pa6t5!EfS+x5s4@2yK zoQ0G@+TJuOV)^oT4w3MAyj)}biK-mI<|6o7C@XbYDxq8v#3_s$bN!o>IoOUHSTkAk z=>^bcDnB*>&z;vN2a+lq2#=^Ttos9S``D9otzIWM^Vd`CPRu7QZ{iJ5X@4 zi%q7WJBSVr(i;qyA38RQ1V)Sk0JPv^PS1sx*RDFzgAo1(s|5|~Mr7v|D^JrQz6)l= zUG^XSDWM$KwP88rCD3~R^(kwz7!Gl#YC|)~XQ17~$NAwk#B3ACq{S#PZD{r5mn42+L{ z!BBy0wM(y^*+N;0r2Wes&^Ch;M=;nsgF!&=gxiR!y&>k}-7;1F+1!0pLYZZ1nYhlS z9xLCw7bhROP&Y=wdZuk68!!;6%fVm~Mj%^UX6b)saH{@@|Cl-nWo#5q+7$wL(@180 zyywkbWlp91;jDDe`-LB?d+DTq-WpB7#0Cr{4grD5`t+f?Dc*m9>L0o>|>JkLEd-ksa z&XD8f1BY&t3kE{TwGtcd2s>kf{VY#N<>k9VEOAWxlpeH=3$F4 zERI1T4DW_jq+#Rw>I53g=g3hLXv6P`dJkOOlfT(M>We>ezrr~@ZK9B48Jl*v_GmDT z8)oicPV0G%hlBoTB(%zK@Z|!^inUI$+c)-(B^^93`vR4G7Rxiwz@YB;*eM>vPZSL= z6{nn`oY+>K*nH9!fg!(_w_?Uz3;C-NJPC;kMw`Rx_XCxNdKe{bmfhP=Jw<8YdT0~2%xSly?}W1 zAN40N%4~`iB2#cdb-0`t6C??i9?}XstjsmYEtJNL^Ez$i0XW~nhpuy_!{iTU`GPiX;(Kp?c&}T$T8`Bo|2p2639Gx zC@q%gu&L$puLaTSO!Z|~?P>efD>h}hoR*YH>s}ad4C>qftVr(3f@p6v73M<4H&)Q? zZwdSR@j3fS_3FUNG&kM+rc)uZR|8i0EBi=tR(pX1eSA~#YzzCFGFE8aP2_v6QjHGN zC!s3I!?@H!X2s+wd_ZTSChBSwrSkQism06J46*u8Sa&`4`TO*^@usSgsy%*M8&p2T9YYJu{08jlZN62Cr{%2l3k-*?Bzr=nCf&INZE zvqP7-cxjgDFC1Tyg-kT!G7DEAahk`6#gYnLzPLz>Qy(Vw$@gNizbwx7H_0UniS;4= zhKT-HKj=ABzSbhi-`#doz0#nP3p_J>$|nc+bOqfmf6#WaBAhn|Rz_;w$NN%Apba!B zF=r>+3;D=hI;Ra}bC;~5td&*B=8!&YW#|k%Y+b1+zCsr~yH*sS0+F3^8<~~|1iTV;M3%L=s>;GavVhBK5P_WP za&ESIrCt#$;rEqV2bwbZvar*uFNV!0#C#61fa!z;MbGk|G+7rHyZd@me2~oOH@cbV zysq+gLR_&2t$)2^=_V6m=?ougJPj{vea+%LWpJLS$UPaKL7aeE=e#W#VB2Q&T<1p! z5qA}x@u;ntzK7dxY-ZxU*=gpq3QVJF_37!IDw~gT7R?f0+E|YEDzw;|ICzoMHPv9o zX-&R*PmGVu;!I!@4>&|%Er;tW-qT(OJ8yK@H0*I79IAx>CQ}k@b~;6V!e^ZnhQD-L zSI_-I-h#^a`9H&Q-*N(>*UV$1?-Y;j0xUOXP5Rqfc!4T@mH^AU*9@?UyT}N$hKyzt zG;Xyaf}ZDLt>BO7Hf#XDv0q&7*cti-2^L}%3D5VuPg_Q#NQJlDnaP<&{?=W@^$*xxRx%( zpDKnr+|ETu<80)+zVN%VZOCh~l9G0Dh;sf)6Si@b{yD>KH2<$t@N=z=9;6Kx28e2e zB`*W321fT_apPw1_ZuYv^M+-XbgwP^e6)WCQZ-kH${@&GHjQj{v#B{44rN6Ul^?Lw z@06l#s&Jo}?qbcDgrj;Xjb$PG1LXA8nTfoRHlqi)JsI73-u$1*+3|{PUuW&D;{rWS zGLVwBx^3Mz8*6S!R%;oEgCjRV3!e>NXX&P$4;qf`uNLlE&er?Rn2zbZwuNS9<;3Z; zm49~$woIE_z;v18jTjJY_NLF}=mIB|Eypfa}-X3_E1Cx2o)tmv2_5&j|YqdK! z@hRuy1VtLlkMk#)b(*E26Q=?r)06;LhTYz^&SUS#N9wjVzPq#{I*NsxDiCTYn63`y zH3Sevd{3_Lw2ugRZe4rD=^Ke#cs*Iuy^1vSe+Z*kZ2wSQGcX;&P!IFuvd=>yf9$K5 zhPLz%1zU^4AfmHQ3XU)!0=g~f4@|ogoeWh08p{2$A)5szxT#?5P`w{|tu4(8^W~m= zz7xO$<-|vGb`$8H4Yqy(-NxaxN_|0&4Ylt;0TIcB_eu-L!H z_}Z6pBFkPbr7_iHB9rMo!JIBPhTRk7K=s7wBAJ92dX1~2IitP}O80aZg5_$P9M&El z5k6CXP{s{as0ZY!(wq34V{MqUyhRPbme)cuU6$&M~kRnLp{LLe9$`dO-=uhwzzo2)6U7O%|EkG#}!Z-v4HH1FPM9rapHX z)`YSnCC}%4t+zf=Q^!}zwVvJlD{*hpXZVGoO3&FKos+-gxi+@iW8umY4c4{U4yLb+ zTF!ZvyiW5!?6W;nU=y`6Y$4dZ@q=EU?d^81J@uPCO*U%NeC8Tr6hLf9))#GQ_v1{m z{!QP)54h+w znrZgf6v{}L^u=v-MJg^l+g0P+*y_Vu1BkXD+S73ul#<l@0w-0;mv~PS7I6MzD-SnDCIXq!}kGS2k4b{#) zhwWoX3)@^Ki>kJx2i?7nG*L^6MiZm_3fv|oePHPt{4TqZc>uWs`9zJy1`S*NM#yx| zaCE~u&V%R==!cJGae0Dw`x)8>&SqU~sVqr3-&~_Mn-2?^jg_>tU!T=&_2nJ}U5wq` zkpifs0uV?`Kp%I7r7)zf7($$3vbCQv|8XKF15d=TuR1RLGEdu?Z{bbu8*gR^xQij8 zJ<7Q4yp%{UJ|LUOz|?GilD@aL-M>@~11g$X*R91tWXZ4;ItWw0TU9Gl>g&%MmrvIW z6e1(`mb-I2TIZ>Wz zviGwShF!pw=R)f|^~+M}423o}f=2b})!3_nD4R4H)M{vwk)#5UHrtqRVnN(hO0?oV zAiIEE4qUh}E#G^;D%Qpjz04{ugzvY$UB%$Sq)y75#^*Ry7CE8NmQJ&L)UOX>+G)z~ zus{#5db^g-kh-!|ih9Q%=fQ+*JX`bLJwN#=>Q`!}1;mdTVyPVI_E`NKRO-~G=`uvu z{E>g=Csyi>L{U(8@EfTND?BL|aq?KX8s8Z+1dZszbJnfmdRwo;pmdkQ?SUwKC*0M> zx$sO){Lp^o>RsknZ2kQ_$4({ya_#m@1x64#pE-a0K{}1&-Qd?Y^v20E;m8KzpT+yP zZd*USB~-~dBuVoG8=*7HWnY`1ahqX)eDP&3D-Vw3>QJpw;0t`&KsvC^XJFj+^#0y| zy?tTy(RO@FF6gZ>^JIGF%tG}HHcrz#`numgp{W1#9v4o4%eT0D2`{XY(x5pi!H(aO z08SFEv(6ft>xQa@;cW&%XVLG<^to~$J8?8Gw78x)06T~BBTP6gIr5<7U-B3x(yDYm zS4rCOpA(^&&M|=awz?zY_)m$;Uo?fMaCOsVF!L=rT>-$?QmuPlp^}V6Xg)VLVXH`B z)*S=>*|nn-P81lOrj>Jdh>5nwJb%J3ZrvzMsex8~b?|H4BwxiM{Raz5ZX z;rvNH@JJr%4(YBbb|Skcxk|C3!V8xJ7$c=@RMcq@h67w9okpzb`=>$wzjXwk@+EHh zF3H(WiR>l=zC@^AXUef72(!>UpF=s@ML{x}i%b;YBi9!@f^Mg)=#93^c*Hy&VPfx- zUfwi&Z5dK@+W<7Y`TdKV)&*M6x#x#F-Zx{L4WaO3XOW{ro--Xw7dHz)9-+3-R{Mm; z<5m0*=84a}5Gwti2R;y#$+?Rdflx^D{LVj}!@oZ2T`PFmPYU_$dF(@$sL=5R5+frTVBx<^#}$ zD(eQ3y6*mez0|Ec;ow@EiRh9G@EsuKlRWW1Jrn+OC;9-#;n0cz7qM(ib z&vKmqoR^=vWx?c&@C<++90|!^ru!^A{Kwi6Y?Y1wtroyPzJCm9_+r2&O`Zp9YbG91 z@jov6k1zFY3(nyj6FxLt_5(b$3_$?$KmOnU@lbbrvB64@(Y=#?4?G29SFg>M!8GZIOJ9tpZ3i3Sn) zP+dRwgAHh{DmIO%(k|lL2A>oeyowo#FXb&znqJJ>!g{9j-))LuIoL>o^FKdG{xdNc zy(ST4$LSJv3DJl67^GIeU;}q>FmCyrNPk-_MaBULr|py}8w|7;MdTs=Y@FdK=4_ps zkA(T9xKUI}`NO#JP~l-W)@+?Qg`q@-DrBgDCB|em$d>Ls(tkZ&JW#+hxF#?f4K2Iv ztH+!iCjTsUgpNiwijNQgpy^-y(Z!D**JK0TMc|z|GTsjK!5<fc3}4&S_iEg(&#j@0{yudm0Y@R?8MjCYck2^GotW!cvfkQU}ZRT=SAM4B=anSINRH+zI|_6~xc@8z#Oci$FP zd-kr8XOo8C873F|{FUBZtv+YX&Y|D5u3udldpTm@?f>#%qLzjqOfLH(OJm?*dQe1S zosp#?-wa3wIsmUG5+H?KO|JwR?Pm?|^g-qt4fP+fRzwt>vmk{)8jL2+o*^_lmUHJLi-bN^Ju_uH=cjt{O|NZ+G&ybrkIJYKzbNY8Cv$k9a# zqEo&~4I(F411`Q%ApJS)_oe*kcv1GYFHar7e+3%j=dsMzOp+NK?49A*Dd~bYF-*Fx zl5olzs6kTc<`Y<#Io^=z#-*U3)2u>da4$$tK>4BCZS^0@|;&nMyJje=lxfJU67oxoUEmXGu0J%T1eBF@cT0c&2r?!n? zLAcg}w=8|puNqLHH$>W0s`^XpTGeibpLv0$Q_t#(NeAdO>qf&g4lI)qRxX8F zhC%Kw))|6_wb7>Ihj$3T{a6ZjyhprdNV&2{l>QMI>FENlk~!Tnc}dmYSzML+3da^2 zCO>vbXn!X3cAmneuGmyEbq(>LuuW*I1?zhRs5Ne1LKcx2$=;Huko96~E`ZTTxA`wj z0h1bk62B-8#AOAB2LZ|zFLWg1Sp5}l1ee_HSGGM5mouXrR=T)r(p|mJvQA#KG%Rop zD{W~`zC7zyGA^*^^gc11{nSii>(z_Z2{OtMJqBF@_esCNh*e;JnrPa=(4*Q$u)iUz zf$n_`f5IYxvIQiOS^IHqHH3MSUIf!K)fsW!lIOXA%b{>JKcXVuce>1SnnDt zo53vy)KpK?vCT4r{_ptnx9R`OJ6(w3NrIK6@X1@Sfo2Hetqi5JM1j58#98=cn^)rK zQSFC(xs2Hf(_K%?N9-P?{^%q_RJw8%5+B93#N6V8piPcK5AMQ|?P3o+`H2FBJCjZ3 zNGWVa^fWIcA5SsW@X7+}RC#HGPSS&ccO9DFL`Gvp8-0OJl-GJUV61VnZEh>jzfCu; zgh*myy+~xQepIC3&DGA2wY$X7W>@;IPkIveNJHAIo{Wi{aq2xQ43{TRZya7Px)d{p z5J;^{I7ZMsP9oL;YL;u@5Wh@Acuccwt%Z8l%df{~2la=MT%tzj7dve#s`3Pgfx$eL zcyEN3YGsOPye?fd%PeE3w}Ei*5qYOQPU->Tiokr$7H3~HcMbsoud*&jM++aGJ(tTW z&0y*Q^5Cg!b3+g7)xyc3$#Pz4QP{mI`h+WCZhHe2S6C0WNWFHxm%U!Mez81|yd-lN z68R(JPZcF@L%m5~_Q4tWpW8?wX$x)VUL6;MUy}qC7WudtyZ4T_cq@^?SrV~&lxUKqOkc>Sf35Z9#nans z8y2{bo?Py!e;|mAug9;1KeKlBb&=svZ~EIdWNtR-?X2jGNBX2Wr+hor^%DDRK2xT? zkQUtJYev1%N6}Od2WqG~N0UgS=!yC3Aq|ao$>pLU6|=Y+ZA?z8lcJrUlaK`xo~Rde z`|=z6bmt?7Xb`#Y_sBjT`ifW$tK3*#@o+jEh%crQhdksFvHFBoRA&Xv?THe|M+lHA zXz(s;Uy+S`&cFB77Kv^-lNFP?=F}c`sw0`ol||=zb&ksKc^sBan0+b{MPBIP)P7YI z+vdVbV~_RqLK+{)R*zD?lWI@FTI27g3D~E9$7_wi8_J-nCVJv1WD6+V)t>88j*Wno zjo$J6uCHQMt_p9bwYM)RSAoNX%`gAi9H3WA|QR`o6R z)C49aoj|MQDt;2^wAV^_=FFmF(#a%r$~t@JaqSp$pf5cQEP+~}LsNhBykrgAvdsU) zL?;2p-w2Qy2O!p$fjs@sWa96C)9eQ_>O~fGl0h0$8meSY_lGKF>Z${@q5XjEc(cr- zSuQJco~0%3c6`Z=ORMv_t5gABxr(de0{zN#;~0`%etBj$zE5dSYxkpvd~oRtAg+;a z7izyS@>u|S>%w{TyC$>yDqXJEY+W3)V}{P(^+*8tnt+jr$Ef($3-V0q0hb0&ynwxc z+wN`@AL^Q~UeejO&mxal+_G)UCJzB*uMk`wf;6oPK{9h%nCPsiL&dZJ0yqQbrI})J z>UE839dgbsgz#tf3y; z?q5Eb9xi{2D)O3QNHRIvzb9PLoAjG9%Pu_yP~CG#X|9m>1pGo@SKhP-7v;X4fZWMNp zvHy*idY*%AvNhl159TeCt&g;YSTZg|O4xxC#=oCEBZIhlmQgcg-j(?HPk!4u=W`!; zhsOUdV00mapIJ7F!UvIHlJYoOa8k-dt4l8zv2PRt=AKE;6bOFDGHt0YO@_;EHja zG2We&dz}nV^jBUvbx+<6rDi73W204XcHR*HhS3))wohq{jHTMD1LH{dKYgZ9E>mQj zRE^L+<}Z3#4eW&+9iuIxwl*-~9VpSw@*?HWo`GyNyf)2ycq+`gJaV{}GpD?hg;4EW z!>1mnHUXh~Op=Mue0tn2j)`-76ScTm`rTj@O~X~ljDdj>*O?y)Q9oDHRxGpg?%Tco z>r+5lRF|93C}#yQ-8a}FCQ z7Do|c89h_F@DHVv!$G#R|4F|+$_;FdAR5J2J?v$w-Q=P3W2#7Db>ukO=2XWkr0`Bo zUwCc!dbHA^IL_6>!)9JC*maOx1R_7MG>!0Te7wnd=MY9$78=0KrrI1EZ)g;_G(@bW z1l56vLhvl8Wa{=NlX{2SWpRP#6QTU2}pHHs$%U$CL^nL7N<;|$uIIQafXoU!pNuF{DqJWqwKJg7-p>8$`a$Di3{}Jt07_`7UcY8N?G$KMUp_U zFNI0|4u6gN08bGJ>Qs`vGLm(dvGB?( zvC_&Wgj5KfF9oDvioHvsld+YF);+tGhd=^I$IKOFjxQ%4MldRhkBomIKaaMc;#`Kb z>A>;`*%8z`$er7WqHpb{Q7uU%@82vbMh@9}FlV3(vc(Utmc@IX8uqKiT77M%91BMX zMuy2y;?3Hfg3z$gefT!H)e$vF@g*Y*cvAx=wCm|~j@Z8@Eq7iBqnxc)#wZt+wB0SA zWVcyN+c2h8{2-C-a@EDCT<3-Ct|IESL&BppJ#>vWbKJ49iM8c^99dwEXYS@(Nt9VE zZQyxO3F29kud8HqDGOy9PkD?k4ctHlq`o@*2is?ZS3Hfw4nlhX0jCvB-h{#8P1Qux z`E>cLiNNMQ3WR117s~^Hf|idTAQU~TC2lGNrbQe;#JM?~WSg<+O&~n7x~#@O^rQeA z_c1~nUmj15`3P`IPwp-~m5^ch zST0D<m3LivJA3?`=61~Q1wL$Fv3wHxUx6JRG(#K z51ZPwE`idDF|aMu&LXICGKCgr zX?7}iRY-G6ot4s5s;F`UH9`N7wjudON(3gw%S`+H6D5%RTZE_|dY$#LC-Xa#4W{yE zsDHA;^>z1h-Ug>OFi4W%GH6bjN%-soKj+4Fj}MP+r0w1qZl6{K&d;87|5{6(QnU4w z)V>Mw#%CuYNFl|)+RVjpINv;K3STLT#vJXolmmi>tDzX*CFFc``ODM24nv9C_04(c z0F~L+T&~>k_))XF_p?8tW17q1lxyh%bo2Pju#S`l;TlDE|{~n}sEeBv2Zwy08{QTK*YK2&uD8}h7c=4kP243#uyU0<% zF=kcoqzZS8aY++g+<@A{Qt?U~P7BKTJ5sMfq^j=R^V6rwKG#9p@hQzQuXAE+&|`5( z3VnF4c9Li{+?BfJ%Z6Wst<-_LM~7_SDqujsX2pv7ghPyqF{1HwT4hD6nkF$VQllAP zz=MlUsi@vA35Gp&T1#fR&?=QSuN2lGqLx^IJsGLO*t8Deh7c(gtmtln(t6(tsbP+jJfMg@l_Sdqp52JDr( zgLlI}L*8FS%jzfoY2Q1%dH`k7RlvkNw9_E!NGR~MGX1L^t%i|T34#se&ui`9))87_ zA<#A|R#P1nzRGa}a;uORUtWV1kOe(@%&C&|^cB|Vw&ey5kd@QPiK)w9tWVO1fO046 z^v{t(?0*i3wOMP^GW$LHrGf*{+=1oe3KXm@1 zN~U+3*&1sp&#_t?S!9f*lA%*r*~Lp7tk z_f%gkX$Iw!tgq-d2&%1K_~tB)c7279S&hj;Qv7*IRj>2P<>!`RVNH3DoA`1&G7=!o zeFU<^!5SVZqrt?@IEX7_0)Tbis0a1G_$U$Ruompq`x zR=_g{WYI7Jg%27CjmA5-$x`7a=9#p(cA({;mEBY)Z~fPP*4h+wKmsA)GF-P7mi3*e>Vd6FfCWQg+`_|d3W_2XS>yFqsmJ?Kfa8~3gP_+3!U#0W zluMtlmix51cms=2cQ(~-@G1_x9C$mFODiG}Yp9M>=k zgaW<{>&0f4CCt@@ChxV`gB1r*yv=Mri+7>Xky>6i-C&b0=7pb4v_i2M?)qq{-+S}D zs|$1*&-hEw)RDi9db>Ij?_b_3EGlWzvf<5mbNf*zECxwq+eQ@NV1AnM)7*e{L;=eA zO@5OYt+ToO;Mxk;MwMi)Rs^GG>Gp5jYwI~eY@D-l!^L?WJ*N2Cr zW#zA*2`T+~C6`kIqG(!HW|fEl7?@YycYeta-^zpMTDY@mT<+U?n>*;~q`No-& z+Xal|MuC>UGQ_3dL}vNZIqU7cR)Yc^-Nis`ia+x_yF?(P4MoW ztAOAuui0O+*bF$sH_KcvchM%}J12AdRh2CHF)KOoht8)ui*vf9v$H6=G&l%B`JNh! zMTt1DVQFy57Nan-S|8&SX;+r?6{`Q_h3m^CwM1tu&xVewi%iC12|I*4z$X;(iDSyK zI>iO&>~Yc2>()MJOcj(-uCz0BJi1J;ALb*Y5wP7y!DZfRLr*MEnMNrmCJcB_Bu61G z7yBw9yskVgt0#&gw9)(Ks?IjTsLEox5+bz@<^1%M2(6Q3C`%nWKbzL7ILYG!3-fQ# z;wZ_4hbFAW?mozej!(wS8AnKE2#v#cayx>tL$nXhm+)x;DIf$y|1zbKe<@D!iAZ|! zb|yxjMXxj0Wb~>{r$_Aywx#8E0X#Kc=7}Su@A!OdzPAU*yhFwxI^EagdT4za^L=mZV|AzSHhgqFMQ`uvBx(Gz;^G6a}|>8M}yRy3=hu4 z$)vN!sFrG2vk}8l2B5!GDp6+JVEKO5WTR_yP-GmgBKp9nx5sKpr;j@uhg=>>JHDyj@DIEFcru2WT<+Q5h&Pu zw4ULOV!MajXutA=Simin>V_}$$Be)}T=5bkt_ z;^GZjEjG$%*q=A)^m}RlYq!pP7;uYBa@ zSw?=ROJxp<(GwB(JG!&qzO3EVE8}jl?6!iJ4`s*}35a2aA`+eQ;kFjafYVF$=cRAg zug(|c^p=B`;hL@u8m%emiPDv~Ao6K_;$)V9)>*UuJdd$$2V;5V;tD9#Lr)i)PG~}H zxW_5v6Y()5I?T& zLb;9Sm4y#!SsBDUq5P*3;l^~ViFZpk=S}Hu}@wn4sd79A(wC%e1Lqx2L+GzB7 zFaYj;^yqxl=<)N>UOqI1<65Vl#f}WQ>md$fF@ieq`DVH~nibJ5RGOFXxt``84%ysd zQmc(6Yb?%uSyB~UhZN$<$6(R)Z9^QeX}RhF%LW05Ywx}(gvW`t0>mNum8}DnL>K`} zHdzn9kVmY~f~w~g(|FAWCru@prV(bjgWgXb<6#KK671W6KVL#i&Q6ja4k&_Blz6Yq z`|9XRJ?!IBBDstcWmvIJDb`>rkI>{#r0F)dqktZ%41xFWSCgkjL725VRm#g@xk)*| z)N{PvdkM0C1(5w4C|01-=}!h@+6D$M%60*7d(OM);dFj#lI7MnZ`gA&6V{F}p}Sv?BiuVe&9-+2*r zb_&N<6y2AXFA^-v^7RvRp6?{+{>=RjlwW@VP?3=N+^RH25c%+ECG=%i|LGfl3YK>r ziy*FAJ%D;cM@i6kM$AP{x2)9$mXGliSf&zA%E&J$koh~Z% z(oDb+RB7F}n*S)tEzgr2DI_93KC`E!90%~^QQ+^R1q3yym-9w#9Mo6CM6Tg-2?bSb z4BmX1xk0BA4^PVsi8CJ;3@|Ty0#|!8A-|et(0xtuZSrDd*_+Qx7)V4g!kYnG(jr&v z(lj+_^6hQ9swjCmkZHih1S&(am4H~R!Lccl6niJy>$uK|Z&l^i+TsG3Qj<~UasSAq zjmxtY-E6whR~jaC5TU`XdB@E+L6ZrEo0+Vt!~~emNvoFJ*Yic4$_1|l?42?X(_0V= z;D^}$FTo_(o{|o(A&<8f>F1rdv&;fQD^M83GWcv`+xdm2_#I9O;>s^evCQqfN*}4L zu4IVKLlCu%N6Q6b1t6MzNfh+d-{mcyJ>#uvV-D1VwE^#EAMnD8Gy2&SbEFe*h75d8 z&ph=kWycd5X8)Rdlps)Ye`uLWrM77AlBYCe(06G&pnVUJ&MMsGfAwHVclR)#A!Kyj z=o>FFV?9;XTWY($fgTICZd}!u(G=}bj_!W{La2M=A&$PYFqImzb+em7Z8Z1t&H41Fo8^6#h51}^cs+I1wH1Iy8)1QrMk~ZLVWzfhbkRf1;#i9x$kwECz z+W?id=aFg*d0icj;OV3TK#6+rm?0WypVunk*}R^K_u~^QJT0(4_-NLwVVPXJwlF91 z#@YQGFk0>yq+W7LV1i@`0Kz#Q>a3p53#xp7H25z4*jdZUdFx!}+;z?(nfn5N>|V8g zmrUO0_AYf$Y23l-rm>2|HbaFjA)h;dMkRpjfnun6jH$c$FK67r8z(*i{?&``f;X2U z52B4mLM@j-!DD&mREzn_l%i>~*GfYVbV%Mmo~m}e?W0T8U{J5YX|TcVQuo+us^x>o%o2Lzq#Dj0}= zCAsv82zuK#Gkz+yhfS3WKi`HrFt7v5XydboIm>lNubMcoT7v!4PenpQDqDr8C99s4 zo|G|f?2+UD+hzn0-@3WWNj8f}X=+7>eTRU;gb=N2ZS^q89`18acxU$~h52d`*+)Y) zal9&5sgZjQjhXMuITOf2!mXNf2k&Sw9XNcm|1pprH{+AoISWE1%+S+R|I8u(94`vd zkf$&>Md)z(!xUaaJ!icrY#x^(avEc}1zsj=zP_(WQkI+{#E?@74X!9rUb}=8Z?TUP zza36H$rbMGn=Pj6Xcl@iKzu(g*!9_Ft2R*THQFBF5p%nJ$>nxBxg=Q^Kz_`@U^o~Z z1xhbTc^fRM;X&IN?b%-E*;tTtAMz6 z-{2K3s3+_&V3XVCvS$|=aMC*ch<6j8DKrqoRGf-C>5{YLNyfrn650EZKhm|EZuimSYqlfP7ed`QrhzG)4R za^Uq&ScM}cfEOhSKLr((I>;ets#aZSk8?2o^tAs|OACHOx{451&KQ79617CVf3tJw z-R34*e(i;Ocs;W3hlzwQKqMOaNG0{=I_>e{@%uM!2SSjLtIljeaMG>p^$h;bP{ zcN3frt^PAv>Vgj^Ld^w)uS|f#|43>dyuW94C#<1C(*Oo3vaw7QGhvcpHGz1Zuc z8*nbK%M_ygyAJ!WUhES2NJQl*Zq`3o9h|Q_oX+reEz>_d{EQ@lKieI#Jql&MzRdJp zl2FKg>jqY`JhannV3pMRddOio>ZWEq}iK|Mhjf zD5=q=3l623!}-M|z1z_VecfDkl{41qrT6B-0}th&EjN3*s#r*54rKWAiZN@9baYbhK&riwKt5+uwZMw&;xP73|L#v?x8x7`xv!LRq}I_?)F06dJxb|5 zuUcV!(4cm#u1n^ef%r$iM~Y2=(7K_q|<=U`H(-9Xs*d)Wjlo zC|tI<@w0n7O=QV6eRK{R>xY~c6}rAqN-`l%D-YyltpKwkaW}V@`}@cmx*`hPn~nTa z3GE}ROuzTreW4CIXa@R6iAjULuz3g>|3^2ipdWI{RKdZo5JL1#SQ34Px3`&S=@;F( ziq3eTsHKIkwj6%+*~r+q@X{tCb`xr8n&~n&kyKJnplvZ#R!)FmDDlU4 zzx@D%1}!K!hSy2(Mz{m$Z@B$l6_w6n-Xf_2a|**rb>lW zt`OW16-PZtz6&TRf1hC^^axk$PS_tES3f-jH=+`>Tcs`l%E`c(z zAVee_UcF?Z`B&!C3Hr0ET)#h#PtU+R(6J-CJ;BclH=B3A58d1Uq0R49TsOW>rG#{Tnl_%;@ z=H6EYH%`&J`uvY;62Rx-?I!;f_Ff#x$r^u*Z=<*MhbkIbcZiEw92|!RyA7YAB@Z` zB_h<~V*?Jgp@DYPGMnynnahV?9cZ~~NHg897Jl%^Q_oLX?m5%0+Jn`X+0=jckI`Tu zf04;0Mm5INPAYGakd#UC$DjVUS56q?ebEOvuAzK_2hlqc>;e3*WujX~}?FBHiC?3<)R!Q2r3x`hNPQQC@tKrWb zJ%_DH%4IB6Yrx#|V6EjmYYA0UF}w9k4Ok&x*dNaQ(L2>9`Ie7f{$S$Zg;eGY4EyED z-?y{OhW8OJ`l{fbRO2(;b3cSV8@m_>J)dVUOv)I=e5=`W`1}n&^yCe=Kj@-O*zaot zgBdL8Wy8Fj=dyP?6?|dr|J(Tf@w;#^(wjl14;y3P_eb)t`x{GqN(*%&E#M}UbzJg| zyBD2~uW6{i&}$jt{j_Z9JoB7)Vh}vxEVpjQ--p#l9loy?vzd?9BjIQv44eOPn*DG0 zX#x68&%}?jZp!{Y*4{g;$?a(u-U^5fL;)40DIiTi0qG@*(wjgCMT%6BCN)4PMpO{# zRir8)y-DvX9i;azy%Smp1Ong6E@Z#w`2Nm!uJ`=6u0WowwPxm?nR{kEOZ)n+zk8w< zQCp46CllrNvqKpx5xf@ZRzS`zq1}n`=ZZw^+-%CJVs$8bD=KZB>C(cimy2Bz&bC$q zRJ$#ec=31+CrHl%(f&#vDr*Iz6%*Yi`;Ve!90og;#6=&6!OuZCagZJAw>7U4nS;#< zzBL}$_YMuo(lfa6c$4B7C?MzYCXAFT?4bacOj`&noIC#0u>k&s$}juCFJ#9fn<^)U zznMFptk-F8QMF@)`W2jYU@l@6PnIjTbTSgZ3S=l7D@Fiz3L@}5W5Y|U{KO~goj;Oc z3GVV=Pe1-e!y=$rndXeVs1kv7nkqolE0Q)v~0#pdwGt-Tf`TA+;on{9{`2ax0WOcYxjk5m1uD95 z$}c-hO-w7zMX2wc!(|hNoma8J^EEC~A>nDcverOfWCQ%130koN?mQn{^0lGj|Hi=qHy3iCMCq=(-s}U4DUMgETHa>=%B=z#HHD7R8 z4w2JW>#<0P4cQ+3|4aK%0`{RBF?FyPmXcY`nS6#@OPg`gb@7IHCd2T~uFMoi&V{`_ z2z{Zm2T8Zo8o~5^9{~`_7s|XG_zsf)X1DU%f7Huw&OrLsf-FxLgYo-H>UZyB#HXp2 zP_+ct);RvId7(}sRt?sE<9zTl8O?^m z`e`hQ68ee#_|7#p9Vi5z9m-4j{HR5r>)by``*Oo73&z^-4c7IB|IzVz5e`r9;I^BXq(Z$hqr|+Qi z51-pugn~;8GE>d8@QQAsl&Iyct(PK{c}GSK(Jl2+G!^WMcLA7WU8@vfSMD-`T{(5D zOIZr|l+>X_9>Sk~H_|*O#HA``RCiiViSEW8dB=z; zX1VYkY~T$P8eR)Q+{0OL@ zRNO!;$xvt&BWrJC%3nb63=ag)0zxr_$Zb#w#DZgHb(6Rosw?YflJ|cn6~bpvsq-uo zwP5u6&Iiq3fBC+V{#H_!uJrNaNOD=a9*OG+lx1=)Pvm^xhsUd0Bz~fzA{uF>dL+>! z8Z0w5=^`4popQXpyPxO2$OloKB~iT_cXo!FSg*(?TwGjG@2oP{I-EVx;cozWxkfgi z1Sb3<;FUAMi^T#n8?@jv+d90&R=h{tCH@<{A{aO_?d%}CYHYlOTA;3dhQ{KfLAXHmlz%W4t9y1Ke4Wo3`9U61kSXdumWmRC^7c65SkjYILKN$MA;ky2`C zicFqQ@u@T`7C#Ir^-H?`tOTgKV!bzEZ^*9zXTE->P!|I(6t+P!8&J@t-6`|Go(`jX>qx*W-cSveDXsw$37&VHHs zkFPCV4_K=2yNBpC_bx0Fd^5~7%sZVKhtpOMBFga>r)BW^W6n}chPT*x>ts*@Sfj3*!CyGpgUV^LU z$%?Gdn=dO*m0NTeBTki5MQ$l)DQA(|tYXie6AvJ$rI0F6OCr{`cD-AwR`WxjYzf=^ zyHVHWJPy^$sTplAP{sw%?n*vR{a3yEhU1=zY7tR^p($ zwt~a^-u`|CW8*Ll+F_OerHHwdG7D^iR=$ zxln*?gX9GiQXU}mk_u~9CFtnyMsK+&Rv{Y;UD5Wd&;bR6ZmNbxuR>L(>7en|G~{xw z?hS>=+Z$z-&-(&G1?<0sNA~T-2KC;Tl1ic#(cq+8rBkzi@xHLQ>?WEc!5O5N!>p=V zk5_b3TpCjN+~;l&dgFme{a36qo~>f9*`QqMk4^PkI#AI# z5eI=)L8MWP^7*j`;9m6KZRB5{H-Crx$DcjaV7!K$Dl53s1nx~yfSP*qmpGmmp{FBOR?LdL zAhB!MxzEdMKl8yjFhtnlODkVTCG!C9AoV}*0*D)%t`ntN;Zd!0*)Y=nYLc%~Q65Kf zZcgs`^YWF^GT1G}59}zLQQJ{IFPkqWX3nHzQJ+Ii65uWjh5RM5+S+e4G*FtKrg%{b zPsi{My#|sWmq8_3C6ce722eNeFs<|IF@pV*kH>aGPu44cV8Q<9i_j^!kg}wHsVXsC zso6rh8JX8pii#YXo-R_LjDxa60B(@E=DK>5pY=i^Bq^deyC_dd{B5T(CBz4=cuS4u zi)s>p)(eFTY;VB~aAdAWI9z=7wuh^NLuPn*q{8ecy{YFygBW|QK)gBd0CQNS;0SyJ z(69S{ihd7yRmE0A9>N8t0 zpD$kPCUH4~(((_>fq}d)FMSBe@_$W0-lSnW+%z4KN9aan{1~~szJ35D>8JMHw;_Vw z8UNc*?OWugXEP0|y65w&SI_sptws%7!diD$8Jepw<23fy1;=-dUDuABcg0X1s!(k% zCnxS9z3nfU#k>^|^cUJD4z_UA3!nSSg1E2Tw5415Nmjl$icSE~Ms&mrLnGdpv>PyCU z6kONJoIFR?2cj%<%A~QU!hJH-M#uVC5Igk2eoJ)Somz`Mxs&u-e=bg|Lg#Uc&|fjg zX;&RR(j}9Ta;_Va3~Qv>dIpp9WUB-wOXv~sP3mSXH*n0VE5YwR#}JnDyV2u|z8ZFC6}yN7Akg#vYXp#rv^pA394?^xqEbQdwB1@lc;YFy$~_C?OSPb*1AM(MjZ zq|$jDb}QtDSdZvQV3q~eDz_RXo*H_f&;z-lr1Yf&^OfYBJUWhFDl6=2RIX#c89bW# zz9x7*Ek}a6=pOp({I`+ro*vV9`khp~?veUsr>Q;3`wHpa>XwQh_?u1$PPl;a#s^tJ zZ+8f28w&`dL3X~`V9!fz&P@-yl>P$}L;gUfoql*zH8xT}tzC3p&B9_aG$-eeR?5t- z_JkPrAo1c`zbH_Ur@uzPJ?O$1KJ)!uGO9IkVDC5%s%1on(6m+A!sl~D&!r~#RYi$N zg4^DX=#0#KL#hoKV5=RSi=$J0a26nZ7)KffTyImg%Yw4@djfYnMkH`NEu;$-@WMd_ z^xyANvIR17D-qIaLQp{%2`MvPLQWl=37dUAtsFKt_lsjq-)rnFK+$(WlaTv{9$`TD za=0ta+CF-&X6ZO3B?rW^rBEa_A(l^nHC9A5^qd=hg{!{^elV znPX4KcnV|@jlYt0gqiWg*Otxk3XlKg-)^zu4A^+Floye-RWG6oi%11^yiQEYFzB)J zRNH^El_GlMf`eY!8ECJ2b=$&voC`CKNLATak;M5|?#=1q+HFTmAJe<6-%CKCze84u zud#7+u}67F?5AvY=6G8BxcwOZmWm^)AHH|(I3iL_ee5TgmRE-TI%2kp{Tg!$_pd}d z5)c^A>7D01j>NCF>#gS=1OOO3fjraOo0KzU<(EWy+He;}t*H^j9B~)f`b+Vt z+>n-JDF9h-3CZbh8gG4urKu527Q@nIg&f_A>f1EDJdchyG7kwDoa>4YZaX0%cDLJZ z855QSIsPZY=xPoG2uFrXNdGKr8&LJvFDnF9*#-lnmZ zpJ;i&ScTwDrdd`dC9rU_ntcy?33pX}XVo3LU9F|-EjT^$MZo*0%oF=DX{QKjW>PMb zSb!jUQRbBo!HkU{fEPcn_&M$^FlXh0`v!zR{ce#m|35O8m^FIRt2SO5+Vy>N=E+f>cU;D$G@{AJn? znz3=_v3A8z9J}6_6*Q#QfETt#@_6l!gyDYFVUZ9pVZ{5Ls3zps?CwF0^b56L0S)M= zoTz2o@edU_W)Ly;H^V(6KtSY0JR*nC)2$Lrd=Lr{SBAk;j@bu z!8(Pwtixm7Hut)j*iT@F3`${=S)8X3w&Q)Tt2$z+kx|@n9QcU5IyvL=1e*nuxx9sT zTnD&|NOux5-pXB(HsOj(gd3b%@~Kv-v7P(LastY_wzLvn1zxp&*o{dkC{U85k8A@5 zRB*CBLxc(KuI}hgYO?P?%UT&eT%lbc?knf+s8y6}o`}Sch-RB9C@W%VNnogWj0GT6#Crqx*_SHnz_pspZHIeC1SWW5X@v_zvGa&Z;xG^Z=U0##&O)(FB@}sesp+=oqd9XEFc0Tri1wc>x-3; zd;tSIJG%hb*+v(MexQc;btJ$DD1WdC5Mf`8ulK&SQk+}P ztrb9wBS63_!lz0b$Wi|m_bT?&7te3Y_1D35P98%ZfPfp)^Eo8U_@O+&fMk>DLXiF0 ziENy|{#!@#kD7hUg)kGe2Kg! z2|tet2gqf9%CBhm1t_YR_dg-kfOw8YPV!$YG6%N(`1&m#Lh_dv4Zt}@$+xFMDsga; zPxgplEWg9BAM6y(ko>jzx`RbtuW>aw`R-3s#5H<&8i44ni+4758AEbEw(_u?`m0Iv zr36;Z?DEIm((U1@wY3rf>E1iV&g@)VQD0l={*_#a2&#&Wa@5yGSN?6g|F34c2xe+I zSr-k?INT-DaS@*4JKnsVxOT13_ z)9*&b6uz2?S{DRt-9OQ~*4c%|W<98X$KJ5ZL^nltN*gnasX2OsH=C`&srvV`f5*)6 z4xd&upqdJLaSG&`tHBL(8LA&oFX8F-c5*7qg=d=V&N=|ejQ^)d_L+vQUr0N8+GL}P zllku5t~5r|0B^1@1Wi z9p$1eB`>jpdaH<}YSz5T(9&$khmW4t)u7PmIltohV;F4;r~4OmL%|L(DkL1S^dSlJoK=BJ^cosu=u|eAgFmP8}OU&3e2V@DA~wO?R#t13-Azl z;tVsf;}t;y8vZYH8^YH$D0cz%)(2wP~Zj1ZDgZxFH+$V~h0&^Sxi`WuO{rNZnBqlPCyR?tRfxH81 zXXH$`l-^OW(LblApr@DjT|Ui7k@b?#bLjd?S}DVS1IWJACq#+;lv=~XHJY1S!dx99 zGw$T48QOhizLl2C4BoULDkAa-#$;n<6*)I&W_-FR=TdqmPejfdxr1z^2cR_2<6s@hdv(Uj+8iM;!$qF|CV-p4f~dZG(tT#Gci#Z_6^~6 zz&;Mm%DB8d!N;0*so@=mh83}YpXaNy*H~G~CDBEy#cMg-)aTbO>3NhU6-bE;i)y?m zl^PxyPEpY7(KU7mD1`IB%l!02q+(dgRY@ZrL>M#(@u46!fNvwX7QjGj+`*EFnEchQ$}u%GCIYxBwM17 zrB6A?uIA9{c{;R)(=uYNUxfO$O}GsjQ5a7T&nvY}SaG%jS^UfXSYC^k+umP_i`#7; z-p8;$f%;8Un|pMkibsfm@l;rJG8`)%@)=(2k&dyIK0ueB;d0li7(`@aE7sj<_*Pvo zuGM(yKfRnbfeF;G*-K3@%omrc7m*daF|3Lx1HO=yVQ@L zeJm43lM}3`{BUFf?02=*)Os}Rd}nH*@540i2tDrZ;R{fKb_}{?>Arb~(6BpCN4^F) zQyXdu8%s-yqSRLnV;LfL@Au24UezAn-WJBACJh_8OvKdRkpl8d+ueDf%z;loClMUm zQ+!94S*MF_AjHo0gBHrPL*&ufz8eK$sP zi(qL&#=UGEJlal2A2rgxrldfJM-WF2&TF1qbjZO=vhwnwy}cS}A5IJ27EZ<7%(wjD zg^2xzG-StCM3DWJ30`$6UmE|MQGGAACR8hxxPs-fE)y>Zem1GM<|DSM;vlL+ImsDV`x)+EnEF z8av!@n`#LG{XBQj6{p5|q0p(j(a{ZLBC<~mP-;ifqUHyw%ctn6VHBtJAwKUL{hPOm z-!JQN+oeCRw<7EqVU!PgSA+!S`#?*_$|*k|b&&jKP%bCnyEv>4fAVr1%NO|xP$?Iz z>*(&Et^@3)prVz=Es4Vx#+g!TAo|k@kRee^YgqbV1+SfTTt?Hd?4$nmHX$xyC?k^; zbfw)MHk_!IuWlaVNysygy@wR&Vxk{zdI!gQs4+;s{<%-D{fyH^@&)poJr?Qn2o9$% z32c)~Ec$eyu*9F+)cf-c@A84D#{JH^)ABv|H0h2nM5SZ}JKxs5Ci3jPe0_6sbExEv zj)gli3qXe;Uoj}E*5B5x5=(nS zsQ{4l8&JOcT@HN5IsiG3H>pp}g|(`usWNNsBDw`leilxz-l5w*ae{bCE75a8RBdxk zs`xZjP+K!V78!YUhl1YT-iD2=JC4K$=VsCpLLM)fCu`&UX{XHVBrlo&?=u3R1$u$j zXUMvp@Fu~)M*cEC-RRjh3_V}cnoSa&)6X;nEt{v214iiW65Rk{9Y%mqu*+)C zdNl2afo$wDbwrFlGRTun7{I%h>XQ*MN8C^bNpp)tAwGvf|K^{`BKfG^7q20bCko{4 zs#;mNVNx~AvHv9k`&%zx$=nF5*kcgTwISm1bL*s$(>wWT;#Q}3M?!xl7m8v!pfBm2uuD)nNASD z1x;yU#KBTL_+}qa$-7MWp#d^EnVG#Qfl+TvPfgRgvzji&oM88a(S4v>G>JxfmKE<86kp zk_PIoMs#eNH;hyQ2MhSt3&3@YLKdI9)a>LeKIkOV5F5c>CPWR!=}Hp{>;E{>4X!^? z3EyaTKZ64kVl(lM(tbH z@mn59qRZ~v!hhCC_~Pk7kW~U^#B|pKAHI2kn2Mu5Uq4POR~Zzu*1aU20Vw%@JnDnS3f)yCA;ByvVO^+ z8$EXjcS6f04wC(V6I0~HygUL~xak9pa(M_Z$InV;Y2sbicOmaguKsJie`6Jd0VG`> z5Tlt+AZPbeeohfaFuOQxMo+w7hFnWQdN92mBu5Y56Y(A zVAtuxecqoQ1k6l+_80GV0ummNo>GDcK|o&jo(aHo;5dqP{&2jAkhCE zlbHe60NOF``L8Z-3Ip&j)0Wjt5;`aA0n1$7_m0aRWUgvT^|IBEg zLdQj4r4#T(q5I4?9{0l07J)ql#__&QtS6d%^SYn;pIzU<kH@N3f^AM~rKDG@84V zC$KIDLIfBTl?Fsog)_Wxyne=N5Oy~XxXZW~68jBEkN(vu{~Z7Xx%7L)#XLNdxc&=x#9%B;`ZqHN*!us!sUFnkc5hCTfbmTWpZRW%8FU+*?h|pr_EY*xL=F@-UGdrpRPnMcH_3^8QKvPO z+269{Qz9#4Uee)ILFX^85Q)gqXQOOPX;om*XtF(mmyDHPMIVA#DlBzYF>>3E&)>UW zYCn0l^DwRBjk^AzWgk;^3%f?rTn-iW<@S|c(~lR+NU9j(~ww#(kLh-B{YetHl;WDP ze!*WO+5os_(F&so!ATx|^CPf#cWqAA@0_DbWoB(r$^F2?+Qu-CZuLKWpPOE!ZnL)~ z;0i}59laNj3`_G=;B)#RYk^vb3IZTXsS@ z+knGT%mw$f2U{Dsa{#y2X77NFY6SrtANi7V%?(r3L34rf;0E=2@zUaAq@I@nOI$Yh zM9fK{k9LQ2yf=GrS8nTMU|On=_O<^|smE{u2t*vx{O_&2bvcm3WQ))bADGDk0=kE~ zXex*Tl0sNgnOhh9&o8d6g?^o?()T)b1qZRaKk3*H^UoGv9)S5Hd1?Pa$v==Uf##Dc z)(0Q~{1n3ycX!K#?HeP`G3$}sAsQRs+YTPxZql?Uab?j#ZDe78Se32Uy_vfhpisn<*Pn*>s%`3_Z0s>~YZ#eIH zPec*J!Oq==WfgtgM=VR+zU>48BV#ati5|)3U_RQMli#|-EqR8jB6UoZSs~G7oq@!b z)59D$UXtQiiz4+(>*)KL-q?~Hma`GdqPp_ws-q8NBT?)LU?`54^!JFCGg$O#Xmauw zP{Ud|zk@2J*N8{xM(RSW9FZ{D>XZeOML+rl4#yCvuEK5Xn!fBIG}AzD6-FIlKQ z85IK{VFb>J@CZHqoK^j-xFa0eSJLcLu{={N?)0^4kY&2T{|?8M1Utp}$7txpX!hZV z?3MAu;sr$9*XSE+nMC!1`eLwl(Q&4T+^*2zr`i4)ZNpaoZiLa*k!*j28YyVVi%hAEX z?Y$Mdz0J;=ofb;l@bfMSbUX*RNK@V$qHUXJ>v<;1o^-2?^(9`oSJ*n(m40eK-8Q17 z%4@V!q^ksp^pKXI~OzSdPXWrlkn z(bUH0dhpw%N<&USI|%RwL`G9zAb20gqEB@OKqJ&1c9S-Rpd1b|p$|y(Kp#f5jN3j@t=SleyOSjxtou zJ?A3Z&g9kgmynH@{7(pae>|e)3QqKcQz^!CcZV_l1u%;X8=bBpD^}?F7iYxPoDFlg z9pSpy*py{8-e_tW+%3AjnqO_?7yg~#7>NNTE(Bq-Ij0CP8jYM{x@F!{dsH;Y_msyr zCtUZavdw{ZrQMo?O4Lll?*K7<-*vyezc`2UHw7IQLWf2BcoZs& z3!)T*r{`vxVt;gn=49+#h6=QjR#?vR@Gu11#M#pu#$>KZZha7oPHp&9npeurJxBR%AY$Sl{RRIvFPA z8Phwx+m*7FT$H5XS!UzY-K`hf=2DV^r#UX9SLa_wi=uW%QseUr)BeC< zgEG+;Ne>FiotGc{G152OOI?Dq-V?Tveze8}g_ONGkTs55y=@(=RPh{lZCM~k%)^iN zp18vJpbnRcE!({YkDX94;SFCqUU9GRUIFJO)<@{gZ+wX4N7=d+R>Xc|e3NvcWGt$& zv61XaoAV0T(#6n7K5da0OAsV@+R+U%(*>-d=i%*?msq4E1)VdJ17dEK$Mp{zS#TU_ zJb8pdBOa34H*)P}iA*s06xSq=t8-cmz2S8p*XF&M2`L|rNx>6BCG$$tLv~w|Oma-T z$<70o-Q%hjE6bRG7Rd){e5|rDo&(=iG$bV#FgZwN7hO8+HVJx-FF+Su+Tbki;l1<` zB`H%m5}miL5Xv{tKdrIa4g-C7^2T0yAouc;{(jPwzwN3e3=#HqjFk(DNJ%%UfN#a) zezGg{;(AiDa~>}3*aW|>GeM85Lq%mcydS@{>ytU67&Av%*L`rOx%V`FBd52^wOhx4 zBl|ghkpec& z@x-lBhsK5{J}Aky?_pwSWvD56c*)6az*2Oz0WJLjme8U;*>eQPb@AT!z>YW?!i&xh zc&g28mSs(BgzHe2xb+E+$RX<=46tg8VL83D`U1L#2Vt~J*kf$7mv1^VE+a7Sv@!-pin2H`)bCw4|u z^t4NN(WJ?#mJ2Pc|df zgQ%ZnyCn@95HQtd1(T_FFu4i82D6d22+P;khr;%~Rg+|@`p*{;E73RU!i%NHHQBjK>E>dp=P~^g0`YW#4NI9gs z&s~O7tBlP_+K7Hn8_&cz=>nveD>@r=IZ!3)RsJHjFyCYTdz*BM&X!AB2P%`JIzd;{ za8%Pd?NRk^0o)(QUdA+=D@bn+pezot9OKE!2-;+wj@mY!)nMnyY4~{SjT5gU?n5Dm z?=oIm+04;KH)7RGk~rsKz2?y5AHTl5w`oMgqc`4^)X=GdvN#MgGFoW&hPO+4 zh$cN=wbbS)G@*vmO`@&sJk_$X(~v_hId`TMji^XpW#7Vka$$nb-$5GbaS6e@NaE9b zk?M2{N;J`2NzlZ;^E6R4m@8e>u5Db#QxBpmHznJosIS@F<+!%|Yo%$U%8TZ+Sz{|l z@;~VhlaEtkw#k|4_6kKg6EdRLt`bRrA_7#+)x`& z`HT{Yd13lzjU)14vwpc^%SvcUmW$zH8wsA7dza%kxoGrU{OuCcPM9$4%#4hYsObxG{j|<(K_QzieP`#$oI*K)skvja(N8l zfv@m|6@Hov=fR;fmsLZt$7OSLA3gL*RBSP4&e+QnyxZ#BH`j!49OJ#gB#npZ%^h^U9UOdpm0WIqvT|1h) zDQsp|eDT*oS38)1&Ry`L(|{N#EZ?wQ^#hsC+^ z!q6NM#7DdI$0QLohnWEq)XzG^ZmHPpUw{i~`b1ZGHysXdNnpBpA{DTcojEx#4(hJ6 z#J8$UxV@UmP%RukJT!YZis|L37_y2bcZx^Xf*fO%Qcc1YZP}eoi?#6%Fn>PIw%3XY zLK7p8@;_;;dD^F@zB`EJ->Zd3xx8AfXuUSuf^Z|+1MT0qPSFH&MDn4IE z2?p}+pi590^4+M_7orGdojd@80c#*8;#ZC3RfCRJ<&{jWReMc5CDw1VPz1%>#raVq zVt9aGCC9hnKIh#8y`_(jElMjC90yBnax)^c!xo+^v_{|Vk#vX|^0)FjaASIrrQ$;B z*LK~}x6B5FK2M5d)c6_{bUn%(iv($+05ep6A;mW5BJ8p4z3tet)YjK5Q8bt(!?jee zihe8SZz{H&py~mA#Tw_HZK7-kQrrdkTQPtJ zBNhyN!DA(xcHO?`qwR+|YUKr&INVg^$F-(iQ{kYMcxBBh>>Bh_nI}rruS_9SO(y*h zjKs93-cz^k=7FpG);adSZli^7Wyy{n5aXSF%jpP%BYn%MA?6xEha%`_-ZHuyfzznFzyCuYHT3KP4&3sgW{+ zXN~M0?Pnc)UzWH(z>^^GC`WvNZm#d?3ZIS6L@qUIV^P4-w+L0?^b#{`zAeg+wYA?^NuqgYkxshZwceM$6>l$EHSFiI&g&XaT_r2 zSzb(#l<1-qIovrKxy`WROj-dHN<`HQHG!yYGGiL2{%|xudvkBh0nw%q=>d*o^dNjp zh{&iAKF?amJ?qk5kHBy8oxR*Nqh4bf+Yj}2LK`|L$jV2?+fWO^?oWU{V|1Q4!YMkE z7*wIjs08T_H2n0-Q&H3L#wbXB%~E;!&CSYI&-pU1`3aaDDAdglP6U=j(6A{hcZ32a zW58iQC)M^2$H7O|FL4e9$w5v>eBVc&CPFp<6%+y}p=&_{D=v?q7M{IUEnCqaLb)Bd z53^YvE9YsT;-%wy;)5e9l6j~J$$K0S1pUr%^j7`ERcH`8ee4JkRw$_9rsss3rt3`KW zj6L7VP`00}2How5_Q2v=kZQlOWHW*nRNs`o{^sp!P4(xO-#Cw-L2Pvcw2WQup%9H@ zRITjaY~Cics+DHYA3vlqLi7RG< z+0+%P@=1ej$I~P{pkiXM<3p+Ht=t0@&=9cP>rY#(|AQ5yjPw)T~A zCiV>Z{P9!g*5??!QcOCY*o?vs+jY{%Ru2_u!1|;TByu@!&*XMhr40f%YC>R7G|DqVZrO{ zj=adxKlc1jZcnonAxnxq$DGQn@bM$KUO~&}-34fbT*XHoxT}#z&3=a$R+46wFDv)i zd!K2Kc5Q>nt6bKE2wn)h=qR7ktognNGhSDR+*ZC!r@U}4?+Pl>c!A#M_$Cs|6`Yr0 zGa<@GyRctfF~{U;E7SI}BsJw04Yg_NTtN7Bo_I@*fIez>m9oiu9ehY)zbfw^@uWV3 zu4`5Hdwa$sq*a`pOpoGm&2sV2iw!DllUCR)7BD|?6Hk~Me>#%RZ##J;U@kvP926~F z9aCm>n4!z)r+x#YCpY!E2E3blquG~hwOY9K%dY$C6TyX;-M7OROyZrck0XB>64f`$ zosnMGDe1`$9bnCMQ$k_Ks<+Cb?VH)(G!y~mV^;Knjld4k87c%Ux!+PZ*Dg~KkoPp} z+N&Bh$!h>_xvvh3Aiu5-Mc(4%*Dpjld7`kq?0s}L>7bUE;PqsI!x-|~p zrMlK2ji`S}OuaZ=k(wzbfg34`-``&|Nxx%4QtInSBhFq|)?>=?I0pl#smD80b2MW4xM85T%%2<_QJoVzkK;xqrdC&g zcf&o;;H=`HTrO}vL%CeN5P+U_&O3se=kV-TbW0uc>c~lazftuKE*DS{E0$1o9~cM< zr<@PsGXvT2BksLDQGGtD0~^Mt(6J17ioQpdRE)PZb~6g)rsBsDBVJ;f%+d;-R}51R zq~)1zNOsG>y4k3Tej@g(aT-6r*WJ<_Z}xU6rg{SutXd2V#DBRqOtfQagk&U2vc5T_ z=cjm~)jaNcJPc)KDfdcGZuDqxvz7H8s6w6sO4JqMWNrU_bxpnj`74&461B#65Bq@h-Nbcn>&SCqF} zmfnx{J!!SnnZ+{|HY}=Q!Gpi%S1$!`|EUQ5eGX34dJa9`2R;=K>*c0@TQ-&`NtspD z{5~0G>NwdI->2rAsveAo#Ne{iJG?z&UVbxtc zmwSq}ujK|fF=xqAv$6J10+65UofI{;mqP_ZzjgLrHN@+{oF0rToHFRDCI8W{0>lhY z?s@u#)sZ0M`I#nh7|%AbE!v6hz}gxW`K4c(MzTTgB40RU!#q+sm_bjV!(}$o18qNs zW7ziakZt6_8I@hUOujQ&Q=@$oBVN?HrIiS}J(fxkEip5G6%%~Jr%eJYIfdblPOW~| z^#$X}fV270p%VF+_?gRG#Dh2xu41u?TX8P$6j_1LEexrgkRG}d=o<6FMX ziG!luqE))!k9t5y`u8ZGrCJVMDUk4rO7?HL>oc=Ax<6{oVe({3xL*_qTP~f+w7nj4 z9b*v`r{Xyg~JL8;Ywr11Se%lGpd0ab{5o zS1PcbJjaH3Ts<-s;JrYpLSh}q;#BX z9o&KOH_z5MlB!58KEX>ihy3pHoq}=wy)-qOcdI27fBbQeLhj*x4eg4y!3#4Zv2trm z`DO`{gL<4n8IVoU5lgY4Wf0-D*svj|03Whh7ZfNsEHd*vYRl^&GIdN9uBpz4&rFTGGANK{pXZ0#G(AEp=f3h^21EjEvXt^A%EF znZ}N`5JZh#xZTmGQ>HIsMi_e`8%dHv%3tQn8XYiUqO+h>8&FKTFAxjZadPm&iUh%d z;BiUUK1(9auIgEZt(g@Tn|bhF@bHnt#;V9ORF-AG1o1K_r^@`)4&n*GIy79}X7wtQ z_n<#yvHIhDxnFM1TxLn&oKE^+q4KrXVp+IP#YcF1Y>&y0ZXTKeI?#nCzLRs!>O925 zfx3!^#rB{b)EKbmsFvSvaqq`5GpAg|keP`(9}0)Uw;wflM8qV7E@gMn>;o(d>)|!s zc~rw2zX7{HRBD)H>%8ZhfANgoZ%%_6J^3cM8y)92P3>_;1`=SF_k^N6aj2Ex<@}XPVT*(?o+ow~0UWa`o z_AMdP0T={KK|uNZy0y?&Rt&98;;wx4e1 zz|I+}>*w!#6(~S>0WgL4z*^JJtS!x@Tt8$)BLs;BJfUMQ<5B%-37Ch}j5Z;0UPtkc z@Zx>3Sb?&Yc6drk zcB_y;4GSyF)d+AyyI}J<28|D?`yOVd$xQ{4!p)TA`hNv`aG}zPHhtE^nMIP ze09%jfMI$ORdO_8)&)&OUw)pr>)RZ?x$ecaQ&~GvxfooY^8_~lyC5s)^!~hgJo>%< zLA^bVtBaCBs(gV!>}=Dy_O}M_%+iJ&aTQbh(>Nno-TSp6yeoky7vp*ZBY1yYg@-*S}vPWY3;#MW(FfglscPw4yAd zveR+0FJbIE8AT~6i77e?S+WdS3rRx75Lud0lx+;gFk{SnJLkM7=Xd%w=6e5ouja40 z=9>F{zW3+*`L54>KTr7)cgJd{{Dv`bTUbW1Tpbbe@Sb&@PbcMcwl4A4ICEmD+~XjO z+bjH-_xN2>=m?~}$mf-1kRSXf9f*s99TBYqaq*gV#4~MiLL;#~bk;Mc0U+;G9j3oh5{&4Xk{TBMXV9 z-gIM5KFK2v3B_I6+EH^!fmBD?p%$+9sRD6v818j$KRXwb}Re8hEX1%;g~{9u>Dv1L&g=tQL1Ygo zc2(9VqSV(zAX@b_5x z`kh}LbGgWt&c|yfgIC7#p1YTO563)6JKm9Dssj$C_(bJJxq5(`^fIB#oFi`@MLPH@ zM2B(CS^$9IN2y&P-#~f;_x<-ocWktK9A@U~kW5)P>VHtl12f zlxn8l77i^nylB@ItQFkKT!p>gM56nCzWgB4nheO9i zMAQ1j+%V5ZT5Obstk3rZi#?9Y39v3V85K-gFx#nCG|@1nX*&=t}1Wb#}jkGnv2{x=r>D+y6xSg9jvaB0W0b2 zxFXzXj>+{69W|m%*e$fXqF)uh8ybJmczaAgRfRUCE-dP6S9h+cjpX0`Qqg5VbAxU- zV&3n2e4V-&CeGQ_6@?$m$s|-WkhwSjkdEp}w~NwCMdq#Y1`LGkbnet_);=FHPLbC|3_PsRns^>8bKa@qMlJPH_f%k4 zWhQvz*XySrl^pAz+%)ia2*r+ARDNs|ksAv5;DT!Fp zy`V5WO46OnL8pe*Pa8h`U>E6-eX?AsCBLdQJ@5&r4+%8}tU-P(*l0X-k7E2naK|03 zXCT`6CbaI9@g&F^5FJammGs$w+mvRW)U@=pljAqYtci#3SclmtY|}0J_SBefk#~_c zHE{g0c%O9xwkw&C?T(ggUEGi2JSrmnQVMniqIX2$eeop$-ZN49YQ=}n$T&pCygzKu zBCp0PeN&Hj_c@_!5&CXSJNUNAa$Y`yGkkHo;=_msdXQ(_jN}K`avv@X_8iRf?dVnY z9)LBYrd%PY}6xY-{5!}2ad() zdF!Da_niwpWfJm^YrC*O)_iGFn=Q;FgLZjJMRKE_w{B?}|5^pDndmQ-@k(7yk3eaZ zCvb(-Mmgva8a&_XDH)q+zbtVoh3I*!WtUxJVrFh;;p`J)|K8}or-4N@z*v}@H;JFf zYuhTofi$fRpje?%mB!TNB1K3?_zVAA$>2g+XZqRcE%L}ou!R1m&2=_U0&hEesSSOe+ll9{)9Z_H? zJHWwbjd+KN&zqZr?Ug6vlBt=f%0$Ym1MIxFtn8o=8%}$BX@#b)?(pq_dzV^`XO2dG zV!yim;73?PxUvTey~V;%%HRsNv$t*FCJK;_`JM_zrq(TN$m`;FV}*e;Qu6vzapFIm z)W1O6yh92i@lwj?OdQaEMq90$B(o16;LyIK6o?+s;qx0)*S?F>qt*ZuZ_5oE@Hz55^c*W1V%W!uCs(4+IR(Ujf;s zRB>$}w1)T@s<{giW+50*=ruP=EH0}Q@EEM)_xJbLtk2}&Jz{Qm;ll2L8gHG+$?2GL z=;@rNTob$Kk%D=vAg_R&X5~Gl>Uq>6ad^>6BYe*Bka)5mNQrJWP|$VaLrb|({C-Fn z5yKOwnrj>%3=L9t^Y9Q-+xS7&%O?`NDJhO8?Bg*+O}XGuC~2q_`sD~+B}X)H0?SZ^ zT|^#=d>4&_4=+1aE+p3bvf%`QT?PqMQt;uDL)0F4Fc%UISB^={&&R%fVSvEbmP_on zN^dA;DYUBE-to8~hIL}XK9q_r7IyWc2X_R_AFzDVpdTNHc1Z?HvXiI8#(brW4Wn_YF{~zP3G~_?*R{k zlx8B)#>B7`+A`c+zsAI`2?Nz(X}(6;gt-of=YjiO$GoN0v)n6$M0D;VvV&4c$=a>e z zEl+Lu#}&V)n|a`+r?2RCatMnGw4AcoPw)^IXnBfIw+b8SZFH5Soya^?Aa48p)GL2~x@#z*XB1zv%LLhA5OOSlXoj1bnmS$Kmi0Zt{DasH5v#e0 zgc0(%yecH=x+dZnA^C7~wYixU)gwSX<7};jQtgU7cHl}Dm$MSh$x^p^ytR4v(5Idg zDCfvUVZjRZ-o}w~e5@gwCO-f+sXV_<)WVov63(X?C+zkP(Ij{|;&$0`Cc-T`;<|v_ zgWH_pKAw2I-8T57lzimf!Mii_U;W?r_iqssyK@j%@Vl!jJ&~nCfxVMew|8^D;zEvy zIGAl8!Gb-@y~OKCM>DHhQQMYE4GFa^SF?ge!{=93EWD-3Xt56-vc=miegZmPkMfe) zmDFPH?j35P{YID`v;Weljg%B5Y~y9L96v-0lJskfVKad`D8k>;Uzv27C+YDBZn1xL zDkF#q`WfM969{E8IKY`1eVnuLuB3W?enXa3UqFW+tHNZ!U?w3{drP!p>DtGt0Fgq#feTr3 ziz|cpE;^OlRH9g@g&UvRBP&7msXyScvOKAN#WAyXjAbL!d5-Rc8DC~h@D()AKHS?) z$b82UWieK5(gi5JwCyisQM;ue9xezSkbYGj)j&o&numx8wd_o4YHm+PoCMPFZ@Ih! zhgf`G8io+yORmeBapK-dH{h;9iTVvN;q6Ekb(E#K<+j>$+~UOI$d|{_jad}JN9$qm z7ca<+W5P`7B@GEx@)UUY=vd8;b+kf13W2y zJ^Wey4-5x1+{CI;_L&12uf{h)H>+JUbq(O%vX5lF`>Nj9N4?f1>7V2O%73qZ0KT{C zWOvxQ<=qfD0Klp;Ms!g41v*6sKCge|MkZ5$QZDm6AsehYTOw?o8veslI6*0*J{v0qX^V7RGXD)uSqlBR?puk4>uxU#$Tp z%n~2B>!v82eS4z|BPfl4$TJeNT$c*WP%tf;Ud_7Jk<@}bCsbrupbB1a?tD?3kbx>#Y*Tn z-4yEEjBHU3>d#I9E~21r)m+BD30P2qZJN!j)di zvlfZp0UeAzzi@H^+u783oDqDP0KUv|H{NY!Y2JOZ?JOhom1aW@vZ#Urt@B1#D_jO_ue6i2;nn6kFCAWdEQz z8Nf?|Mi*E}K{{MA)DEqm_W~fhQL=kEH*g5l@-u0*uME2-YC?2YZX&)=@SR;USTNa+V<`g-2Sx}I1tfD#M@ z)PSD>^@rs68Bpoc_-8;}m(BeQsNY=WfAeoY1L}W6=36BG8Bo_@Za)L+kMqwzl8>Ji zD&5!y%<=zNq5A(Yz4(p*{aX~Qs#adueBe2dN#7g%Ba74qB~0M!w@T~K{hAA(kO9q{ zOYQNDjrt@F3R%Y_e?9tM{hRNC+3f&{xxSmOK0~9V!1fVu3Ewh~by)ryxcR|u06B*_ zX~sqcg2H$1R<`wz>gqKs`fDM#j({qX?+y Date: Thu, 9 May 2024 19:12:42 +0200 Subject: [PATCH 02/35] chore: improve commit messages (#7921) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * chore: improve commit messages * indent * cleanup * additional changes --------- Co-authored-by: Tim Möhlmann --- .github/pull_request_template.md | 40 +++++++++++++++++--------- .github/workflows/ready_for_review.yml | 31 ++++++++++++++++++++ 2 files changed, 57 insertions(+), 14 deletions(-) create mode 100644 .github/workflows/ready_for_review.yml diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 899ab5a036..25969473d2 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,15 +1,27 @@ -### Definition of Ready +# Which Problems Are Solved -- [ ] I am happy with the code -- [ ] Short description of the feature/issue is added in the pr description -- [ ] PR is linked to the corresponding user story -- [ ] Acceptance criteria are met -- [ ] All open todos and follow ups are defined in a new ticket and justified -- [ ] Deviations from the acceptance criteria and design are agreed with the PO and documented. -- [ ] No debug or dead code -- [ ] My code has no repetitions -- [ ] Critical parts are tested automatically -- [ ] Where possible E2E tests are implemented -- [ ] Documentation/examples are up-to-date -- [ ] All non-functional requirements are met -- [ ] Functionality of the acceptance criteria is checked manually on the dev system. +Replace this example text with a concise list of problems that this PR solves. +For example: +- If the property XY is not given, the system crashes with a nil pointer exception. + +# How the Problems Are Solved + +Replace this example text with a concise list of changes that this PR introduces. +For example: +- Validates if property XY is given and throws an error if not + +# Additional Changes + +Replace this example text with a concise list of additional changes that this PR introduces, that are not directly solving the initial problem but are related. +For example: +- The docs explicitly describe that the property XY is mandatory +- Adds missing translations for validations. + +# Additional Context + +Replace this example with links to related issues, discussions, discord threads, or other sources with more context. +Use the Closing #issue syntax for issues that are resolved with this PR. +- Closes #123 +- Discussion #456 +- Follow-up for PR #789 +- https://discord.com/channels/123/456 \ No newline at end of file diff --git a/.github/workflows/ready_for_review.yml b/.github/workflows/ready_for_review.yml new file mode 100644 index 0000000000..f46ee4a407 --- /dev/null +++ b/.github/workflows/ready_for_review.yml @@ -0,0 +1,31 @@ +on: + pull_request: + types: [opened] + +jobs: + comment: + runs-on: ubuntu-latest + steps: + - uses: actions/github-script@v7 + with: + script: | + const content = `### Thanks for your contribution! 🎉 + + Please make sure you tick the following checkboxes before marking this Pull Request (PR) as ready for review: + + - [ ] I am happy with the code + - [ ] Documentations and examples are up-to-date + - [ ] Logical behavior changes are tested automatically + - [ ] No debug or dead code + - [ ] My code has no repetitions + - [ ] The PR title adheres to the [conventional commit format](https://www.conventionalcommits.org/en/v1.0.0/) + - [ ] The example texts in the PR description are replaced. + - [ ] If there are any open TODOs or follow-ups, they are described in issues and link to this PR + - [ ] If there are deviations from a user stories acceptance criteria or design, they are agreed upon with the PO and documented. + `; + github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: content + }) \ No newline at end of file From 694232474127f80d2722f70a482b1d6b8229ee04 Mon Sep 17 00:00:00 2001 From: mffap Date: Mon, 13 May 2024 08:29:25 +0200 Subject: [PATCH 03/35] docs(concepts): Update resources and features, add account linking (#7934) * account linking * updates to concepts and features * Apply suggestions from code review * Apply suggestions from code review Co-authored-by: Fabi --------- Co-authored-by: Fabi --- .../docs/concepts/features/account-linking.md | 36 ++++++++++++ docs/docs/concepts/structure/applications.md | 26 +++++++-- docs/docs/concepts/structure/instance.mdx | 1 + docs/docs/concepts/structure/organizations.md | 1 + docs/docs/concepts/structure/projects.md | 5 +- docs/docs/concepts/structure/users.md | 55 ++++++++++++++----- .../manage/console/_application-types.mdx | 5 ++ .../guides/manage/console/applications.mdx | 9 +-- docs/sidebars.js | 32 +++++++---- 9 files changed, 134 insertions(+), 36 deletions(-) create mode 100644 docs/docs/concepts/features/account-linking.md create mode 100644 docs/docs/guides/manage/console/_application-types.mdx diff --git a/docs/docs/concepts/features/account-linking.md b/docs/docs/concepts/features/account-linking.md new file mode 100644 index 0000000000..43a5066763 --- /dev/null +++ b/docs/docs/concepts/features/account-linking.md @@ -0,0 +1,36 @@ +--- +title: Account linking +--- + +ZITADEL supports linking of user accounts from different external identity providers such as social logins or enterprise IdPs. +A user can authenticate from any of their accounts and still be recognized by your app and associated with the same user profile. + +In ZITADEL, users have one user account to simplify access management and provide a consistent audit trail. +A user account can have a link to multiple external identities. + +### Advantages + +- Users can login with multiple identity providers without managing separate profiles +- Already registered users can link existing profiles +- Provide backup authentication methods in case an IdP is unavailable +- Unified audit trail across multiple identities + +### How it works + +ZITADEL gives you great flexibility to configure account linking for an organization and based on the external identity provider. + +When using external identity providers (ie. social login, enterprise SSO), a user account will be created in ZITADEL. +The [external identity](../structure/users#federated-users) will be linked to the ZITADEL account. + +If login with "Username / Password" (ie. local account) is enabled and you have configured external IDPs, the user can decide if they want to login with an external IDP or the local account. + +When only one external identity provider is configured and login with "Username / Password" is disabled, then the user is immediately redirected to the external identity provider. + +In cases when a local account already exists and a user logs in with an external identity provider, you can instruct ZITADEL to link the external identity to the local account based on the username or email address. + +### Automatic account linking + +You can link accounts with the same email or username and prompt users to link them. +On an [identity provider template settings](/docs/guides/integrate/identity-providers/introduction#key-settings-on-the-templates), you must enable "Account linking allowed". + +Automatic account linking is beneficial for users who wish to associate multiple login methods with their ZITADEL account, providing flexibility and convenience in how they access your application. diff --git a/docs/docs/concepts/structure/applications.md b/docs/docs/concepts/structure/applications.md index 1a3343b620..183e4bc032 100644 --- a/docs/docs/concepts/structure/applications.md +++ b/docs/docs/concepts/structure/applications.md @@ -1,10 +1,28 @@ --- -title: ZITADEL Applications +title: Configure applications for your frontend and backend services and clients sidebar_label: Applications +sidebar_position: 5 --- +import AppType from "../../guides/manage/console/_application-types.mdx"; -# Applications +Applications are the entry point to your project. +[Users](users.md) either login into one of your clients and interact with them directly or use one of your APIs. +All applications share the roles and authorizations of their [project](projects.md). -Applications are the entry point to your project. Users either login into one of your clients and interact with them directly or use one of your APIs. All applications share the roles and authorizations of their project. +## Supported application types -To read more about available authentication types and how to setup applications, read this guide [here](../../guides/manage/console/applications) +ZITADEL supports the following client types: + + + +## Security considerations + +Ensure the configuration of application settings is limited to authorized users only. + +- Use [Manager roles](managers.mdx) to limit permissions for your users to make changes to your applications +- When [granting projects](granted_projects.md) to other organizations, the receiving organization can't see or change application configuration + +## References + +- [Configure Applications in the Console](../../guides/manage/console/applications) +- [ZITADEL API: Applications](/docs/category/apis/resources/mgmt/applications) diff --git a/docs/docs/concepts/structure/instance.mdx b/docs/docs/concepts/structure/instance.mdx index d6d166f466..419fa0b938 100644 --- a/docs/docs/concepts/structure/instance.mdx +++ b/docs/docs/concepts/structure/instance.mdx @@ -1,6 +1,7 @@ --- title: ZITADEL Instances sidebar_label: Instances +sidebar_position: 1 --- ## Instance Structure diff --git a/docs/docs/concepts/structure/organizations.md b/docs/docs/concepts/structure/organizations.md index c3366bab12..f84a68dd54 100644 --- a/docs/docs/concepts/structure/organizations.md +++ b/docs/docs/concepts/structure/organizations.md @@ -1,6 +1,7 @@ --- title: ZITADEL Organizations sidebar_label: Organizations +sidebar_position: 2 --- import OrgDescription from './_org_description.mdx'; diff --git a/docs/docs/concepts/structure/projects.md b/docs/docs/concepts/structure/projects.md index 179c5c62e6..f7035a1e23 100644 --- a/docs/docs/concepts/structure/projects.md +++ b/docs/docs/concepts/structure/projects.md @@ -1,10 +1,9 @@ --- -title: ZITADEL Projects +title: Organize applications, services, and roles with projects sidebar_label: Projects +sidebar_position: 4 --- -# Project - import ProjectDescription from './\_project_description.mdx'; diff --git a/docs/docs/concepts/structure/users.md b/docs/docs/concepts/structure/users.md index 5ece5af7bd..b6440f33ad 100644 --- a/docs/docs/concepts/structure/users.md +++ b/docs/docs/concepts/structure/users.md @@ -1,6 +1,7 @@ --- title: ZITADEL Users sidebar_label: Users +sidebar_position: 3 --- ## Types of users @@ -15,18 +16,36 @@ Human users typically logon with an interactive login. This means that an application redirects a user to a website ("login page") where the user can provide the credentials. ZITADEL handles the authentication and provides the application with a token that verifies the authentication process. +Read more on how to [login users with ZITADEL](/docs/guides/integrate/login/login-users). + ### Service users Service users are for machine-to-machine communication and you would use those typically to access secure backend services. For example in ZITADEL you would require an authenticated Service User to access the Management API. The main difference between human and machine users is the type of credentials that can be used for authentication: Human users typically logon via an login prompt, but Machine users require a non-interactive logon process. +Learn how to [use service users](/docs/guides/integrate/service-users/authenticate-service-users) with ZITADEL. + ### Managers Any user, human or service user, can be given a [Manager](/concepts/structure/managers) role. Given a manager role, a user is not only an end-user of ZITADEL but can also manage certain aspects of ZITADEL itself. -## Constraints +### Federated users + +Federated users are identities that are managed by a third-party identity provider. +Users can login via an external identity provider, using [identity brokering](../features/identity-brokering) ("Single-sign-on"). +Federated user [accounts are linked](../features/account-linking) to internal users to be able to assign roles and keep an audit trail. + +### External users + +In a multi-tenancy architecture, you might use [organizations](organizations) to separate user groups. +By using [external user grants](../features/external-user-grant) an organization is able to invite users from another organization. +These invited users are called external users. + +## Considerations + +### Uniqueness of users Users can only exist within one [organization](/concepts/structure/organizations). It is currently not possible to move users between organizations. @@ -34,20 +53,30 @@ It is currently not possible to move users between organizations. User accounts are uniquely identified by their `id` or `loginname` in combination of the `organization domain` (eg, `road.runner@acme.zitadel.local`). You can use the same email address for different user accounts. -## Where to store users +### How to structure user pools -Depending on your [scenario](/guides/solution-scenarios/introduction), you might want to store all users in one organization (CIAM / B2C) or create a new organization for each logical group of users, e.g. each business customer (B2B). -With a project grant, you can delegate the access management of an organization's project to another organization. -You can also create a user grant to allow single users to access projects from another organization. -This is also an alternative to cases where you might want to move users between organizations. +Consider this general recommendation as a starting point: -## Identity linking +- Create one organization ("default organization") for your own company +- Configure projects and applications in the default organization +- Structure users in organizations based on common domains that are self-managed (eg, company) +- Grant your projects to the organizations, allow Managers to give granted roles to their users -When using external identity providers (ie. social login, enterprise SSO), a user account will be created in ZITADEL. -The external identity will be linked to the ZITADEL account. +You might want to adjust this general setup based on your [scenario](/guides/solution-scenarios/introduction). -You can link multiple external accounts to a ZITADEl account. -If login with "Username / Password" (ie. local account) is enabled and you have configured external IDPs, the user can decide if she wants to login with an external IDP or the local account. -When only one external identity provider is configured and login with "Username / Password" is disabled, then the user is immediately redirected to the external identity provider. +One important consideration in the setup is that you can only have a domain once for an organization. If you have multiple teams working with the same email address, you might need to add them to one single organization that has the domain verified for the teams' domain. -More about how to manage your users read our [users guide](../../guides/manage/console/users). \ No newline at end of file +For a CIAM / B2C setup, you might want to store all users in one organization and allow that organization to use a specific set of social logins. +In a multitenancy / B2B scenario, you might have thousands of smaller teams. + +#### Hierarchy + +There is no concept of hierarchies and inheritance based on users or organizations. +This is why we recommend to structure users along the smallest unit of groups. +You can use organization metadata or your own business logic to describe a hierarchy of organizations or user groups. + +## References + +- [Manage users in the Console](../../guides/manage/console/users) +- [ZITADEL APIs: Users](/docs/category/apis/resources/mgmt/users) +- [User onboarding and registration](/docs/guides/integrate/onboarding) diff --git a/docs/docs/guides/manage/console/_application-types.mdx b/docs/docs/guides/manage/console/_application-types.mdx new file mode 100644 index 0000000000..53bbff2753 --- /dev/null +++ b/docs/docs/guides/manage/console/_application-types.mdx @@ -0,0 +1,5 @@ +- [**Web**](#web) (Server-side web applications such as java, .net, ...) +- [**Native**](#native) (native, mobile or desktop applications) +- [**User Agent**](#user-agent) (single page applications / SPA, generally JavaScript executed in the browser) +- [**API**](#api) (OAuth Resource Server) +- [**SAML**](#saml) \ No newline at end of file diff --git a/docs/docs/guides/manage/console/applications.mdx b/docs/docs/guides/manage/console/applications.mdx index ace8d32e20..3d143c3299 100644 --- a/docs/docs/guides/manage/console/applications.mdx +++ b/docs/docs/guides/manage/console/applications.mdx @@ -7,6 +7,7 @@ import ThemedImage from "@theme/ThemedImage"; import AuthType from "../../integrate/application/_auth-type.mdx"; import ReviewConfig from "../../integrate/application/_review-config.mdx"; +import AppType from "./_application-types.mdx"; ## What is an application? @@ -36,13 +37,9 @@ To add an application to your project, click on the add button and select your a ## Application Types -At the moment ZITADEL offers four client types: +At the moment ZITADEL offers five client types: -- [**Web**](#web) (Server-side web applications such as java, .net, ...) -- [**Native**](#native) (native, mobile or desktop applications) -- [**User Agent**](#user-agent) (single page applications / SPA, generally JavaScript executed in the browser) -- [**API**](#api) (OAuth Resource Server) -- [**SAML**](#saml) + The first three options (Web, Native and User Agent) require user interaction, the fourth option (API) has no direct user-interaction. Depending on the app type, there are small differences in the possible settings. diff --git a/docs/sidebars.js b/docs/sidebars.js index 48eda263da..d0a0ab9cf0 100644 --- a/docs/sidebars.js +++ b/docs/sidebars.js @@ -474,17 +474,29 @@ module.exports = { "This part of our documentation contains ZITADEL specific or general concepts required to understand the system or our guides.", }, items: [ - "concepts/structure/instance", - "concepts/structure/organizations", - "concepts/structure/projects", - "concepts/structure/applications", - "concepts/structure/granted_projects", - "concepts/structure/users", - "concepts/structure/managers", - "concepts/structure/policies", { - type: "autogenerated", - dirName: "concepts/features", + type: "category", + label: "Resources", + collapsed: false, + items: [ + { + type: "autogenerated", + dirName: "concepts/structure", + } + ] + + }, + { + type: "category", + label: "Features", + collapsed: false, + items: [ + { + type: "autogenerated", + dirName: "concepts/features", + } + ] + }, { type: "autogenerated", From 15d5338b9135f8bd277b1189e7849a9c8842cbf7 Mon Sep 17 00:00:00 2001 From: Miguel Cabrerizo <30386061+doncicuto@users.noreply.github.com> Date: Mon, 13 May 2024 16:01:50 +0200 Subject: [PATCH 04/35] feat(cnsl): docs link can be customized and custom button is available (#7840) * feat: customize doc link and additional custom link * feat: add e2e tests * fix: update docs * fix: add @peintnermax changes about cache * fix: golangci-lint complains preparation.PrepareCommands --------- Co-authored-by: Max Peintner --- cmd/defaults.yaml | 15 +- .../app/modules/footer/footer.component.html | 6 +- .../app/modules/footer/footer.component.ts | 11 +- .../app/modules/header/header.component.html | 6 +- .../app/modules/header/header.component.scss | 3 +- .../app/modules/header/header.component.ts | 27 ++- .../privacy-policy.component.html | 20 +- .../privacy-policy.component.ts | 31 +++ .../app/modules/settings-grid/settinglinks.ts | 2 +- .../src/app/modules/settings-list/settings.ts | 2 +- console/src/app/services/grpc-auth.service.ts | 50 ++++- console/src/assets/i18n/bg.json | 5 +- console/src/assets/i18n/cs.json | 5 +- console/src/assets/i18n/de.json | 5 +- console/src/assets/i18n/en.json | 7 +- console/src/assets/i18n/es.json | 5 +- console/src/assets/i18n/fr.json | 5 +- console/src/assets/i18n/it.json | 5 +- console/src/assets/i18n/ja.json | 6 +- console/src/assets/i18n/mk.json | 5 +- console/src/assets/i18n/nl.json | 5 +- console/src/assets/i18n/pl.json | 5 +- console/src/assets/i18n/pt.json | 5 +- console/src/assets/i18n/ru.json | 5 +- console/src/assets/i18n/zh.json | 5 +- .../manage/console/default-settings.mdx | 18 +- .../guides/manage/console/organizations.mdx | 2 +- .../img/guides/console/external_links_1.png | Bin 0 -> 52578 bytes .../img/guides/console/external_links_2.png | Bin 0 -> 6527 bytes .../img/guides/console/privacypolicy.png | Bin 28895 -> 0 bytes .../settings/external-links-settings.cy.ts | 104 ++++++++++ .../support/api/external-links-settings.ts | 32 +++ internal/api/grpc/admin/export.go | 11 +- .../grpc/admin/privacy_policy_converter.go | 11 +- .../management/policy_privacy_converter.go | 22 +- internal/api/grpc/policy/privacy_policy.go | 3 + .../grpc/settings/v2/settings_converter.go | 3 + .../settings/v2/settings_converter_test.go | 16 +- .../eventsourcing/eventstore/auth_request.go | 15 +- internal/command/instance.go | 13 +- internal/command/instance_converter.go | 13 +- internal/command/instance_policy_privacy.go | 33 ++- .../command/instance_policy_privacy_model.go | 10 + .../command/instance_policy_privacy_test.go | 132 ++++++++---- internal/command/org_converter.go | 13 +- internal/command/org_policy_privacy.go | 7 +- internal/command/org_policy_privacy_model.go | 10 + internal/command/org_policy_privacy_test.go | 196 ++++++++++++------ internal/command/policy_privacy_model.go | 25 ++- internal/domain/policy_privacy.go | 11 +- internal/query/privacy_policy.go | 42 +++- internal/query/privacy_policy_test.go | 58 ++++-- internal/query/projection/privacy_policy.go | 46 ++-- .../query/projection/privacy_policy_test.go | 38 +++- .../repository/instance/policy_privacy.go | 6 +- internal/repository/org/policy_privacy.go | 6 +- internal/repository/policy/policy_privacy.go | 54 +++-- proto/zitadel/admin.proto | 17 ++ proto/zitadel/management.proto | 36 ++++ proto/zitadel/policy.proto | 19 ++ .../settings/v2beta/legal_settings.proto | 18 ++ 61 files changed, 1000 insertions(+), 286 deletions(-) create mode 100644 docs/static/img/guides/console/external_links_1.png create mode 100644 docs/static/img/guides/console/external_links_2.png delete mode 100644 docs/static/img/guides/console/privacypolicy.png create mode 100644 e2e/cypress/e2e/settings/external-links-settings.cy.ts create mode 100644 e2e/cypress/support/api/external-links-settings.ts diff --git a/cmd/defaults.yaml b/cmd/defaults.yaml index b8d7952be3..ae6b815037 100644 --- a/cmd/defaults.yaml +++ b/cmd/defaults.yaml @@ -14,16 +14,16 @@ Tracing: # for type 'otel' is used for standard [open telemetry](https://opentelemetry.io) # Fraction: 1.0 # Endpoint: 'otel.collector.endpoint' - # + # # type 'log' or '' disables tracing - # + # # for type 'google' # ProjectID: '' # Fraction: 1.0 Type: none # ZITADEL_TRACING_TYPE Fraction: 1.0 # ZITADEL_TRACING_FRACTION # The endpoint of the otel collector endpoint - Endpoint: '' #ZITADEL_TRACING_ENDPOINT + Endpoint: "" #ZITADEL_TRACING_ENDPOINT Telemetry: # As long as Enabled is true, ZITADEL tries to send usage data to the configured Telemetry.Endpoints. @@ -200,7 +200,7 @@ AssetStorage: # The Projections section defines the behavior for the scheduled and synchronous events projections. Projections: - # The maximum duration a transaction remains open + # The maximum duration a transaction remains open # before it spots left folding additional events # and updates the table. TransactionDuration: 500ms # ZITADEL_PROJECTIONS_TRANSACTIONDURATION @@ -264,7 +264,7 @@ Auth: # See Projections.BulkLimit SearchLimit: 1000 # ZITADEL_AUTH_SEARCHLIMIT Spooler: - # See Projections.TransationDuration + # See Projections.TransationDuration TransactionDuration: 10s #ZITADEL_AUTH_SPOOLER_TRANSACTIONDURATION # See Projections.BulkLimit BulkLimit: 100 #ZITADEL_AUTH_SPOOLER_BULKLIMIT @@ -704,6 +704,9 @@ DefaultInstance: PrivacyLink: https://zitadel.com/docs/legal/privacy-policy # ZITADEL_DEFAULTINSTANCE_PRIVACYPOLICY_PRIVACYLINK HelpLink: "" # ZITADEL_DEFAULTINSTANCE_PRIVACYPOLICY_HELPLINK SupportEmail: "" # ZITADEL_DEFAULTINSTANCE_PRIVACYPOLICY_SUPPORTEMAIL + DocsLink: https://zitadel.com/docs # ZITADEL_DEFAULTINSTANCE_PRIVACYPOLICY_DOCSLINK + CustomLink: "" # ZITADEL_DEFAULTINSTANCE_PRIVACYPOLICY_CUSTOMLINK + CustomLinkText: "" # ZITADEL_DEFAULTINSTANCE_PRIVACYPOLICY_CUSTOMLINKTEXT NotificationPolicy: PasswordChange: true # ZITADEL_DEFAULTINSTANCE_NOTIFICATIONPOLICY_PASSWORDCHANGE LabelPolicy: @@ -1432,4 +1435,4 @@ InitProjections: Enabled: true # ZITADEL_INITPROJECTIONS_ENABLED RetryFailedAfter: 100ms # ZITADEL_INITPROJECTIONS_RETRYFAILEDAFTER MaxFailureCount: 2 # ZITADEL_INITPROJECTIONS_MAXFAILURECOUNT - BulkLimit: 1000 # ZITADEL_INITPROJECTIONS_BULKLIMIT \ No newline at end of file + BulkLimit: 1000 # ZITADEL_INITPROJECTIONS_BULKLIMIT diff --git a/console/src/app/modules/footer/footer.component.html b/console/src/app/modules/footer/footer.component.html index fdf2924441..26d863d129 100644 --- a/console/src/app/modules/footer/footer.component.html +++ b/console/src/app/modules/footer/footer.component.html @@ -1,11 +1,11 @@
-
- +
+ {{ 'FOOTER.LINKS.TOS' | translate }} - + {{ 'FOOTER.LINKS.PP' | translate }} diff --git a/console/src/app/modules/footer/footer.component.ts b/console/src/app/modules/footer/footer.component.ts index f7d1a3a148..758917ea4b 100644 --- a/console/src/app/modules/footer/footer.component.ts +++ b/console/src/app/modules/footer/footer.component.ts @@ -8,16 +8,7 @@ import { faXTwitter } from '@fortawesome/free-brands-svg-icons'; templateUrl: './footer.component.html', styleUrls: ['./footer.component.scss'], }) -export class FooterComponent implements OnInit { - public policy?: PrivacyPolicy.AsObject; +export class FooterComponent { public faXTwitter = faXTwitter; constructor(public authService: GrpcAuthService) {} - - ngOnInit(): void { - this.authService.getMyPrivacyPolicy().then((policyResp) => { - if (policyResp.policy) { - this.policy = policyResp.policy; - } - }); - } } diff --git a/console/src/app/modules/header/header.component.html b/console/src/app/modules/header/header.component.html index c436cc4a28..a8c438ae4d 100644 --- a/console/src/app/modules/header/header.component.html +++ b/console/src/app/modules/header/header.component.html @@ -168,7 +168,11 @@ - + + {{ customLinkText }} + + + {{ 'MENU.DOCUMENTATION' | translate }} diff --git a/console/src/app/modules/header/header.component.scss b/console/src/app/modules/header/header.component.scss index 2b219cc0fa..04a9e53d2e 100644 --- a/console/src/app/modules/header/header.component.scss +++ b/console/src/app/modules/header/header.component.scss @@ -224,7 +224,8 @@ flex: 1; } - .doc-link { + .doc-link, + .custom-link { margin-right: 1rem; @media only screen and (max-width: 800px) { diff --git a/console/src/app/modules/header/header.component.ts b/console/src/app/modules/header/header.component.ts index 25463e0c52..720d40cb98 100644 --- a/console/src/app/modules/header/header.component.ts +++ b/console/src/app/modules/header/header.component.ts @@ -1,5 +1,5 @@ import { ConnectedPosition, ConnectionPositionPair } from '@angular/cdk/overlay'; -import { Component, ElementRef, EventEmitter, Input, OnDestroy, Output, ViewChild } from '@angular/core'; +import { Component, ElementRef, EventEmitter, Input, OnDestroy, OnInit, Output, ViewChild } from '@angular/core'; import { Router } from '@angular/router'; import { BehaviorSubject, Observable, of, Subject } from 'rxjs'; import { Org } from 'src/app/proto/generated/zitadel/org_pb'; @@ -8,8 +8,8 @@ import { AuthenticationService } from 'src/app/services/authentication.service'; import { BreadcrumbService, BreadcrumbType } from 'src/app/services/breadcrumb.service'; import { GrpcAuthService } from 'src/app/services/grpc-auth.service'; import { ManagementService } from 'src/app/services/mgmt.service'; - import { ActionKeysType } from '../action-keys/action-keys.component'; +import { GetPrivacyPolicyResponse } from 'src/app/proto/generated/zitadel/management_pb'; @Component({ selector: 'cnsl-header', @@ -31,6 +31,9 @@ export class HeaderComponent implements OnDestroy { private destroy$: Subject = new Subject(); public BreadcrumbType: any = BreadcrumbType; public ActionKeysType: any = ActionKeysType; + public docsLink = 'https://zitadel.com/docs'; + public customLink = ''; + public customLinkText = ''; public positions: ConnectedPosition[] = [ new ConnectionPositionPair({ originX: 'start', originY: 'bottom' }, { overlayX: 'start', overlayY: 'top' }, 0, 10), @@ -47,7 +50,25 @@ export class HeaderComponent implements OnDestroy { public mgmtService: ManagementService, public breadcrumbService: BreadcrumbService, public router: Router, - ) {} + ) { + this.loadData(); + } + + public async loadData(): Promise { + const getData = (): Promise => { + return this.mgmtService.getPrivacyPolicy(); + }; + + getData() + .then((resp) => { + if (resp.policy) { + this.docsLink = resp.policy.docsLink; + this.customLink = resp.policy.customLink; + this.customLinkText = resp.policy.customLinkText; + } + }) + .catch(() => {}); + } public ngOnDestroy() { this.destroy$.next(); diff --git a/console/src/app/modules/policies/privacy-policy/privacy-policy.component.html b/console/src/app/modules/policies/privacy-policy/privacy-policy.component.html index 41bfde9127..037d53389c 100644 --- a/console/src/app/modules/policies/privacy-policy/privacy-policy.component.html +++ b/console/src/app/modules/policies/privacy-policy/privacy-policy.component.html @@ -9,6 +9,7 @@ color="warn" (click)="resetDefault()" mat-stroked-button + data-e2e="reset-button" > {{ 'POLICY.RESET' | translate }} @@ -40,7 +41,23 @@ {{ 'POLICY.PRIVACY_POLICY.SUPPORTEMAIL' | translate }} - + + + + {{ 'POLICY.PRIVACY_POLICY.CUSTOMLINK' | translate }} + + + + + + {{ 'POLICY.PRIVACY_POLICY.CUSTOMLINKTEXT' | translate }} + + + + + {{ 'POLICY.PRIVACY_POLICY.DOCSLINK' | translate }} + +
@@ -53,6 +70,7 @@ color="primary" type="submit" mat-raised-button + data-e2e="save-button" > {{ 'ACTIONS.SAVE' | translate }} diff --git a/console/src/app/modules/policies/privacy-policy/privacy-policy.component.ts b/console/src/app/modules/policies/privacy-policy/privacy-policy.component.ts index 458c0b2728..53f7ab748f 100644 --- a/console/src/app/modules/policies/privacy-policy/privacy-policy.component.ts +++ b/console/src/app/modules/policies/privacy-policy/privacy-policy.component.ts @@ -61,6 +61,9 @@ export class PrivacyPolicyComponent implements OnInit, OnDestroy { privacyLink: ['', []], helpLink: ['', []], supportEmail: ['', []], + docsLink: ['', []], + customLink: ['', []], + customLinkText: ['', []], }); this.canWrite$.pipe(take(1)).subscribe((canWrite) => { @@ -107,6 +110,9 @@ export class PrivacyPolicyComponent implements OnInit, OnDestroy { privacyLink: '', helpLink: '', supportEmail: '', + docsLink: '', + customLink: '', + customLinkText: '', }); } }) @@ -117,6 +123,9 @@ export class PrivacyPolicyComponent implements OnInit, OnDestroy { privacyLink: '', helpLink: '', supportEmail: '', + docsLink: '', + customLink: '', + customLinkText: '', }); }); } @@ -129,11 +138,16 @@ export class PrivacyPolicyComponent implements OnInit, OnDestroy { req.setTosLink(this.form.get('tosLink')?.value); req.setHelpLink(this.form.get('helpLink')?.value); req.setSupportEmail(this.form.get('supportEmail')?.value); + req.setDocsLink(this.form.get('docsLink')?.value); + req.setCustomLink(this.form.get('customLink')?.value); + req.setCustomLinkText(this.form.get('customLinkText')?.value); (this.service as ManagementService) .addCustomPrivacyPolicy(req) .then(() => { this.toast.showInfo('POLICY.PRIVACY_POLICY.SAVED', true); this.loadData(); + // Reload console as links may have changed + this.reloadConsole(); }) .catch((error) => this.toast.showError(error)); } else { @@ -142,12 +156,17 @@ export class PrivacyPolicyComponent implements OnInit, OnDestroy { req.setTosLink(this.form.get('tosLink')?.value); req.setHelpLink(this.form.get('helpLink')?.value); req.setSupportEmail(this.form.get('supportEmail')?.value); + req.setDocsLink(this.form.get('docsLink')?.value); + req.setCustomLink(this.form.get('customLink')?.value); + req.setCustomLinkText(this.form.get('customLinkText')?.value); (this.service as ManagementService) .updateCustomPrivacyPolicy(req) .then(() => { this.toast.showInfo('POLICY.PRIVACY_POLICY.SAVED', true); this.loadData(); + // Reload console as links may have changed + this.reloadConsole(); }) .catch((error) => this.toast.showError(error)); } @@ -157,12 +176,17 @@ export class PrivacyPolicyComponent implements OnInit, OnDestroy { req.setTosLink(this.form.get('tosLink')?.value); req.setHelpLink(this.form.get('helpLink')?.value); req.setSupportEmail(this.form.get('supportEmail')?.value); + req.setDocsLink(this.form.get('docsLink')?.value); + req.setCustomLink(this.form.get('customLink')?.value); + req.setCustomLinkText(this.form.get('customLinkText')?.value); (this.service as AdminService) .updatePrivacyPolicy(req) .then(() => { this.toast.showInfo('POLICY.PRIVACY_POLICY.SAVED', true); this.loadData(); + // Reload console as links may have changed + this.reloadConsole(); }) .catch((error) => this.toast.showError(error)); } @@ -188,6 +212,7 @@ export class PrivacyPolicyComponent implements OnInit, OnDestroy { .then(() => { setTimeout(() => { this.loadData(); + window.location.reload(); }, 1000); }) .catch((error) => { @@ -209,4 +234,10 @@ export class PrivacyPolicyComponent implements OnInit, OnDestroy { return false; } } + + private reloadConsole(): void { + setTimeout(() => { + window.location.reload(); + }, 1000); + } } diff --git a/console/src/app/modules/settings-grid/settinglinks.ts b/console/src/app/modules/settings-grid/settinglinks.ts index 726677ea73..7f967f865d 100644 --- a/console/src/app/modules/settings-grid/settinglinks.ts +++ b/console/src/app/modules/settings-grid/settinglinks.ts @@ -36,7 +36,7 @@ export const APPEARANCE_GROUP: SettingLinks = { }; export const PRIVACY_POLICY: SettingLinks = { - i18nTitle: 'SETTINGS.LIST.PRIVACYPOLICY', + i18nTitle: 'DESCRIPTIONS.SETTINGS.PRIVACY_POLICY.TITLE', i18nDesc: 'POLICY.PRIVACY_POLICY.DESCRIPTION', iamRouterLink: ['/settings'], orgRouterLink: ['/org-settings'], diff --git a/console/src/app/modules/settings-list/settings.ts b/console/src/app/modules/settings-list/settings.ts index a945a8c7c7..2b24d84e24 100644 --- a/console/src/app/modules/settings-list/settings.ts +++ b/console/src/app/modules/settings-list/settings.ts @@ -187,7 +187,7 @@ export const LOGINTEXTS: SidenavSetting = { export const PRIVACYPOLICY: SidenavSetting = { id: 'privacypolicy', - i18nKey: 'SETTINGS.LIST.PRIVACYPOLICY', + i18nKey: 'DESCRIPTIONS.SETTINGS.PRIVACY_POLICY.TITLE', groupI18nKey: 'SETTINGS.GROUPS.OTHER', requiredRoles: { [PolicyComponentServiceType.MGMT]: ['policy.read'], diff --git a/console/src/app/services/grpc-auth.service.ts b/console/src/app/services/grpc-auth.service.ts index 987721180f..6fc1750d62 100644 --- a/console/src/app/services/grpc-auth.service.ts +++ b/console/src/app/services/grpc-auth.service.ts @@ -27,7 +27,6 @@ import { GetMyPhoneRequest, GetMyPhoneResponse, GetMyPrivacyPolicyRequest, - GetMyPrivacyPolicyResponse, GetMyProfileRequest, GetMyProfileResponse, GetMyUserRequest, @@ -99,11 +98,10 @@ import { ChangeQuery } from '../proto/generated/zitadel/change_pb'; import { MetadataQuery } from '../proto/generated/zitadel/metadata_pb'; import { ListQuery } from '../proto/generated/zitadel/object_pb'; import { Org, OrgFieldName, OrgQuery } from '../proto/generated/zitadel/org_pb'; -import { LabelPolicy } from '../proto/generated/zitadel/policy_pb'; +import { LabelPolicy, PrivacyPolicy } from '../proto/generated/zitadel/policy_pb'; import { Gender, MembershipQuery, User, WebAuthNVerification } from '../proto/generated/zitadel/user_pb'; import { GrpcService } from './grpc.service'; import { StorageKey, StorageLocation, StorageService } from './storage.service'; -import { ThemeService } from './theme.service'; @Injectable({ providedIn: 'root', @@ -137,11 +135,18 @@ export class GrpcAuthService { >(undefined); labelPolicyLoading$: BehaviorSubject = new BehaviorSubject(true); + public privacypolicy$!: Observable; + public privacypolicy: BehaviorSubject = new BehaviorSubject< + PrivacyPolicy.AsObject | undefined + >(undefined); + privacyPolicyLoading$: BehaviorSubject = new BehaviorSubject(true); + public zitadelPermissions: BehaviorSubject = new BehaviorSubject([]); public readonly fetchedZitadelPermissions: BehaviorSubject = new BehaviorSubject(false); public cachedOrgs: BehaviorSubject = new BehaviorSubject([]); private cachedLabelPolicies: { [orgId: string]: LabelPolicy.AsObject } = {}; + private cachedPrivacyPolicies: { [orgId: string]: PrivacyPolicy.AsObject } = {}; constructor( private readonly grpcService: GrpcService, @@ -169,6 +174,25 @@ export class GrpcAuthService { }, }); + this.privacypolicy$ = this.activeOrgChanged.pipe( + switchMap((org) => { + this.privacyPolicyLoading$.next(true); + return from(this.getMyPrivacyPolicy(org ? org.id : '')); + }), + filter((policy) => !!policy), + ); + + this.privacypolicy$.subscribe({ + next: (policy) => { + this.privacypolicy.next(policy); + this.privacyPolicyLoading$.next(false); + }, + error: (error) => { + console.error(error); + this.privacyPolicyLoading$.next(false); + }, + }); + this.user = forkJoin([ of(this.oauthService.getAccessToken()), this.oauthService.events.pipe( @@ -697,7 +721,23 @@ export class GrpcAuthService { } } - public getMyPrivacyPolicy(): Promise { - return this.grpcService.auth.getMyPrivacyPolicy(new GetMyPrivacyPolicyRequest(), null).then((resp) => resp.toObject()); + public getMyPrivacyPolicy(orgIdForCache?: string): Promise { + if (orgIdForCache && this.cachedPrivacyPolicies[orgIdForCache]) { + return Promise.resolve(this.cachedPrivacyPolicies[orgIdForCache]); + } else { + return this.grpcService.auth + .getMyPrivacyPolicy(new GetMyPrivacyPolicyRequest(), null) + .then((resp) => resp.toObject()) + .then((resp) => { + if (resp.policy) { + if (orgIdForCache) { + this.cachedPrivacyPolicies[orgIdForCache] = resp.policy; + } + return Promise.resolve(resp.policy); + } else { + return Promise.reject(); + } + }); + } } } diff --git a/console/src/assets/i18n/bg.json b/console/src/assets/i18n/bg.json index 2dd9ab1a5e..8cbc3ba790 100644 --- a/console/src/assets/i18n/bg.json +++ b/console/src/assets/i18n/bg.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Външни връзки", - "DESCRIPTION": "Насочете вашите потребители към персонализирани външни ресурси, показани на страницата за вход. Потребителите трябва да приемат Условията за ползване и Политиката за поверителност, преди да могат да се регистрират." + "DESCRIPTION": "Насочете потребителите си към персонализирани външни ресурси, показани на страницата за вход. Потребителите трябва да приемат Общите условия и Политиката за поверителност, преди да могат да се регистрират. Променете връзката към вашата документация или задайте празен низ, за ​​да скриете бутона за документация от конзолата. Добавете персонализирана външна връзка и персонализиран текст за тази връзка в конзолата или ги оставете празни, за да скриете този бутон." }, "SMTP_PROVIDER": { "TITLE": "Настройки на SMTP", @@ -1564,6 +1564,9 @@ "POLICYLINK": "Връзка към Политика за поверителност", "HELPLINK": "Връзка към Помощ", "SUPPORTEMAIL": "Имейл за поддръжка", + "DOCSLINK": "Връзка към документи (Console)", + "CUSTOMLINK": "Персонализирана връзка (Console)", + "CUSTOMLINKTEXT": "Персонализиран текст на връзката (Console)", "SAVED": "Запазено успешно!", "RESET_TITLE": "Възстановяване на стойностите по подразбиране", "RESET_DESCRIPTION": "На път сте да възстановите връзките по подразбиране за TOS и Политика за поверителност. " diff --git a/console/src/assets/i18n/cs.json b/console/src/assets/i18n/cs.json index dbbd7ee2e9..197d821b41 100644 --- a/console/src/assets/i18n/cs.json +++ b/console/src/assets/i18n/cs.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Externí odkazy", - "DESCRIPTION": "Navede vaše uživatele k vlastním externím zdrojům zobrazeným na přihlašovací stránce. Uživatelé musí přijmout Podmínky služby a Zásady ochrany osobních údajů, než se mohou zaregistrovat." + "DESCRIPTION": "Naveďte své uživatele k vlastním externím zdrojům zobrazeným na přihlašovací stránce. Než se uživatelé mohou zaregistrovat, musí přijmout podmínky služby a zásady ochrany osobních údajů. Změňte odkaz na dokumentaci nebo nastavte prázdný řetězec, abyste skryli tlačítko dokumentace z konzoly. Přidejte vlastní externí odkaz a vlastní text pro tento odkaz v konzole nebo je nastavte na prázdné, abyste toto tlačítko skryli." }, "SMTP_PROVIDER": { "TITLE": "Nastavení SMTP", @@ -1571,6 +1571,9 @@ "POLICYLINK": "Odkaz na Zásady ochrany osobních údajů", "HELPLINK": "Odkaz na pomoc", "SUPPORTEMAIL": "E-mailová podpora", + "DOCSLINK": "Odkaz na Dokumenty (Console)", + "CUSTOMLINK": "Vlastní odkaz (Console)", + "CUSTOMLINKTEXT": "Text vlastního odkazu (Console)", "SAVED": "Úspěšně uloženo!", "RESET_TITLE": "Obnovit výchozí hodnoty", "RESET_DESCRIPTION": "Chystáte se obnovit výchozí odkazy pro Podmínky služby a Zásady ochrany osobních údajů. Opravdu chcete pokračovat?" diff --git a/console/src/assets/i18n/de.json b/console/src/assets/i18n/de.json index 97002aad5e..ff8140f414 100644 --- a/console/src/assets/i18n/de.json +++ b/console/src/assets/i18n/de.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Externe Links", - "DESCRIPTION": "Leite deine Benutzer zu benutzerdefinierten externen Ressourcen, die auf der Anmeldeseite angezeigt werden. Benutzer müssen die Allgemeinen Geschäftsbedingungen und die Datenschutzrichtlinie akzeptieren, bevor sie sich anmelden können." + "DESCRIPTION": "Leiten Sie Ihre Benutzer zu benutzerdefinierten externen Ressourcen, die auf der Anmeldeseite angezeigt werden. Benutzer müssen die Nutzungsbedingungen und Datenschutzrichtlinien akzeptieren, bevor sie sich anmelden können. Ändern Sie den Link zu Ihrer Dokumentation oder legen Sie eine leere Zeichenfolge fest, um die Dokumentationsschaltfläche in der Konsole auszublenden. Fügen Sie in der Konsole einen benutzerdefinierten externen Link und einen benutzerdefinierten Text für diesen Link hinzu oder setzen Sie sie leer, um diese Schaltfläche auszublenden." }, "SMTP_PROVIDER": { "TITLE": "SMTP-Einstellungen", @@ -1570,6 +1570,9 @@ "POLICYLINK": "Link zur den Datenschutzrichtlinien", "HELPLINK": "Link zur Hilfestellung", "SUPPORTEMAIL": "Support E-Mail", + "DOCSLINK": "Link zu Dokumenten (Console)", + "CUSTOMLINK": "Benutzerdefinierter Link (Console)", + "CUSTOMLINKTEXT": "Benutzerdefinierter Linktext (Console)", "SAVED": "Saved successfully!", "RESET_TITLE": "Standardwerte wiederherstellen", "RESET_DESCRIPTION": "Sie sind im Begriff die Standardlinks für die AGBs und Datenschutzrichtlinie wiederherzustellen. Wollen Sie fortfahren?" diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json index 370effeb71..f779856b61 100644 --- a/console/src/assets/i18n/en.json +++ b/console/src/assets/i18n/en.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "External Links", - "DESCRIPTION": "Guide your users to custom external resources shown on the login page. Users need to accept the Terms of Service and Privacy Policy before they can sign up." + "DESCRIPTION": "Guide your users to custom external resources shown on the login page. Users need to accept the Terms of Service and Privacy Policy before they can sign up. Change the link to your documentation or set an empty string to hide the documentation button from the console. Add a custom external link and a custom text for that link in the console, or set them empty to hide that button." }, "SMTP_PROVIDER": { "TITLE": "SMTP Settings", @@ -1335,7 +1335,7 @@ "DOMAIN": "Domain settings", "LOGINTEXTS": "Login Interface Texts", "BRANDING": "Branding", - "PRIVACYPOLICY": "Privacy Policy", + "PRIVACYPOLICY": "External links", "OIDC": "OIDC Token lifetime and expiration", "SECRETS": "Secret Generator", "SECURITY": "Security settings", @@ -1571,6 +1571,9 @@ "POLICYLINK": "Link to Privacy Policy", "HELPLINK": "Link to Help", "SUPPORTEMAIL": "Support Email", + "DOCSLINK": "Docs Link (Console)", + "CUSTOMLINK": "Custom Link (Console)", + "CUSTOMLINKTEXT": "Custom Link Text (Console)", "SAVED": "Saved successfully!", "RESET_TITLE": "Restore Default Values", "RESET_DESCRIPTION": "You are about to restore the default Links for TOS and Privacy Policy. Do you really want to continue?" diff --git a/console/src/assets/i18n/es.json b/console/src/assets/i18n/es.json index b134c4a1fa..e85c698348 100644 --- a/console/src/assets/i18n/es.json +++ b/console/src/assets/i18n/es.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Enlaces Externos", - "DESCRIPTION": "Guía a tus usuarios hacia recursos externos personalizados mostrados en la página de inicio de sesión. Los usuarios necesitan aceptar los Términos de Servicio y la Política de Privacidad antes de que puedan registrarse." + "DESCRIPTION": "Guía a tus usuarios a recursos externos personalizados que se muestran en la página de inicio de sesión. Los usuarios deben aceptar los Términos de servicio y la Política de privacidad antes de poder registrarse. Cambia el enlace a tu documentación o introduce una cadena de texto vacía para ocultar el botón de documentación de la consola. Agrega un enlace externo personalizado y un texto personalizado para dicho enlace en la consola, o déjalos vacíos para ocultar ese botón." }, "SMTP_PROVIDER": { "TITLE": "Configuración de SMTP", @@ -1572,6 +1572,9 @@ "POLICYLINK": "Enlace a Política de privacidad", "HELPLINK": "Enlace de ayuda", "SUPPORTEMAIL": "Email de soporte", + "DOCSLINK": "Enlace de documentos (Console)", + "CUSTOMLINK": "Enlace personalizado (Console)", + "CUSTOMLINKTEXT": "Texto de enlace personalizado (Console)", "SAVED": "¡Se guardó con éxito!", "RESET_TITLE": "Restaurar valores por defecto", "RESET_DESCRIPTION": "Estás a punto de restaurar los enlaces por defecto para los TDS y la política de privacida. ¿Quieres continuar?" diff --git a/console/src/assets/i18n/fr.json b/console/src/assets/i18n/fr.json index cb96599cf9..95cda8bd48 100644 --- a/console/src/assets/i18n/fr.json +++ b/console/src/assets/i18n/fr.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Liens Externes", - "DESCRIPTION": "Guide tes utilisateurs vers des ressources externes personnalisées affichées sur la page de connexion. Les utilisateurs doivent accepter les Termes de Service et la Politique de Confidentialité avant de pouvoir s'inscrire." + "DESCRIPTION": "Guidez vos utilisateurs vers des ressources externes personnalisées affichées sur la page de connexion. Les utilisateurs doivent accepter les conditions d'utilisation et la politique de confidentialité avant de pouvoir s'inscrire. Modifiez le lien vers votre documentation ou définissez une chaîne vide pour masquer le bouton de documentation de la console. Ajoutez un lien externe personnalisé et un texte personnalisé pour ce lien dans la console, ou définissez-les vides pour masquer ce bouton." }, "SMTP_PROVIDER": { "TITLE": "Paramètres SMTP", @@ -1570,6 +1570,9 @@ "POLICYLINK": "Lien vers la politique de confidentialité", "HELPLINK": "Lien vers l'aide", "SUPPORTEMAIL": "E-mail d'assistance", + "DOCSLINK": "Lien Docs (Console)", + "CUSTOMLINK": "Lien personnalisé (Console)", + "CUSTOMLINKTEXT": "Texte de lien personnalisé (Console)", "SAVED": "Enregistré avec succès !", "RESET_TITLE": "Restaurer les valeurs par défaut", "RESET_DESCRIPTION": "Vous êtes sur le point de restaurer les liens par défaut pour les CGS et la politique de confidentialité. Voulez-vous vraiment continuer ?" diff --git a/console/src/assets/i18n/it.json b/console/src/assets/i18n/it.json index ae2f2fd43d..2fe90b412c 100644 --- a/console/src/assets/i18n/it.json +++ b/console/src/assets/i18n/it.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Link Esterni", - "DESCRIPTION": "Guida i tuoi utenti verso risorse esterne personalizzate mostrate nella pagina di login. Gli utenti devono accettare i Termini di Servizio e la Politica sulla Privacy prima che possano iscriversi." + "DESCRIPTION": "Guida i tuoi utenti alle risorse esterne personalizzate mostrate nella pagina di accesso. Gli utenti devono accettare i Termini di servizio e l'Informativa sulla privacy prima di potersi registrare. Cambia il collegamento alla tua documentazione o imposta una stringa vuota per nascondere il pulsante della documentazione dalla console. Aggiungi un collegamento esterno personalizzato e un testo personalizzato per quel collegamento nella console oppure impostali vuoti per nascondere quel pulsante." }, "SMTP_PROVIDER": { "TITLE": "Impostazioni SMTP", @@ -1570,6 +1570,9 @@ "POLICYLINK": "Link all'informativa sulla privacy", "HELPLINK": "link per l'aiuto", "SUPPORTEMAIL": "e-mail di supporto", + "DOCSLINK": "Collegamento a Documenti (Console)", + "CUSTOMLINK": "Collegamento personalizzato (Console)", + "CUSTOMLINKTEXT": "Testo del collegamento personalizzato (Console)", "SAVED": "Salvato con successo!", "RESET_TITLE": "Ripristina i valori predefiniti", "RESET_DESCRIPTION": "Stai per ripristinare i link predefiniti per i TOS e l'informativa sulla privacy. Vuoi davvero continuare?" diff --git a/console/src/assets/i18n/ja.json b/console/src/assets/i18n/ja.json index 65eb2615d7..d6ea29dca4 100644 --- a/console/src/assets/i18n/ja.json +++ b/console/src/assets/i18n/ja.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "外部リンク", - "DESCRIPTION": "ログインページに表示されるカスタム外部リソースへのユーザーガイドです。ユーザーは、サインアップする前に利用規約とプライバシーポリシーを受け入れる必要があります。" + "DESCRIPTION": "ログイン ページに表示されるカスタム外部リソースにユーザーを誘導します。ユーザーはサインアップする前に、サービス利用規約とプライバシー ポリシーに同意する必要があります。ドキュメントへのリンクを変更するか、空の文字列を設定してコンソールからドキュメント ボタンを非表示にします。カスタム外部リンクとそのリンクのカスタム テキストをコンソールに追加するか、それらを空に設定してそのボタンを非表示にします。" }, "SMTP_PROVIDER": { "TITLE": "SMTP設定", @@ -1566,6 +1566,10 @@ "TOSLINK": "利用規約へのリンク", "POLICYLINK": "プライバシーポリシーへのリンク", "HELPLINK": "ヘルプへのリンク", + "SUPPORTEMAIL": "サポートメール", + "DOCSLINK": "ドキュメントリンク (Console)", + "CUSTOMLINK": "カスタムリンク(Console)", + "CUSTOMLINKTEXT": "カスタム リンク テキスト (Console)", "SAVED": "正常に保存されました！", "RESET_TITLE": "デフォルト値を復元する", "RESET_DESCRIPTION": "TOSおよびプライバシーポリシーのデフォルトリンクを復元しようとしています。本当によろしいですか？" diff --git a/console/src/assets/i18n/mk.json b/console/src/assets/i18n/mk.json index 6df94a7445..8e2d5376cd 100644 --- a/console/src/assets/i18n/mk.json +++ b/console/src/assets/i18n/mk.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Надворешни врски", - "DESCRIPTION": "Упатете ги вашите корисници кон прилагодени надворешни ресурси прикажани на страницата за најава. Корисниците треба да ги прифатат условите за користење и политиката за приватност пред да се регистрираат." + "DESCRIPTION": "Водете ги вашите корисници до сопствени надворешни ресурси прикажани на страницата за најавување. Корисниците треба да ги прифатат Условите за користење и Политиката за приватност пред да можат да се регистрираат. Променете ја врската до вашата документација или поставете празна низа за да го скриете копчето за документација од конзолата. Додајте приспособена надворешна врска и прилагоден текст за таа врска во конзолата или поставете ги празни за да го скриете тоа копче." }, "SMTP_PROVIDER": { "TITLE": "SMTP поставки", @@ -1572,6 +1572,9 @@ "POLICYLINK": "Линк кон Политиката за приватност", "HELPLINK": "Линк кон Помош", "SUPPORTEMAIL": "Е-пошта за поддршка", + "DOCSLINK": "Врска за документи (Console)", + "CUSTOMLINK": "Прилагодена врска (Console)", + "CUSTOMLINKTEXT": "Текст за приспособена врска (Console)", "SAVED": "Успешно зачувано!", "RESET_TITLE": "Врати на стандардни вредности", "RESET_DESCRIPTION": "Се подготвувате да ги вратите стандардните линкови за Условите за користење и Политиката за приватност. Дали сте сигурни дека сакате да продолжите?" diff --git a/console/src/assets/i18n/nl.json b/console/src/assets/i18n/nl.json index f31731eefc..2fecd6c057 100644 --- a/console/src/assets/i18n/nl.json +++ b/console/src/assets/i18n/nl.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Externe links", - "DESCRIPTION": "Leid je gebruikers naar aangepaste externe bronnen die worden getoond op de inlogpagina. Gebruikers moeten de Algemene Voorwaarden en het Privacybeleid accepteren voordat ze zich kunnen aanmelden." + "DESCRIPTION": "Leid uw gebruikers naar aangepaste externe bronnen die op de inlogpagina worden weergegeven. Gebruikers moeten de Servicevoorwaarden en het Privacybeleid accepteren voordat ze zich kunnen aanmelden. Wijzig de link naar uw documentatie of stel een lege string in om de documentatieknop voor de console te verbergen. Voeg een aangepaste externe link en een aangepaste tekst voor die link toe in de console, of stel ze leeg om die knop te verbergen." }, "SMTP_PROVIDER": { "TITLE": "SMTP-instellingen", @@ -1571,6 +1571,9 @@ "POLICYLINK": "Link naar Privacybeleid", "HELPLINK": "Link naar Help", "SUPPORTEMAIL": "Ondersteuning Email", + "DOCSLINK": "Documentenlink (Console)", + "CUSTOMLINK": "Aangepaste link (Console)", + "CUSTOMLINKTEXT": "Aangepaste linktekst (Console)", "SAVED": "Succesvol opgeslagen!", "RESET_TITLE": "Herstel Standaard Waarden", "RESET_DESCRIPTION": "U staat op het punt de standaard Links voor TOS en Privacybeleid te herstellen. Weet u zeker dat u wilt doorgaan?" diff --git a/console/src/assets/i18n/pl.json b/console/src/assets/i18n/pl.json index 1857872e2f..40b772d3af 100644 --- a/console/src/assets/i18n/pl.json +++ b/console/src/assets/i18n/pl.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Linki zewnętrzne", - "DESCRIPTION": "Przekieruj użytkowników do niestandardowych zasobów zewnętrznych pokazanych na stronie logowania. Użytkownicy muszą zaakceptować Warunki korzystania z usługi i Politykę prywatności, zanim będą mogli się zarejestrować." + "DESCRIPTION": "Poprowadź użytkowników do niestandardowych zasobów zewnętrznych wyświetlanych na stronie logowania. Użytkownicy muszą zaakceptować Warunki świadczenia usług i Politykę prywatności, zanim będą mogli się zarejestrować. Zmień łącze do dokumentacji lub ustaw pusty ciąg, aby ukryć przycisk dokumentacji w konsoli. Dodaj niestandardowy link zewnętrzny i niestandardowy tekst dla tego łącza w konsoli lub ustaw je puste, aby ukryć ten przycisk." }, "SMTP_PROVIDER": { "TITLE": "Ustawienia SMTP", @@ -1570,6 +1570,9 @@ "POLICYLINK": "Link do polityki prywatności", "HELPLINK": "Link do pomocy", "SUPPORTEMAIL": "E-mail wsparcia", + "DOCSLINK": "Link do Dokumentów (Console)", + "CUSTOMLINK": "Link niestandardowy (Console)", + "CUSTOMLINKTEXT": "Niestandardowy tekst łącza (Console)", "SAVED": "Pomyślnie zapisano!", "RESET_TITLE": "Przywróć wartości domyślne", "RESET_DESCRIPTION": "Masz zamiar przywrócić domyślne linki dla TOS i polityki prywatności. Czy na pewno chcesz kontynuować?" diff --git a/console/src/assets/i18n/pt.json b/console/src/assets/i18n/pt.json index 929b137fc7..17263c72f5 100644 --- a/console/src/assets/i18n/pt.json +++ b/console/src/assets/i18n/pt.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Links Externos", - "DESCRIPTION": "Guie seus usuários para recursos externos personalizados mostrados na página de login. Os usuários precisam aceitar os Termos de Serviço e a Política de Privacidade antes de poderem se inscrever." + "DESCRIPTION": "Oriente seus usuários sobre recursos externos personalizados mostrados na página de login. Os usuários precisam aceitar os Termos de Serviço e a Política de Privacidade antes de se inscreverem. Altere o link para sua documentação ou defina uma string vazia para ocultar o botão de documentação do console. Adicione um link externo personalizado e um texto personalizado para esse link no console ou deixe-os vazios para ocultar esse botão." }, "SMTP_PROVIDER": { "TITLE": "Configurações de SMTP", @@ -1572,6 +1572,9 @@ "POLICYLINK": "Link para a Política de Privacidade", "HELPLINK": "Link para Ajuda", "SUPPORTEMAIL": "E-mail de suporte", + "DOCSLINK": "Link do Documentos (Console)", + "CUSTOMLINK": "Link personalizado (Console)", + "CUSTOMLINKTEXT": "Texto do link personalizado (Console)", "SAVED": "Salvo com sucesso!", "RESET_TITLE": "Restaurar valores padrão", "RESET_DESCRIPTION": "Você está prestes a restaurar os Links padrão para TOS e Política de Privacidade. Deseja realmente continuar?" diff --git a/console/src/assets/i18n/ru.json b/console/src/assets/i18n/ru.json index eda731d47f..e408d47930 100644 --- a/console/src/assets/i18n/ru.json +++ b/console/src/assets/i18n/ru.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "Внешние ссылки", - "DESCRIPTION": "Направьте ваших пользователей к пользовательским внешним ресурсам, показанным на странице входа. Пользователи должны принять Условия обслуживания и Политику конфиденциальности, прежде чем они смогут зарегистрироваться." + "DESCRIPTION": "Guide your users to custom external resources shown on the login page. Users need to accept the Terms of Service and Privacy Policy before they can sign up. Change the link to your documentation or set an empty string to hide the documentation button from the console. Add a custom external link and a custom text for that link in the console, or set them empty to hide that button." }, "SMTP_PROVIDER": { "TITLE": "Настройки SMTP", @@ -1626,6 +1626,9 @@ "POLICYLINK": "Ссылка на Политику конфиденциальности", "HELPLINK": "Ссылка на Помощь", "SUPPORTEMAIL": "Электронная почта поддержки", + "DOCSLINK": "Ссылка на Документы (Console)", + "CUSTOMLINK": "Пользовательская ссылка (Console)", + "CUSTOMLINKTEXT": "Пользовательский текст ссылки (Console)", "SAVED": "Успешно сохранено!", "RESET_TITLE": "Восстановить значения по умолчанию", "RESET_DESCRIPTION": "Вы собираетесь восстановить ссылки по умолчанию для Пользовательского соглашения и Политики конфиденциальности. Вы действительно хотите продолжить?" diff --git a/console/src/assets/i18n/zh.json b/console/src/assets/i18n/zh.json index 005a81480d..9b9b820bb7 100644 --- a/console/src/assets/i18n/zh.json +++ b/console/src/assets/i18n/zh.json @@ -129,7 +129,7 @@ }, "PRIVACY_POLICY": { "TITLE": "外部链接", - "DESCRIPTION": "引导您的用户到登录页面上显示的自定义外部资源。用户需要在注册前接受服务条款和隐私政策。" + "DESCRIPTION": "引导您的用户访问登录页面上显示的自定义外部资源。用户需要先接受服务条款和隐私政策，然后才能注册。更改文档的链接或设置空字符串以在控制台中隐藏文档按钮。在控制台中添加自定义外部链接和该链接的自定义文本，或将它们设置为空以隐藏该按钮。" }, "SMTP_PROVIDER": { "TITLE": "SMTP设置", @@ -1569,6 +1569,9 @@ "POLICYLINK": "链接到隐私政策", "HELPLINK": "链接到帮助", "SUPPORTEMAIL": "支持邮箱", + "DOCSLINK": "文档链接（Console）", + "CUSTOMLINK": "自定义链接（Console）", + "CUSTOMLINKTEXT": "自定义链接文本（Console）", "SAVED": "保存成功！", "RESET_TITLE": "恢复默认值", "RESET_DESCRIPTION": "您即将恢复 TOS 和隐私政策的默认链接。你真的要继续吗？" diff --git a/docs/docs/guides/manage/console/default-settings.mdx b/docs/docs/guides/manage/console/default-settings.mdx index 4a0090a7c0..810ca5d0f3 100644 --- a/docs/docs/guides/manage/console/default-settings.mdx +++ b/docs/docs/guides/manage/console/default-settings.mdx @@ -26,8 +26,7 @@ When you configure your default settings, you can set the following: - [**Branding**](#branding): Appearance of the login interface. - [**Message Texts**](#message-texts): Text and internationalization for emails - [**Login Interface Texts**](#login-interface-texts): Text and internationalization for the login interface -- [**Languages**](#languages): Select which supported langauges are shown to your users. Set the default language if no context is provided. -- [**Privacy Policy**](#privacy-policy-and-tos): Links to your own Terms of Service and Privacy Policy regulations. Link to Help Page. +- [**External Links**](#external-links): Links to your own Terms of Service and Privacy Policy regulations, Help Page, Support email, documentation link... - [**OIDC Token Lifetimes and Expiration**](#oidc-token-lifetimes-and-expiration): Token lifetime and expiration settings. - [**Secret Generator**](#secret-generator): Appearance and expiration of the generated codes and secrets used in mails for verification etc. @@ -256,9 +255,10 @@ You can either set this attribute on your whole ZITADEL instance or just on some Please refer to the [configuration guide](/docs/guides/solution-scenarios/configurations#use-email-to-login) for more information. -## Privacy Policy and TOS +## External links With this setting you are able to configure your privacy policy, terms of service, help links and help/support email address. + On register each user has to accept these policies. This policy can be also be overriden by your organizations. @@ -269,8 +269,16 @@ Example: `https://demo.com/tos-{{.Lang}}` Privacy Policy + +Also you can set the link associated to the Documentation button in the console. Set an empty text if you don't want to show a Documentation button in your console. If you need a custom button to be shown in the console you can set the button text and the link associated to the button (if the button text is button no text will be shown). + +Custom button diff --git a/docs/docs/guides/manage/console/organizations.mdx b/docs/docs/guides/manage/console/organizations.mdx index 6763a09670..077ad4023e 100644 --- a/docs/docs/guides/manage/console/organizations.mdx +++ b/docs/docs/guides/manage/console/organizations.mdx @@ -114,7 +114,7 @@ Those settings are the same as on your instance. - [**Branding**](./default-settings#branding): Appearance of the login interface. - [**Message Texts**](./default-settings#message-texts): Text and internationalization for emails - [**Login Interface Texts**](./default-settings#login-interface-texts): Text and internationalization for the login interface -- [**Privacy Policy**](./default-settings#privacy-policy-and-tos): Links to your own Terms of Service and Privacy Policy regulations. Link to Help Page. +- [**External Links**](./default-settings#external-links): Links to your own Terms of Service and Privacy Policy regulations, Help Page, Support email, documentation link... If you need custom branding on a organization (for example in a B2B scenario, where organizations are allowed to use their custom design), navigate back to the home page, choose your organization in the header above, navigate to the organization settings and set the custom design here. diff --git a/docs/static/img/guides/console/external_links_1.png b/docs/static/img/guides/console/external_links_1.png new file mode 100644 index 0000000000000000000000000000000000000000..c14f43218055c3e156ffae43b6452f78dd9760bc GIT binary patch literal 52578 zcmce;byVBmw=GHy+G1_-Vx_dWyF-h+LxBRt-8E8{@r}F(4!)pX|NYT64`gSN_V$h@!rH`w{^G0aaW~NC5%i$#(>V$BfSr!EXr0 zCz!#vr*@ykm7artZqN1qfZKTX!e8tatqkp*bZiX}j4Z7z3~252Yz+)7?ToGL51%yg zfd`SnA0%jNpkr@hW%*9Y#KHicU zBad~z|9-cA^QflROXJ<2#>7R~(GMtd)?flNv#D1AP1C#QKmYUVc2RL~AK~9OpD+60 zBE0f%;Z|&dzpT5-P!INg6s`<-TE0h;SRz-!2++vI4*{^?rUx@eb zD6d(1 zc0L403r$)`AcHoaG?Z_DrhMtvL{#gBr+M>AnypB~H|0m8enX52`bB?S?Z_qY8w)cgeqWr3*Uv`floi#Bwumq+I+LK@HJA=fqa45Cvg;Y>a`KHe#9H zq4t?gsj$iae`f)!2R<=lK2{xs6W(TcWY?EyMp>5)I2RCBFT@gtHfj&vx}5GhS!slxV4S5 z+K9BmRH+}j6+Tj6=jv#w7O)!Pxi#+j)F}RI%+9x<{pN+27qjJ-ln$nQ{1Y|7{k8@#jUUm{9%wlY6xYk7O*l85 zK3i%|S+zfyLiBmzNbqn$5c~G6R4jvUf-6Cd^Y&YWL7oN*D>XEPK^*!Tm;K1KFT#G< zh7;w-@!W?pNk1Gz*DZ01tZ#fV?rt27?lKcX*XOyaz%?y1X=kT`H}_gEQ!LQ)YDb!; zuXm_U6vr2Hc(u*vxvt*o)=V4rp=#rY59ufZ7la%=Fwv+I!l}4fCt^3V@|=7JpTyt4 zy&o;vTyX{9Ph@y59+=OU$Znh?Z%C!M$6=omee0UP2|@sgF4?0&o#souZ-9p56YG^l zyT#4N{{%qy>l!8mf4`f)qv0?n8uS-0!md5@+h__kc{)af%ZA2=mgeg&`Vy;@GVIE& zM&D@8|J<9ilQV^UTQVc!cb7@?cE~{d-X#++f63O*y^Ux+nCSZGn|jZ0bmI34kq{Sg z3k=vc#-m3?lo}IC84N}~OTlu`CHiqYS*!fFlTkGd^G84Y3D~|fVi+#%xyYCDP*KIE zr+=8KEZx{TR($%jaRB-a`9Blk5g|NQDLKV6WZ9lRd&c}w6hWiL@#H&^yZ38CjI z2~T&HyvE1(iB$2}nJD;M7Uv^z^U)*0d)g_P zu<`x}-h`-#h=Cc0LwN z$p-WoW+W`IWTsNIDB^XpL33q>=yb^2KDwJR#^!PVgGQ|~@MG^piSa#)_w;$1VF1-! zHH1CtGwpvy&}Wsq;G`el!w28wYc+mX<-4cRsQ7_rhmC;&`#au?Bj!Hx?tV9cPg+_! z=Pp5$_fOzoow+R?yajc&)~P?YS1 zgXH~ziODxXLsd~=w~4Y~dv$B)Y!;#2Gw`8M=bsWu;=0yDC?JiBYABub&Tc-3d9&tW z=>^)Vh^~&7cV)u$E8?W)x(njyCg+d6*!_ml7TRnU^H0+2?=ZgkC(wTM#UH7b=eR`@D?jdms75@*& zLD^qgesVICg|hoOJ)CR~4la83_Z83e&iYtzUwE2XXVkksJeqxt!2!|7k;EBnwd_;M zz14b=<%wSEKKY1Fvr%UGy^B-~N32g!;>po*nK|#j@x!7h$jz)QEV$gJfBGC68}Hrj z34$6DXf-MiBVtXf?W#yYUNM?kV~pq9{XDe$N~`h2;663NpMdN8>o!E|Yky?Om?EO) z4H^+C%^soNzRxm4OW@j?ej<;1%NHLt0v`MK8b#Yj!=5=xEuq7tNX#awgy=*(I-T(! z$MWU93KM1xuHp5BscC-G=E|iK9f4$Bm;v^n4&B4UsJ7k5MnX?$*4gGMAo_ER^6e~orD>gW0|qjGL)4ciMAO3&tV(%#nLjQ&aQ#YJ%Ax4eOSA{3DUm%w&eD z!Ja0lyOS+L0{m6KNY+JB!f0xrIT#Pu+gKv~3NVX20x86n8<#%2brN8v(+uVSx2qRgA8%pMLML?P#SmH7--OtoQocw{PS5_r+kD0k$Mc zi`oEP!Ea78W#UcTQJfh%Dohwc)jdzPEZ?$b!=yI}nX=J0Wx0Fq@L7^K*$E$9a~1Qr zxGVEl)`sWtP68Z%JoYasTW>x&HbN8Xf)h^Z>=ost*)Ql_gDNXXA^K3o1%hEUz; z%R;>gX%3I|=@J{6bg`m(QzVT^-|(;5Y}G15nP;4eozv)HU)!d`kfy5ac<*lPMHLkV zGww#KcXx{I-Ps`Q@*VgDikbhivWcYo!W(19j zNy+c;$zj{i52IEzr1{q4|15vD`pNh4-Aai_&IG5ybGwb-^$-}7Lnv>dWz-h8F=mn5 zZTbYa6fX3zNmciz@E47GZRF+er!E&;@p{YRGWVZHWVOhrgOUcsZYcA=);$|lAfwS{ z@^QOj!8!&SESPWY%JNG|tyTpAbm}f6bwNMufjhMy6}dR?6F0kI36? zkK>mII7Ms!`#W^7rYQO)_z1wZr_IPks(6TU{9J;+bd62cH{;8=Lqg;gcFU15leH3J zr4k#zBcUfDSl@LLj*Z(L5Ou|(&f4xxE&2snA-s6;qW8{XIuRmNnvMP(JU%v` zZ6kQxQ zI=F9lU|Yw`Z$<-FB%`RH(ei=}^hP3EaaDWMPSL%pRuUFv)(1+dsi|u9<^}p{HKm66 zU%8?dp6vbc_04phM6)+vd`U=Xk?87D<}$A$zFuo|qmD+%3yrZW6zIXk>1v3>HR1PC z<@4x^WBm)Tn%rD>aAiTkakX0lRvx?fz<4PH0}*xaqjK|}=!`=3A0j&(8bN?c;N`wr zhc`4V44zD99S=5Po6h#-6?m+=uN-#A-jQu!Y--XKA1*P1hm-O(x`x9*?9F zIeg!AcHlAVAZj<>K@RY38xXzgN(tx zaTl{&XlP&%61JUdB2|OdA(#o{la~8XldMy&@?Ag)hLOZT88}S?iB4_DNBqs64w4rO zf}oulyh942luza8k7MhxE-Y7qZX#nBq)TQwDi!LBf0JYARkdjCn$+Im(AzUN*pO8& z)X-Xx6Owm(gvrkIZR}5rQlU~Jz*get8nwE-j7hpNd?qOSTo=z2GIMg@YLlZK>Yv|c z*l$lo?u>ho?(Mrq7ECq6a261vBiVGillj1b;#poMp04SVwY ze*yI1t#e8hbj2@6Ha3@?Mb$79W~)@#dY9%?NagmJy6T(AM=k}k+Z!9T%{m>%Fndx;$FZyh zofn8nNa#1M+K3YtP|#<6q<8mxD0uI;kM|C9OvNTG+UwJ;pMU={HhTQXSFaNebux&k z2#9kkap`#MxX0J6M$QgpLNVj{{=!5y@S6=5}F2 z;NC*zd0gvd+GU}l0JTc-(sEjsP#48PxM5_X7D?nSYZy{cBEyIWlhHtpLP>p%eglXl z6}p73jNZxZX{V=olNJWx^hHN8hj9(mzz$eU<&XfM5o*9jn_um|`3TgE)7|+1Gz*I_ zjiwl+ds$1nIL)~Ru;Jke70!H3uF8(7sbJ8v+MR?eW)_xNn36}A3`mVv}TmXf05 zc6IXXJEV*}sDey3Jp`r`*%Dpn1^0ewpKJZgh<)q2uvCg>CB%$zNxe_W85u(! z33e7+A5*=-z{nWDAvp0qXz+Qw#Na^0w(nvMdT@IOEWCWv|L(gZTFPbS3HO^@yZ}BRzrL7AC2dC?@qzx+*OQ7w#f>J%5;g@%SUXQ<5 zxz+5?S_e}EO2W7JX4Df_GthJs7z4G%=Z8j5D*sg_Eb1>q8HyU`#5`m%@6###eNR$K zS>!}CH3@xeNMAg6>yJH~t#&_5Y2`_$u#f=dG<*4pT8$&}6CeL&(3u&hyRr#PgYCx0 zczql)yqdYZveELpq-}VV`e|}8Uo~WxXq~oKK0BB$m}!a{G~#Ew6QKlkj{T+};wkZ} z&-Uj7x?~ea3npKIN<`=IuiV$>b8ggi@XLPR1db;#M%IdyPEN8)cU2-i*X30_x%{h0 zKb)e@yG%3n4gAQ?HYPxSXp1nb(kGG~zXW;T=(M|KZ^0=V?7S^VuN!^#!F?PtOg1d{ zk3RV)aQK1LVS~%Aa6;ps%8)Zts2@>(trh{xv@%knM9yu`OD$K$E(8^8IQtXf#$83c zNf}Oxc6oLmthYC6JXgiAGu$Sg0}`3yh{0)dLQ|F*kY$^3f)_ZPrK)=Bhh?x4|1n>^ z$_t=c$;6C2l?o>2EdSLtN^(SW;=zR{qKwS6&)oXc_SH*m&kW6dWS181L~-%)AN9;m zU7wjMv`#&reZ3mP06_zcPnzD1%F9`r;KhN=oiiiy_^))|*d5;Gd zA)c9Hym>1E-X`Se=mkL7@QCvGC0b(G<|u-OFLqqyWE*kDsxT_7b#vhWo{>JB zJUmstOX7gU%*GaI#(uys;6Xv^eIAu=l$#%phf^iVVxoitPGYEqy1ItV?zwvmfBrzi z`uCI+zOc-Gy}kArO8&lGW24+eIVGGQD|`Y8>f?BNM!ku5q9w%q34mk8)nDO#QCs^A z90Q@L*>GYn{fZ8ghLdAb28u5`G3)PzPqUTFs0t6F;92{xo~U&vGy)tR*ufoACWn8d zIdxwCHa_O+&o1Se%F0MC)x5}lYsWLWZ7zujsuu!Zrs|}|@k+ZTMnQsbx5M?sTy#MA zQk;zT`gI6iWD;OWjbw?I_MlI~?_-@~hC4GkmzQ6Iumao^`&_+yklEy+*hH1t{9|Hb z&wI{wA$utl*+iF>m5oo#)Z0G$MT_-V7&1#ce*lgkptvg8gzqWp}FjfX1ixGVSP z1`}M-U%Y&2xEeX%-tLy_kY`Bc!^%VzTZ0_Ay0(|NO^MqPfbs%8=pDxzs*cs7&0Z37 zdl$J}PU^>v^}a6+mek;C0Iyea*eoB*esg#|Ha0d@_dwwj7~c*89SVhl^Y9uMv#%>C z1hATtcd;pAH*B<5xOg4j{dLb#-1-6OH&rnia-hkrA8k7fh%PvmEz{xt^r?l%^`HY_ zj}K1}A%L6^)oJ)#@3JncWDhT$p*MM`0_zg%IZDH!9laAPcOy|zMQ&=fwojBjihgGZ zt3e$_gOXMNHTm=BPsr^WXG@Be^YWQ*v}}^KO_NZDZzNvee1W8^Orq_|!mlo&uJ)z1 zy@9%mWu>czH^lrRr3N>Ai08YX0D)pMQBDGiLj?W+XpKf{^zbXq7kxYhUcnz_GE1~G zmMa4&SOG`%M^B&m6q_BAtgP_CP9o@olAIN4bR~ox&t_=7{o}j)XD^OU&X@he@WCaf zGXyGP(PX#zb4qeJbjARBmkKql-YwhoErs2FCn1~F?60yoB(S(IVZo{8l$QDepLO5! z@p%CBy9%gB+fBxZQj4$ibT+5$CO@@&;6Qt9e5{0pKChh5dHK%wPf&r<;QGuvQt`RGO{esU92EF@5$PK!D3Dq?6NW?QU49Q_w2C=5{F%XV zF3mocm!zQJuX78HV!I&H3t}D;3X13kq##2oJ^+P(=iPi9;Ho+1;s`I3vHV(XA3!wE zWjN)y8+ZqYwwv_zH6E*I7sPxirV%{|x6^0nbG(JtC*c?=R;{2rA#w0@<|KRDoY{lAyIBroc5>b z=`?w7$P5~DcwGqn!^*fpTgXx8;+CLn=UrVr__fK#=jiBpk4EP0t0D<)Qs!;y-qfba z;>BZ*vz;;h(b^`pM*Tp2gxClsJJGri$p$mdciMZsTn+aALJ zptg?hzo9LNgKtWOnKCIQWeB|2EETc=g2wTQ$H$5wAg1(0M*t*6U#~?)c-y@SGMMBp znfYS*V*oxm-3KE6{0WMViTtc7op6?iBU#y>R!A445J%ZY#57RI+1G0QZ)y4;o2u9MYq>YC`%rU4l`{YpJWPl1y=+%loz1E>9uH%>;!w`pMA-z3-V)x)>4~C}Q1+jOcXu0~p4xwW z$daW-80paY`jz0>=v;x!O`fTc(C;xW;f4AaVYzb=Uh?vMO5ung5L76661NLA<%tx+ z*;I=b$yiwY2{lxffr^qfSSyz4o#}FU8PjSpBJ)vJMrK3NoQ8{Q2J}&KUx-0D@!|%H zoOXTq^{84RVP+g4cz$oh>#yz6LsWymLmT zF>=p)Hy+q&Pq9n{8{3^9BglW>MptIF^~26HFo(4dc}#F9l5OjXy4fp4P1@aMu0qJp z@C3h4vFwLYxd-&67tz4um*^g;tL@?F#tI9tF9s9kFZ_#>;xm}SqNBSzBqxn$(n&x` z&jFQPTpT)A3wzgABP|&xhPb?KkO_whk6zv&WJtz!_f7i7^BphZGiU<_yK}EY!HIpe zs$;uGv%WR?QA74OlL641Qd;3S)Vzbaw6^g-rsU_q85@q&m;kW-=)^-<(u^7u6hDVD z5lVKWHJ$;5g;D}QLq4W-n2g9{SG#c_8?9QS6gG*SX1LF8+(kIrF2k8BH}(aZO-^9n z_`K6UUH~ybqwDfP4>+>l%P!Qn_iQ^OxCI7nUiWj;Xw=9bu;l>EH3UkYlw{mcDg@)} z9DPW9JWWh#^mvPgVfahC$ zPr~;DB$FkY)hK?ktM#1VM7m+dr0{#(;8#fsBr-82avK7}t@Toot=WZzGG=jxEZM4Y zp&xw}lfSEYZ+=tGpz;6S=N28dwoYPT!fZOnvNKsA4i;{rNUJaYN;2c%Lsw@f<-CZz zGv+uFyVbm2`_MfmWvZwRsbC_{S-O2r=va<&f^3ORJ=%+i>FV2VB`AJr_8V<8c5|bS zMY|HyuR&YUvha4^5Q&7_*w|FegMm^r_k(A-nJ|!*K#%^a;q!wusWN6}UpcjjyZ@i| zp?9m~K?+F?e=nm){Yjn?bc`ZrA|C0&J=B?@rD^rh|;BVuFKukVY#0`Ry!)rh5> zrv%sL0UejajV~b+t|PB9^941a{=-LuJC_KkX;l9Y zMRG>Odg%`6Msf|1heoM?JB*4{YuCTOxRQWaC>ahEWYZ~#kXmWIdBYU7xYs31PC^pW z-JLDf#PIAL56{oK3!;&H6G6U?PK8<}aXQe|)u{yJmX}+8j$z8g3}$^IEEAsqy&LczpQmOlEj^Xm^*~x|P*@urGkMHl0az0H}ZBPokPxk#j7CqC<`ku(SDeAgt?WJ@cgxVS2ufsU?%Mt0$W$m0zCd8)!Q$%uvLSeTf7fMv4Z8;YG_ z&0X2EeJvJ~1@h^42HA4Xp;@@Rg+VZdEZ{87jfP(rt0a!5mJa= zW^j18(7NyXG5T{M?Iz>Mh4W>eq@mi^zK-B-mhqbmY9IyA{`1|3DN3P3bdf;6# zy?gf@8SkoVl3uS-yHOua_~mYi+qei&9K&2VgFOX;^-XovL1q0D6qHr(zrCYoqSvbt zyGr~j{p396jCS86H{LWzUw#69rZc1XJ^8?MOVCn-RtYe#;7A(Q^f^OrUY&A9tI)Ew=;g02( zppE{wHn0JAJ`X8KUvI9BJDETJkGvZLk${ArEt}DgHxyK62spfj@&eTSZRR(j;nD4& z>sU+VKch_sA~D`Uv%6%XLU?8j>T1wV9U6k*;_njEdF+`=%NF2cF_CLxi=a~1ozH(g zN*=Hbcr<{U-wWBpO0wnfJlK}{=Ca8Mk0%)i zo+$ti4lXt&Pb1h)d$Ww+{r+(t*%_sh7!FvMso7~mDv$bl?UWF9dfHfaGTB5PmV9lb zJQi4<2AkFAFp;zFC|L|iSgEmz$?_@=Tms>7I}N8qODid-kbI#>TI;m`9d0`roCJI> zRb-WbqT(-8WhxkO!H6$QM+65804NX8YdXjjAd_}A8O2kols^|lJZk|L2CgsDGl`$m zamC(SyK5l9Da%@iR|I8W)`s*6m2$a0$o^}+Svd@ia76&fYM_S%IZPP%WqtL#1cOa z{R6g!@6Z8}>Ye2Ij$Ag$Xzb6YwX5s%g6?h#DQRg?Yh~tV#>D{+Ix6wR<0)o$FjMX7 z9)b%jG2Eleaaw8?rlzfcojyJ}|0GCCUty-wdr}haC9lP&6p0u^JDG#IP9kigxR6RP zU*`x=2OHvb2ZeI(hXs1~jKG2(HqZtUyZHvJLz!h~%1sB(;wT3{_%yh80m_r5!Zg`h zqKs!cVQ_R))}S=jQ~7VvW}?>V;cS9u(EdjBs$-?)SD89CS|)etQji7JPx?9mw**;V z?P8Xt2SITH;trhs*F;30A{MFT0e$`y%S&9oE;S{krIS_iQm_-5^Zsh`Z*kS3T7&K* zPsf{IfVP%O;_(J;6I_pn?%_ht>QC=E zdQhXkF4;x;Fw|PhNLx?tr5g<2{H(4jVghz9T?P@>4yJa3cA zzOY*ef!Yi#YH8wWE>oz)Vz#zSx9_3OIZl+3C7~@iej1S>o_1}n)fE2Y&P5Ky|4fwy6e#i^ zj*}vo!g|K<-e_`HtU6d{&t0$qLclAkDkxox&OqU(&3PMz>V(v~9d({xxXnfN=U!}; zFVRtO{pH@hRxv+%1-;J52ky#aw<4OEVu^C$8v!Tn(~p+9`h*i2gD{pL6Ob5!M;x_k zZGQpH%f<%QebQHF1y%GNVc~9zj%(b-ltTbq=2N7m$L?C^qpsE4`!gA- zzARb)B%U}%$4c|B4bcFRd~Je=9+bT$QZ0lhh%nf*ob|eMf)%^3JcX38jK!ZlLb`i9R^nX_VzBZ9F?Jp9K2L`4OwVHHyW>{McJGD71D-iyS$e$GOp>ma7j zFecsCKT$=u(RJ1_ef#GJ{GXGwG;`F_UiPY3E_qE-cgn>71tt!{*{b(cT(O?A+;&Gt ze^G8kgxsVczeciC%FX6~0u71N_7)SgOVs{FzuTVziAAmMgdTjWae4^R*Q&~AaKC)j z(#PqC$LaQt`aTi4xdOjxx|(y>sa1j3{rqPQa+Dr-HoG9w1zbpt=RFj$?#9RNPx6kt zF#u@pse%@p&UiJECU+HFClH7Tp?ORJVryi7}V%cenPQY=)Y>=E=G5o!AJ z9!@4#sj8-?=>fv%!|x6W(q%wK-D|Q;H)0Vh;WY>F)1mh$BF;isFE5bbIu&ySHo{jM4^Kh-OOeSi~jh$ z;jGlyuV9ps$T&qSo5W(ex~USIDoQvxEA3D_Om>#FBFHEpqxuGT17l|R^T0wKRof?Y z2JA@mn{wI>L;yggH+WtF{7gT>vf`a@&KvX_QcDpj^}MkA&58mJLm^4w^;42v_^tUF)@Tj~OG_l-!Xy%ZU$;rh zWPU$K3w7J=9#qCljHjP2(Lh^B0n(cY>W-X%Br-syAknt(bEDf@B%hIbi@$ohtU8og z!MdsGxyNnBFNlkEb)YEVY5%Oe+<2~-Zq$gjXFnO(+iu?g<@-yyJ#B-lz2QoAh}$hL z^eoP4>J*ip`PvgD?A`O$hdNVb>a?_i1lrLDyPm;UA_nc4a{riXfeAbMG1Wg#)Bnw% z-43@kSXlG}V{BQyXQNxJltb|*TxpJDA;T9WOS1e#sLom<+xRdPN!B9(}u!dZVm3u+(29g|w zRI8TQiCtG?Ki*F7qa#Q}vTSU%Sd2-+`lW=K6g_~0@wo0MdijGnFeos&cDB!&4o_JOUB>US^kO?!M*o`uGnYuJ_++^e_&b8^P$qi+! z3ZhfGDtK=;VbwO>|7#>eg2`~~RUa_AUT@I4o)ZonaZQ5qTV8774R}nzw5%KwQ=Fx! z0v8$XR1x{riHYsP`g;why|DZ+2f|N9f*ioU&Fx6MmLC?UKMSNVz4>}ZN4-pm1noM3 zMh6*2UDVMZjaA)$5VmfH98u1br+{Qw?gCS_$=xx3|LvVM{)=w zsMX#8MdU;|?!&HPPF^0fuCeD^_Iy!W+c&C(^SZMGcfcz-2q0gz^VM4*q=f%2vFobb z+Qku;mPY*^9L$b_%OtW6t1w^q{ppFTxC8e7znwX4t@S7{Lup-Lknk_T|4bS7h6l0% zT`}1G^XHO+oxj3rHuUoHX-tt(P~cx^v6NOVc=^!=Gb8|yM8SZ<1rd+o`i``aaFvM@ScnAR3W2u_cfs&BkWdUD< zEs4|r_*+YAMEwg_E!pBPxl)`ezawD&uP$8%YFQf9xH zfxdS&YjAtIfiyN259Xi_S0;1Ya1Hx4e`ZZeLQlYufnrbkQ&jx16xpJ}Ti0uzUG{w? zbrnV0cgjA?2f#4JO^Sv*R&(`1% z_;qs%25_vlw%d>bxA|I8ld5Fpe5J`Vqk&quRo#An3{BFn^r=rhd{_jIsQ^1=0;ojK zaw}m4h4(jvL3Y>q$iXLm4*y3JPzFRri)$NuOlRo37U<{V($n>Uj~Wi{Yp!7TzsMD? zo-6EJwmfmwGuIabl^f0v6>wiXVu~09>1GS05CF|Si;Bi=CNAV_RYgp;q#*pCja}!e zN?nvxVJ9nO1$)`QKG{t7n|nmFo4s*5;BEgGXjcJUZVBKtHV5kTK}T*95roWs z_4Zq}FkBsewcKCquAM@k1>2_TErLd>2`qurfSZ!uVx*FGQN1WLbW(-7mwy|JD!q3u z22CkXol`J2!wMr}{B_N67vLMat)(B(9q=gV6i-$d%N(Y`cm;F1o#VJc&f1wLR>vmb z*>N+d{~_NqVB>COF_-h1hDDWr8>V_YmM45cM~Lu$H9ANoT;UK!6#~`b zhjblLpJp-2_nI;S3QOZ=U{SD+<_db#5fB|_=uro94lqBy0l(nw{;9_M3D{HQ*PV3sVe+)y|&=5nT8}w2+7$AnxIwKszL2Zef zfjhWsuejK$PrIB+aZ^zk$U(Q$1;B<*pL)17Y;0=E1X?Dq8>L)hXq%|)U*7?aDM?xR z+VMOMjQ`=^knk!17BQ)WieO-R`DUCfdzh%H=lV zC-ng3iA8bR3mG{{a$=&V=@|b)Ii%JfAI2om|C$j z7HF$O2lALucgD#+u=oRW$H~$%2KGRLFF3q+h(Wsj-uqzCBzQ&JbDwDFLUw1o0J>%Z z!{c$|v9Yo7msLE+Tvvl^kNsDhMwEgG@G+;ccxL9pjT)K$tL@M-l#00SzhOo(tQI^G z)DcnUX{LO;lXdunGc(0*<76UJvMrPJ-<5ke01Bj?&Xnw`1af_;O|K=8#Y1Pb1@;*=H@KzhJIR6dba2kY}YtoIo(7p>mi zSl8@FQ#lA(o-&q~pBQn)^Gj-GW=lc+x`=b=o^;%43$J;pYVl@BG#<{@;Rhx0WN8$U z5OCPXztHnZ%Tg8FsXw`%ck!~vGvdc|3ZjN*z~CW3%>sTk4v-szuz{V zS7ko@A-NNmlG1MuW~BLA@7vxk1P_0D=E+dJMRx>TJgg3YSiejOM=-lzY9ri_%s7R^l&dhB(}lFSxw-B z>z_Se+S~Z#?EG|Jy{fsZE6G!a6HEfN0aCoW8Zy+E8`3lR`h?8ifSMhi9r7kEkGG)A zVC<*plTH5~w6V%YTjr5d;QBf}2ega4%lr z_(&?jAa4Uuk%64>2!|aVYzeHViyj2}IPg&cL?H&=3&_f8js>PKgOvZnvO-0uAz!Q6 z;OIv}N^T1~=LI%dj@7kDlEVV^Ixlc(;Lp0fBvo_1Lf^;{h{AbQtpR`FKYs&gFW`H- zK_ke3FptCVn}2ptL+)GgWs9QXooXmJogCLTl|HqQ?9I6T0g`*Y+j=i(okK6h4FK|Z zW|viLFslWn*XhYtS9w(UKRhoFXR*rsf$z6L;RjHM9B3la8W*oX4gr1uoBeA-==HgU z`UxYGFEF;f#=VRM12^#62UtJ>;D4*MP=AGm)emgp07z^A1)=hg>m95MOYNr?5-`cg zfKjA@LLv}3Hh`H2<_|mIBnJyhVPzr%cn0|V4VZdqLlOYa z&F4zvqN8QYEytxwHT9KPfK9s#I<1*2^Z3ePt|}6`m-|bZvMzVSM+sCZJD@~>78z)* z5dbKBVJ)P;P>+wFhZ|jXb|~k6Y^b1uEv5WFL*^vJ>^)fey80j1vr@VIEcZ z?IU^wyjRdtz(ieLGQMOU9jQNZdG>vC(nS1W-{@zI8YS3K61B{nl$LpWr^lG$65)-3 zVDT_-UAjIGJIoy+H}~FP0cv!r)SVtkI~n%Qqw@_+v=;BTqq{@746uQyX5gaV@{`N$ zHrnRhDO@zK=}&O1O#qYOe9YK$T+uXcSpjM#!wZ6tbWNiP2_dvJRJ z&B;JkZu#hYZ6u%6!oon0l2kA}7+K>EfDOP0Op_T|6!QpBdKQG&uU{+dBIJ0}v$4sX z_{FAjFfr45)y8rGhkWE-oT#QI6{>Pb^yT7M!d5gcw5E)dKdVL{$8&XMC4Hs2IT?4B zt#BzLNZZ>a%oiRRUJ67f9iLi_6Dz?!jkK95vxVNr0z@gH`B?cJx_#j#84 z`=nK2dg`?w78dvvdbOMzJ_AKV#QQp&jq>lNUlf&7DCXarTRbsnR*r5{rugxSH@x0E zj=c&U36J@g&EX#ZPj_$GN%~+E@b^<>r>S2(rqJy9jZCDP5eb1br5as4yp=Y%LQzPx z7#0)Bi6c)k~nlk@fO6Kp0S+NfkSnz zw(ik)t+7J22w>pQna^hg)3nUyS*ETbfC3YzrasGM%H2pR4;_&T^1q)U>ox5P2hel6 zt6Pf0GqRSZ;x;`)f`3&sr}rK?==R>qQJ!@%OLi0_m#r-dOZ*X+#6nbM%EFOES+D(boaJWK;9(+ohvZ%y(1y{WK!ej?;nY#N7f~h+jADxyao*uRanAU!2n)3u}rQ= zwPQ}cL_kFso3D2ga5k3iayTs{c(~V=0qc>9^xI-{uRV5Z%2-4BJP~Deb@mh~JjIv# z$1-t6+6Yg~yN1ScAAy>&1iaq3Y&}2FiPI1N@Hk)o2Duk@(Ta!Q?9!lnwG-d;wUqH6 zFTmfr(-YHl{o!=`LE7}Qxlw%3-42iRBxO7@qH=I>P@iQ<`_wQKP9q=x_*pp<4?Rgx zDu*vHe%<+4oBIR}+D>6Yw{PQBzD#kG$;9+_R!AC;=GKgryPJa%e%_UUjW^y zrQ>eI$u&kcu^#d_Vt83BBQvuT2h-_~Qo{Q)+Bc00?lDYyDQld=+!c1>6aq*L08Q}Q?SU3~N6u_^gP^xc3 z=km3;I00lQ$Lq*Sa_*BLo}QgQa|e3q*Pc1Or8{6#*TiQZ`sp}h4kHpSxRVr8`uxe) z){m_k$iVmmd=?nE2d>W#ydBCq!B|p;LX9MKR;NhKJ>GL<7*nXv;N6p-m$Vo~WkA6G zEGruXOr9TlQBM8jv*kYBV%1|oK{l7bqA^%7?SF^-w`h+GTu|C~6%R0F`jL|HFQ^{| zQ=R{zVd8EX-L6mk4^@(xxVz}TN!uUnc0Pl%KbC#Z4JL!KR3Ae6G^%+d13Z9z^9r^e zrkE(mx5IUZuR^}@>xfo%)5~{oZ^opSC?YC; zmk1txM2M(7!4=Ze)FN$`t_A&woZEQR)`dpBwhc`b!a4Rfw>zb6{G`6faWK>bH%kDE z_gJAkmQj=+6(RZAq)@@_6%&Et`Yy7oy!e;@rXKem=^_|Be*CkTf}Hn~Ms)&3yQ!}s zhYr|GUmU-P?&VN1TyP=J3slUIqS_HKQ2p0&fN(P3K2}(fTwqPGbIg({*nztV08r|6 zgJ4q_)7xgRM&(qJYvPttKXj)`5QfCL`ztjmXp&JAd4|_YC6?bU=64!hGbMywX@$i5 z=jEdqD$~Nt&a{m*u-3tC*3i)n#gd=Tyk2fo(K@L$MD|^S&x!zpg+oA%1Vd`T74*nL zoptk)-w1)@|Dscd^y%@s+@jDQs=}L5@EHnyQj&~1d)8oW`>b8L3d%O;h9)LD7Y48~ z!rp|_>iL4tn1~q^7ZMTCF*W`COww*=qOfp;m8vdKwxs0izon_*n3^Qsi&kK=v$cTF zNe_770_3d&>}tu)-z*mzyEX@pS;Xx$IGBM0?SB)1NmmO#g8?Y`h*luy!O~?4A$&gb zb~-GBYdIGPv0fqz_2tG3(L9iop<)lh{8;_?hXtSuOGHx0j8jG64OJllw^?X-_-|>y zOu*-|w8cMw(*kF^ZYpWjDvjA_!HWQ{12 zmM3U9a_InlV9W}`TR@V8Gq9zCp(ZANwz&VMHdA%j7@pWU+5ia(*w?@mmW(0k8Gr-I z9(h7wb%0jgt)RyH-<0#@`aV%$;04|f{J0I^ZIgnr{SI=H&xIYL45pZ~YccE_@gk5%X)^Rg~ z|7B&|b>vz%jtj?3SFmaM`NlVtikZo_9i>Wtj!8Ftf)dCCukBCwCLZDMN&%7e&j6u% z*~5}Na4~b(^!z9{83iJeQGNjp<(GH#K;`aeZ;uwGlciLsM&Pt4)6>3tPY-OrIDFr1%0#kWS_4?F=^KAcdPgn9*6#0~D zj=*@&I#$=gyem3n^C6L|Vvp0|yuQbp^$dr9RCeb*pS$cH%LkD=c~K4g!iPI~@D><34!j`YI$5ur&vq0t)0&lfp%J}Q{qQAm1v zq`o+`zmt;qfBYb>AaXjM#+fCUo~pOZQJ9|?r%!t9@{odzjlGet&gL^z%mC&;a;m9d z-RqQKmNi+l>il$PA;jtakkey_K+DQ~%$r^3#QgefyQj5A5uw`l3^DIM>uNyyXmbz+ zpZ9Oeoolfv)SS=rMa$KUbOa1Gs97zi5iT$$uPkztkTd&^gCYS!Mpih|eD$%sNQO5%hyl~(9;GniytuE~3JjJSL zz@K0SebEW1t(79jJGarfDml%gn}sym6-0WZdQAFaUElfUjTbXHdsPZ2Ir%&v&}p<9 zy}^XoP?3}BfOd7?dBP3l7rCp#v_)=DLm5J!ni@PKLb_6qQM7k117%)boQT(mHm!Uh z7g^QUn@rb}xVt*FGz$<1O&{o!T}Db$HD7OigtOdy zAsFlsM-+OZX!;|IZPV2T>~yk;9XDSb>eu?fm=6a;z2>&ui`i=Vr3lJ)*N^$# zG#KQLO$2Q>3+BP=zR`1{jK8&zLHOj_arF{v2aMU@-!BqXqoLe(15*?3SQC=;+lh}` zqvUABy!`{bNRPmWDfxTEO#xCgTNRmDoBy1MoNl!TQbaEO?kas2PV_$k1HV1EUHy+-_~;chSToW z+3|zpof}N#D&m^mYEkd}cHMq=E|TPl%gXwGn}3aDwdFR}W3f{KXKx};U>x3;d3 z+3C1AneFAQ{vY<aecRuge# zE6;Rm4lSh6G9l9v21Q-b6pF_0jQ)F=XkvAjL%Pr9)YIrF=f;0D)mFtuB1nt`&xfdl z6jPNI`N9?UwL%-avm+Hs)KQIw{E3?yd{3S{d37>>*qy-g6fcAmVWL%D$)^8iZ(Op3 z9DAs$CQ4OQB6ao5Qskp``Xx-m4+*17VqA-jP@k;z#aVUM!=~fz<__m-wW6S3%6{%` z%V3QJUuT!3YPBmOsVTIDkp`?NQuM3heMe3)>Ze)!;?nEZ4oizmk7I-s+|4Fzd*2$`SMLhg@RwNxd{ky&5)yE;t z7D#*}YlUi+$DNW=ikN@P2}Z|R`+Lj7pD)``htet1X;s$fY@RNN%O{2KwIw%()9H(6 zDbTeXeJgTzko$VnldWBLrEE*^-5?h;^%Y}f&s$H7TkpPq{PmXb)yH4oQR`jL_|Kni z2|puZ#kq_9%Ui-edb4FWaQI41|70dtJy%yd*_uj`it&kv$D7?_}j;VUsh{dJ&u zMH5aJMir{xJRR+|vmkD@_gg8vLx~~o_1ces3#}ndUT%CNvVzT9B*v`fgC9UZ6=SqA z815E+{o!cMOhij|fTp>+@3TKazL>0|;-Mi3|Ek;$*S!xd(q^CGBbY zrQHAW#8{FmaTDY$<4YE&1-cR z{0agbRHlvF{pwbS^g7V`Lgbto(l){!GCuRmuqNQdBK-1q%lY0bQ@GoDHp$%`SZ({W zM4z(iqib+~ANlzB&u0hL5k3o3%+>guRA-43Il66}oei%`^-uQ}!1N2F--^E7F|4h& zAIwx`kgZ2E3Lf7f-Ve`cZ50U+N}QnqcV%Rd#RVmB(A-qfq zsj8?ak7u{a2ypQ4w+E%_Ux8cVRRt>*3m4lNdD}Z{rKlH3hdZ_h7UJ3I>Gu)5d(y>} zWYXq2x$X#68hcmNs>y+ws%5pKCtM_UnA;z7t*BqcH_>Q6WYkE~Tyn48MJ8kzzk62> ztNCQbh&~@FPx*cHj#@-0>sCl%orG`gqs+D7EOrU?XCkL(KN3E}r5t}ksKLEv2`x^j zkJ=?q-Uh}gy%-r8Np}be#NO5KdugO&?cbxc#&;rLbapKdr;@{_c?`xeKxY1O9|+`L zTUlA@D^-*y<;d|c&I+5T+N$p-Uh5qg(CzTjx7}hRkda|}nAOoSl&wfm)p2YkY4S$(W~ACz?+|e(m^hyMBIJ^_i~=N6d+(*U+o``j4WuG%M9`bW2yCRLxfJtFOO%%WbG ziAT(dDS)#L5@pIb4=0L(SBmcSRU6|%fbKArVY>H1D_13+TFT_j&5gIg^~c+eXI@ZU zXHViuZ8wH7m>PHytc%7^@Ekw5+ZZ^B#{>C2^cXgcwnj$TL_8nXEOUO`5|}Up7=DUG zgcn>KvgPmHr;u0wfUFO#c}za3VG^Nb@J>@F_^XQsCTWaFaqXaX(UCF`|xaq7Kh)P2sJ!b^;vo?bRVu z=Y7gd6|Ev?eNd$MLFaXPx5kGJFT_h*z9BfMt0S48A+Lat_@OUk=#txYr5L8wFeYW+ z?c^&1KULp~Iz4+6cRpr`C{JRyZZ z8tlUdWc2B;CJQd~4QyOF+ zAx_SyWwsAtv)q@Se`g{DFET0#12Qcq$3pWt`%NLszDNqqb_qq~ew-$wy0a}JC?J3s ze4q5D>cd^H-@KB$aoI$xfY}Iu7K`jlNVxilt&{nR3t^ zYe=W~9QSvVgtBUleGzJ!LouSI;DqlJZ%I~P#cK(Fe}Btz%WH5vQh(WIMnt0?;kx0% zQ}$@@o2*WFo3{InwujTcN{EjWOAutZd7rV!b?8ccLqo}dX;#0P(TAUf=4<`wP3bp? zXX_RtrY}ea*MDs%?y%lGrGm1e+_5bR#gR>yI{=q5&;uQVQTPwIjPH>Qqz8@cMDiA! zzG@~|!FJvHMdT+MCp#U7UI;xi>e|X`AW<|VvO;uL)_2E=q)Ak7ZCXiz< zPZ>UV{P-~eSw9{msiQ7`uev$gH@CK4h1$i|Y~+im#CeNp4_C1X<>YqIL%wi$|I=kX znt&&(rgt@6ZhUNvYzw1P^{2kEMmJ0UU5KzN2GaytvTE&WOOZLy-}BHxUTiiJ3auy1 zuJ0)OQ^d&gcYK(nteO?_rR_*Dihgx8U4d*z5^<<6w_l^J*XLEQ+$8VeJ3sU%;dx)6 z0p~=phPMdvM783LKN4JoUW6;jDuRgq=aT*bB<$-JKVE1{K%7)aQ&i`lR*j4)Fq%@( zs&SS|c$FL_=)w~9f-NaMJ)J`ceXuSmB63O7`KAH%1&N4=;Pe)40Sw^wrk%Nv$waA#9qYr1~ZRK5WGyU|n{ALYf1s=thg?MREUVThO9W_6YIcL?zsc7eed zD^1#iQ=Fz-m391mj?v?0>Bv7x`hEKq8e<_Z_x@%{OSvfJOtofM$rp6Rhj){!n|4MV zz4PZiFPg!a#fQDn`ufqsxyW_F8D+PMEr|>yNnS&y7FIu^aA-%{BTn4@T~Jf4a-X6- zvd*ygU%r|zdj=mT_PO~j=-^ZBk@I_9_ER26`6z%YF;8Pnu${c0de;9qkUf*(0dL0r zn}HE3g{};+iHJM)_Vyx=4lN(X#jf;HoRv<$Mh0`+}AuQ?NY7OA%~Ru z>Dz-Ga0JjO5b|4;T1X0IL+~Bwx9yaGPLUjrzAplqHu-Mda({oHWHg@-e0dTTPqZc~ z-GbVP-stG*rLaO8?(zqs|LP!`C6^hlurLP2Sb4*4`r2LRwd7K%XjZFd!%;6tILzsu zwn$SIl@N!XQzVv}XLQVsw*O%K^A{rk3;`u{eYEU$slU+Ww@Ejx863Pal%?wV>C;Qt zRoH5acYh{&=SkY$O21sDjw(c-mOWL!OqE*p+-NSj7$#JIP9FBSub{lHZ)@*$;C+JI z|4;AlPaVp6xR#iD{hiT;CoZKgfRZHXgOvrM#}9Ck*_D;1;kc8#o%|{x;nJS!TQjqq zQGj-xP`KS*!kG&IQd=#>Bpt;$1Bwp*%75Dknar!`@pzSrE zK7FdjZu+}2U>qKoB0gR#N3AI8@86!mY<10o_<_`Hes^@N%%49Rw${z{^|87%-FM(I z;30n%7CzIgWLF#bF>0qsrWwd%XQvudCRhu4it7*?%Uu_E;n2U&c)9m-ekXiwZ=LIl zDVO;!JZE4W|J%MNmyymwIuidmrY1?WG64Lw0azoea(3P?tukMp zY<2&Kl)3}aojdLL%3Kuuu1W7aDs_`To}n(e6X-0Qb8e&e$-w5O2UvZhp`_brv{jY3 z<{=fe<}5bR1VQrpl#5T%O=-kaR>M2b5>(~eTf7dJgK&f`Ohs$CN+@R3T z=x@W`NP_D+m?XvOoqzMFfN?OCiZ(eQwwuzrUwL4B4YBt1i0foQ{-xD5)wo3 zsUy^|+HDQ%stA%rJ|(3ek&%(m6p0^>J%;Lzj^+JJhm;rLQ^?{Nzz zOThBa_;|z((|dEv^PPQjhV0T8+T$7Mm&lpu-453)=n?81vK8*{jGp8C`IA6A?RM?j zp9u{o%A8y_Fw5%venH@yzg7Le?KztMl!D)DxrA6Srg@&_(q%k0-EN(L6aAQ{Wbm1C zR9Mxw<388c%DJPDj&^2Vzl=rb622D}7G^m)h)rjNjm+M3?R||26;zGwVAi1^U2@83 zfEIMUdMODH4^X$coRi~@`#6&FsZSufUb^JoINrk5?JPtlbC9FzxU=Uejaxf08c1{VvIH zKp#7R3iuplOqYsaA94eLjQiwYa+iXG*?eof=TeV09pZ2=iXO1p-*obC1l<*CU9#3{ zpCgi~0=H^q_Wd?GB5p~?3-%0tOD+e+etHkDH8?dTNC)LTdE#FEeEFnU1ZVuAYC%a? zbL9{|aYsOae|hTS6W_dzH*#OeY#yC0NLyy8jRSt$2jzK3E&1F*dQ@LanRq}<$&Rd9Qmby7ZjVCkXLzh#yZQ`A6#n}mr{etmB+5l8bj8*W!ZFvPu>6yC++ zKB$Ma;#L)2XnO(3Ar?-T+W$>aZlI+5Tzux^3|Qwyz{`~6W#?_u6!Q;}lQ}y(yNVuu znk!gUz=|NWKj$m`X;n;w@!!Jy)kj zm)%h05Tu}ppKptkU#Xg?Ftf6e8EuQopXL)pVuYbORb=FXIB8fG2=~mj7Kv_x)sfe_ zj`{prp)9&+5oB@%<3g}PZ2r{zgr|f*g&@xBhVl`?^=yR?N4>S!%>MWH0)mIUT1&rb z+|J%ba0c|-+`Cdh(HUgHpReT-(!!YDPBbHv@P&niMG4J#;0#&WST%wWGOpy87=B;c zw1TzN5q0pjt}l?6Wg^n;y~S7Cn3s)u*3NQBv~(L6ZHu+(1&bO#^BV6$lP-hQg}T{! z5%oBk?+NcP^n^0k*Z!fLr0j%P+U17|w%Z#*;WLI0cK{0Y{rmfBw^^->UOR0a3!((> zK`W4vmFR@1OQx_y9p4So>>mgKR@~cytKR3S6U- z@YhFoA9i-B9~w=U@{shWKh^cx+uQ7uz3o-Hz(PVo0&l@_KQ`8BZb6E=!+*Xbl&{-a zR#x^QueC48Smdfz_7rnDbEDrwaUysbZx=oq+Ro&Io}P&G_`0pph;RX-mcPOnuH;37 zG!=u+m!)Q^aQWTviC??fM{}x3AMqA&1WlLoM5Qh|z>|U$sU=KCNZ((983q5H5m21& zXgW z5fWV%J-eRX&}|@bb)n-&l5Lv~7T!qj(SS~_+q!RVKC_6|&?_xSQuKSXw~WH14`i4+ zJxd)jUG~Xpfm`~QWr2p*!t@IUuBLO(hiW^Qc z<)@M6`Ob+TMIWsCmxNPY#-G=(A58=aJ(l1Ry?*~uI>H_-P*gi0dP zc=AET^`kpgc_yI`S|)(PnQsjaKXux8ezD|b8W1ezaV5Z_A$H6jjpfaZi2`1??$gOocMZD(rvH$fLi z?S#Y5I8f95+QtCD9x5faHv@F5_oRK!qqRA4UI6C_XEV!e(JaE$}XuU#}>)&4@&u9L)&WtJ3 zp>SHaw%S$N+r6@TFYo6|Of>-I@$r+WBKtE=QNuILYaD1Q``GeB@r5e$jU`hqVvB1o zkSY2}cN35g#=t{=FgIuiVR@tgk|$T4)1cw}ULRmy2A!Ho1Ner;V@sn|S7S5zC41JZCrN~D724=|ltnTR&>6YebH^XLd zTso%^5<q!r;zevF>Un)$_iRNTRfY6HNwfPJzQK9|9#dYg3R-m-vrbsgbvi@^8Lf~*fHzsti=q?sph0&&t ze=r0#aWF$E3J^_Z_q|(r8a0V~$!l3VRJ2A}yVthaoOb@p$6`w;Si;*4SN0dT2bLUb z_GQ&%NQ^4S?KCQh2uY9)4_qm|I5yMHNxK*6`_zR7tAG-$IZ0n zYw@ta^X=E<{QRCmQMNJYvjC^b9IYzR^y(octt>P>0*F|H(Pc3RLOMesW1Z2Q6u7T( zOL|sU=xFQR4o;~W@D4wYC6NI5vU51kjU z$edDmA0Q0C_M8s+<7G@H(cA6%p#X;QL+V%UUvJGG9xVvrV%etC2vvytDk|j!7|g;8 zNC_3bCBgSL<3J;N_3@o>0vu0Zq(tV|4g>dN>`yoKd@g1Em(%J!=3@7}H9IYw_UZb6 z2`v%U#}3$E$Ff*YqP}1F`Txdk319j2Uz+P`uw*OF`~NUrz_eW>!TFz8!F~DP7sN7T zIM4q}mfdRm`k!a{KQI0t;_!dxvbdk%Fe`UIgnnVTx%b74Q5h7V$~*JSL|eo#+dl{T z{A{xAmT;p7(E5Cw`HhTaxhOm9h0Z@Amj{p^v)r+*qC_n>P8h6Av3xXeD>?EM*l+jT z&Z~~KP*8wx8>&t4U;TO1y_U;GR<{0xj&3!*p(~yNALykedxWlV^HHVTdyksC5`i3G3j}Yi+z3l#KQ=h9+gsS z@~vsSXV3GJX}bR&Zo26_Q@nn5N^+V5q zD7e=X^XBD;N8rc`u+1-%E^4Uun^g}1536=Rqkd&PFa#q-j!%!-;5VwzZ~bm&;H$7X zOdQ_0Lr;i3E65^kUL1u5C<(h`t0I3g1D*vS2Vzn}InQdPodX9;eM6g})4{3!msuGC z#q6*pV8XHUO19%*L7#f<>vkTkfcit~*gEwH%`s!OVx9Et>(TDB;#_vA@ayjh7s>+x!A;FKK-KXJ)Z7WHJzC~+d_gIA35!8dp9_3}3IV{GEW4_& zi-~Y3w=E9G@jgKsp*xlH&31$1>o5aZ=wmnD{!}TC@Ng=KmslKBpQG)}WgycP+_L?SZ5T*a{P z(uaj;scKu7Cg_N`ZJ}4c_&5N%0v^6<=5xNY$VF5r-{% zFCOn=bxojhhlx0X;|?3jjQ}Z<&>&X&Q)lukIW9cc%3*%mED0)%>mciq1DIrUe3BO` z9O9W`^RdW&D!-3LMy*0HnPg^`IJG#Q+b&RzBda%i`W+;}x_Wwz=pp=-K8FXu3(sM2 z?}Nn%HvNR0(JSAz32+R6tKR`RW;{@M4SfY&&hOp~@Eegq^Poy^1*{`9w?fCWNPm1KdVGE^T`7JMMuQZB;N| zI>YVY+h(K1q2N=O5pWLZvJ~kMuFn8x?eqRd}4kQ2=jqWy+;CPM-t#8k=OgGz{&VH+^dH$8v4dOB@&|1)YUe zR34D9rqHlH5eCv;fN=V_F5RvJ=nA!O|9mWOlJh{4?u(@n0sO;dwwrx^urAaILb_RX z1&Gs)lxt;#IJy!EjEKEQjGouXMi^yDaX2%y{rK%GA~`HFXZfI%KU(^Ct zmf&S%8sz#99xSs#n-yS4!qZcl%R?5II60LhAFzdiukS#f9h*|_n19EdVPu+k>fIi& z*i}f|0MM_#zG1B9@Vm|=6nXHO+M>gEx!s0?L(_ZaHs&P0>3Fv3$9TYap${KE{OK_jes);b(vN+SZ0gJOdRP&T5ty7i& zgL5xmrQ=A}gV>`8^jEiT{R`ugS%K4qVfG>rw8q1tRImom2_v^O;7A=dK~jT@$be)N3|-Eo%xC1eR`4O!qf-Mwhx1YgZ17e z1VS2_3D-Ly`qXadVii@@_P;W)3y|Fw$ZL{jK(+u5fz36q;@@bP=)C)>ow&WfM4k+b zvn$`&eIzC6-xe~aW_5W4r~+%0K}&1vJKbuiW0D;Eg#90&BA~;WF8&WLH>l_UCL!Ji zBvJHy>*OXAlLfGk|8{n;Z;OLHD6jrw*uqg?k0dB}r$)dfp>wp{_SMs~Nbip=cteX8 z=yr94Eh6J6QcX!c2T6N})yvAAeJx+{Hkd#%RhP>bcg%i6~4W`7c#Rx{luK=c6Y zp#kuc!%MbWySM;3_F4U*LGG)>Jr(m~#Lf zogBzHuUxqTd}0{HegMDNK%H^rZyTF3t3l_d;NaUlg@%fq=KuCxT1N7`*aIcqE|@a!tB12S5l19_Xct7Ux{ULLx!$Et02~g8fz_Ou;1=W-zyYTS~gV+?VF$ST~mcC`T;APwOyfucI)0q zCAena#c2G7s%AA#*OB2>B_{NRbz>q>E^}g8hf?TS&XKn3N8GEDK zr;}I@B2(qACC_ZW?h*6b6m!BT2VAc}m<~qC)F>WY|7>c*biF(obg`g?fmkmGF!Y;% zgnM=WNneqlg*I>gq=vFST_yO--51}LS5AC<-pQp&eoIUQx;POCqC~yzCpcmB@)x(7?vZnq--HDikLT=gQJ;rQ3Ii?ANKiB886w%FISD8L^g@^6sOs z?_FvrtUg6dOJ_jr@&)C?ErD>cIGd$7EC+f2VSc0P!NgDizdaAJ1LN-K!h91x*A8l- z5s(9%3Y#&VkGJb0-dug`o)34z-__MO+4lm%YJ>cJ9_hE=#d+}Hf#uTF>!!i3y_JCw zdc&LXLJks^r%;7Cfe`Ni5lw4AF_^FJ5zA8umL{w~C|!8z=*XQfQ1e_l?Glb^;pq1# zp4a{)2-%!$;yT-#_OuP$X@Cj5ceFd8MKVC#O zmwzjYtop$7`pQAl+mQp%O&HAd52-aw6`eEVp4b_7`8v6tU4I*xum}$zR1ySfUou>L z51`_7`Yi6+e=t1mElI-m3o&;cl0R(FOAckjSz^*M7)y%6;dedy>T;;5;APeQ=Ud>0 z8mpVqL_#?`Sb28hsb3^5}IFn3+oqhq#@a|z`BCH^`{=)y!I{EUkd&v_|{QrR7 zOM#jvEv6?NWTl|ICBVX(;oda21Q3(wXLy`>s-0MlyW-@L2m0{CP(Keg_yJ&;;fmQZ zjOB3%mfldOGoS$DC~<(lK?aL!L8;xe+q!!{S8w^}RI%y6LrO|*h>dt(t^aIak3!@S z8;^*(qDG*lNbc85EhWaNCcvsrZH_MGF--zk4Emh1=B1ne$s*aXWgXFs_hqaiuyG*S z)P-NGZU&r@>)5qGnRl-7xuOfv= z^uL1mkBJNakHk=T^Z&EnYGgVm@%eJR0U{Z$mHxEjAzA##A|X3S%HMP8Opbd;PG1^A zO69I@YyXJcNWJyM-F*e;mrC%(`J$qQqygfo>V4`btUJnY;Q7RwfpYHT99GEHxZoxr zKvB+rvhph>_bwElR0b}zUw!Jdc`vi)$1$Y$X#NdfBI8NCEqt0TBJyTuwS>m-;X~T* z(~Pe^imB6nJz|pRJdnG38(C+IV`OgN8nj(mQp@w zr``#?&y;zVBd(&ty-!wB-?VTIha*cd@%`shvFL6g#p^^w?O}}Hk_W;;YWV0v`1iS)=}j4vWLw%Q?HR+9pe={yttq6B_fkyC zI~3)s|2}a6?r)!eR{@RoU7J&{wn8>~add!H9*iy(f5=mg3mEFZ1IK!pRT(CzoTm~P zH9-B#W{uZC@+^i-xqJJxPYTk;&+rg9oWn}%sM2_4rp>vH?XPS!H{TaJ%8E|Jn-i`~ zFSUFs)HyCJuc)iX@~lf!0=z`?Tep|AD~pZ8)AS#n7-Fp;^^QX-9-_*~Khgjw}s5)(sSxzp90&i&LYgoECdy~hE zd>3t5`ARD(sltz>&exh~8Q6HN&YAPft+Lp6fgDvbi%MmycH57P>0W}AxJYL#WjlGa z(ux>1`%Jgp+lhop{g=}e&=?lrw-mUu(}pOuKvTk|_eH=?kkb(3>>V*2-uqVVYE5=% z=n%zhe@VN}T~RzC?dSq_4Lbx3T?G=X78@`464PE1aX7LulwLeejybAv>dwtxG9J&0 zLKXVUxZk6fyV_Fpb{m#PWeq1h49K8qM!IPl8;+2RX%mMh~HhGxdCFtY^&9@5=Cn8ZEWhGDYJrgoE#qs z6)?Sr0~+eL;qAoW7nH6;sWYI&8NDN-$AKjd4js!96*t^=d|bZXE0knbcBhrH%(tYk2`+evqS3U=A~o^4{+uZ{l>}6m={Z&ww6#%dIq`DGC|v z&N7%rk!jB2WvEqLj9`lW8#iKO4u(p8X#uu$c{p{1vi35*O?rMXK1Cr>vu98&B9 zOsbu&w5_U5=zB(W4k%IR!_3g;Lc2LSB?k3RTQP=_QE76L7jhLR;|T?s#A2ueMa&uTV6Xe>QPuQgrzv0;!l_Ls1%=Jj28-hif5lO zL4#qM6@~vva`ksZ{erP+k4W zWV=~?{_mAB5@XVTMX1h!-~qpHGXo0um)*d*t)0 z*1soD6OgJpa77_|$Y)l6JyRi*A8Ho)Mnmn?kXex=d2de0y}lUa@&?zv;}I5q4Q|_C zbuF#Bgk$mp39e)tS98L+p-+wan1y;Q*LCdGNvro*k251bfLQ~#ItCb%kq+v>h6wm=rEk2gvDv; zn~Gy42mu_b4#jkpOggN1tW~IrnVtEkw8uSeO>2X(_7Yz=A1U=QqxSRO-e1eisFEbv zU3arkGU{QPeiX)0VLEJdBAmcCGa<|x*+-n>7T*2xmg0n za|HlR!KmbO8UvqPiXIgpBP1Nw%!waAD&%QVe!8Q-5yfK|+`q)L8*%G4#b?h79{rB6 zB3Dr-J~JtoT_z#G(@**D z!a|oQjbZAUtQ~)6BrgRh6*AtJF!Jo)TWSsfu(VjMpsRXJzMwNQIEjj0SG(x36dBh` zp=Qymh?Y?5XjBZyO>Fl5G6s?h1!!XA1}#Q?eTmx(9sfw;Ks_M_>RiA8xH7l7thr5>dhugy`{-f&xeQZ zogaQ4{eh@zRnH&*O2?opOB8gh3Z`Stj2)513rjmxyRCXr!FOP9j{m%ThPH2+=nV6* zK%|!L_%j%sC*~pv@oyw+MDjPLQdb``{Ee()Ybd#ElTE)yDoz|cJ+@RNG z){tgL4^zR&Rn74G%bi?6<0|caz`(I+xT#SJz}**ngc@D_(8xggjJDlqfoVd!TfhCf zF}=FfV2Q)crMQ0w+o_6v)V_ARAo+)dJYS(L6!s~{j9&NvjS=!`U7+N`0T<4>#azDm z4%77A0|3r{ovAmhZOnBDc?ZdsN#DTf?CQFD1AlHHy$9y;uv*NpiihXtjoQzI;F^%8 z{oh)EaF~Dmc6+Q=T$HiVHH~U`Y0Ha{{3Sf)9vQcAI{R?OK%}fL4aoW)XxBM_L?QOh z^rpxUM#V2Lq7ad6$ZH98t}|mc%AAO?%+bI%KN6YHT2#g;9><`AP-M<#(^S5x9<0i%?47!KuN)Pwl zT7q?HE`aEf6l6{y`SFH{ju(a88zFcepDF5y2_$IEU=DkH=T1Gi z>K&aPw-moZY&)!>J|l0E&sEP+30}IyY&dlX$?hUT|qR z&c)Zd-8hCE*Uhc7D=Fau{#Al!taQFmD$7;dDjuw#ztwk!##hO2v!apA#?+wXz6#33 zonoHR#nv}ttf>m-L@{ZFeLv12RmKZDe<;`tok3U8cROp(yfd`(OLcfNAU957W|>*u z9 z2E9`LQ+TLN*_ZI-P_+Y9{kBjubkhq6(_VMbQ;u zIsm{1;+aEUtnZOdsjL*~SrddN`wfA2DvsRgJ#j57{XzIDs9B4FEE2(5_fv~WgVSl` zUlqPzc#?`3WAEbp^-W&uh16v2|OK4tyw7zkhHbdrA&7m(Mi)i@m;j(Y0rbFI)#^ zCaau2daOBGnIhiTF1hv%ZK|mHDHf6JI%`2gJo(sBItiJ~XXr?|bL&=XsQ1WNg&jFy zku8Jl&h7q{g}58XQB*}YUL^?9-WY`pBl)fuoX)OVUvvb0icG{0c1Yh{PMlLSt($5! zGnMAQ#kj;GrkkHfeDCe$*4O#)0Sn}UB1Ug5P(Z_qzb!NQY4{FsVFP7&)Z<)88Gv2|P*ulE$ahXpP6O4~|tj~`U$Kfhd_N|+) z-WJx@rUVrYX@?~72_12Gyr$n7Ns`R+NS;=w@6ei^dv{lJb2NCe?f&c5*AlGg3ijx` z-vC&|_s6e!B_$;t_t9@BZ3Ft;m!0`DlQV1Df}fJ*<(Z3n_(z!MGqbS#X-0`}YsSv? z^EF$M>?G&G zjPIP72IX}9{x*Zj@UND6^-A`I^yC3zSjd4wCtaLqPV?W1Pg|~GPF3|?j^ZkHWkxEA zV@eOq#{&iKGAeumEgx-vg=UwgIPe%Flzce;;(ygI?cWG<=<4nL{{8#%=XP+peEz+Ud4LniZ#;EN{ zGU!7y@@28<`)q2q^}k-(ETz2PHw^JWvg;8P#H3F@EO$DN{O6-nwPp8qrO20CI+j2C zu2)r+cXQ!|$yFPbqaZg7+&Iv3o@mwJ{DAa9?@xE~gLOX_JoyN;AY$>9ds`_(O?d;2 zjQ(00afQYGP5p0X^cG07b0JM{CRk~U7zvb^zQR->ge)_{5P%x|!|GlIZ@NWKU;rR| z?+e5=trzKEO?nBXp_*KWRfaIG=^Ku6Z{=N*ojsP%*-Ii;13N|$VFkW!ev@VYSsy|- zfuZ|c9N`dd{lqlg-Gi76;{0psqTAU@N6+w#Hm5HD9XROaFm_Ce!BA$XS5b@N-+!h) z+zCi4HxBTSx)YHf{bQH|CN7Hy(<8;CV|kNDmE_&s0p5i`(VwPh)1DM>9KB2i;zW~RW5tYsgsz2~f1)=(cJNhe=y z`FQ{MR}B2 za$7VDK}j7Ptd696L%%8g()w6<15ee#I^WOWWSR`;jR-x~s69E4CHYekb@3`8k1wz1 z7gy=Hl$ATq4z;GDhPSJg&9^k@v~qk(5z|rYXNe;g%Zs_{bjqc+A>&)pwvHpHI)?r&T=`M-$#ewa`XR0uGbNL7Q=y_zj47r&rlo~7^Xu)2 zlT&(ypPzJeb?p|~hZKUw&cI726BjQ?#o$RbQdOLvZ6aev!eqL_FoZcFdSa?Vq4?cn zsc8PL!d&q~{xT4=Q5TKn2w%ns#5imfxDPJLo6L2suzlXyXZSJi5qzh~kCv5HJi_D4 zK*^cQq|lqomoE!h{@9sP>o+-<{5yuXiA*0-&(bOp&uZbU&~;E&J9AoCH zrd}ZIByq!-yys-{9Q`;IgO2|J9{CK%h*T}aQBrjE@Oxzb*oO*&3bmnjRPBKF8kf1O zu<)04GlXKE8A*q({F;my+8EQ5rIHvsWjv|DQc!@Zw)0MzZ)vEKbKVqKpH@9&IV0c&B^8uc3TiVO!MWJ*kjtEh;8A$y*Ylk>zl{ zW13%^qr@=vKHa>An2e0xg|F%^GVEAdFGU<3{@tZJw$gGtq)^|cpKYO|wR>184po;f zM<3Gg8)-7&}X0Z`}1Rgq{v+^KVDNYPm*?FyDc|Z`-W^6sUi%n`ANdIlxdZ$ ztWaiuV{8nS1vXJ8sCmV%s50h;7CH+GN@7}#_v%~M_>h9~R2x3zAS+3HL7l~!|U)B%*KD?*YXa3XA3zTZ^^1SmZJ|=7-`dD7u{vG|C)K--h^D4b-;%n)lE zE2j@|X52Yjc`Itl4_A7R{5p>Y0ZO_vyZC z>%K)MCMEEnPxH%%R=z_V&y5oxdUuyrec5AVZa1864B*F%|qy#GM!y1GrzwfP% zDem6KJh9Qx@Cq6^(;ZC69?5bncw#cSBULePIlLA?riOkc7rnuxQ7y8`W0R$wK(VuD zIYQ5LCNuX2Noy0!Go_m8}YCkZC`KX>FKGuDxNDu zwQ|}dfhsr7e&fobf`6YuY+o`i3~jR|iz$^O+j?d^wxie{H6R7cDPa{tiX&47=ToD~ zJycjY&t#;O!@1zkF5wG_e#UbFYa6?vZw*z&)?*hL)T%{_7CV(ST&vY;#%1kHM+Uz= z#qi#@e4ne%p}hM8K};U%IQA|DziH!Gj3-t-d9rDgaQ-Har$S~ZTS<0caf|w- z4Q5)W?wPNZz39*mIDHdSW;U?Zao_YX(9ZW;plk#o`dtV#iT?c4P}}c7^mc8hLYI_n z)y8e`ob9aAtO<8qN}`6Bqr`Cf^RonIcRr`+A1^c$weNNJ|EW>GOPTQV23e^J^|g1| zXLZ9lBfps57_W~ctToPPW}ORb*7VH^h)z@_yW?J==jB!7<2=v(i%+xHFmHvn{dd38 zm1p_0u0!1*nvH)pP_1kwMOiB=-{t}yhimK008+MBa(BZ}(0( zgSr}Ke3&js#vJ=A9m=PP`gNW1|2&CEPmP62wkBS`4b<-@JnN3HdM^=?JDBfhxYnLZ zq;@!BfvQBLQ@cg%yeQl%+oGnSp^4*O&#$TCYz42=fS3~T?JCYgiIvgyz3Hd4y2u`f zrp9KI<8~p1Y=aU#rt@lgII}P_ZaEp_!EW1&b2&~ZjmmGyXzDb91JN97yD<{FKD+QJ z7j09r*oAqO;5u>gS)X=$%V8m_uGp!8lD8U}Z9Y++SxZS65_Z7ilB}v*)Axb}XSil- zedw%%sZK#VkCBmdf2jAFu0Dhcij0$~C69=7?@HvT_GFdaU~19Z!8s4<)!x)}j9QJf z5L0X_G<;{P2h~% zpUmV~+JysI^o{WfMW3%ee(`G05Zdu?F9Butyq5Nq-lVt;fBxxN{pgtXtl1V3A8#cZe* z*nXyV<5Jw--u9L8QI<3_i*DJ?o7WOb3Dce)FzuHT$oe_^)l1m-h74QvFp(+c5+!~P9xRFLLEa*qPzD~$#djfHU-+Jl}zU1!no7x zLsIGQ-n)kpIqiOmvsPqvxGiz^G)r=@VsadPa6(Dx!q;$x@O|p_g?;dY!_XW#T2I6| zZEUKhQRmkrZR^&`-LCUhRlOJgaMwn2_61;5&!gj z(uHGoZQB^;I0>veUVAi$2{pvIU|LjCFeG>$fL`5w1?BGMBm~jZgoz-^5M3gA?|n#Phaed(y69stVKDkgLG(HVK|~)0(fgb=dH4IB>pSQD zu2cUw*SWr2SMnq=9?$bD>vykv-D|D*#fhKlZF7mm6ug+OAsa$Q9lbtxM$lNw7!F;& zAQ$&zY+rStxtI3!n%G<+YJroh<9%uzxtplw(L_F{b{>!-xmZ&lg)T|0PL>kDH8H$a z(4bv8jldkYXz|4xN`!7(|FuVLP6rYkcMYmk_sT2NKFcFa_9gp@8!*>}wa>B7a3Oux zIJ9u$?3@&zH#Amd|0G!8~u9V24Wxm`akb}__tb0^2kSehcIWk)3z3{0hw^@49SS!6Lpjk7e*ySP!Wc$RlZ#y@U+ z7?AaPyWQvddYg%a7v-LOQ|fnN%}$#nllMcRP^*=GmGGj_N-w|1rV+^f4A)QCe48@k z=Hi;7iW`niOyoeh_s2-~);b?SM=sE%a<%CX8+e*te0M^QHOl= z;nvva4p;o-9wj84WnX@{7Dfjuc>_c-bm!ImK?X<<6;;)+%@k$n@dm0OGET-Vx^-WY zav{XUM~ls=JW+g9I0qF&*S%BoUl{p+9zr1avf^?1h86ki>z;$9PMZ2eDuzpiwtL1; z%Jccnd;=6n?N`jZ?y$*h+xW?inX+GV)iS%g#Rp(qC01PjAR`CTDZ#tskyo)FK4aFF z%HlYYTb;O=2L0Qvno>OTHcdl^eAWbyv8@&lS#3Zywx%?PYL3kPA<>QgZM#}CLgSM- z54|cZ=!@wNg6O1BcL)uaWnjdyI9z4yg5K2S;E*I&+4!)2N!EGyu2*ck$-$LZL_;(y zOoyZvsGsJ;fVfRtGjdps}rtDAv?Uj zdCMUigbLO}vtlj!3%E*|L2hJ=zMGboRuRlsZ`O{yR`TvG4okv4EBTfUCk&jv1 z6Z%Mvxo>4xmqV^Nw@qj2cJWen7-iiAm&?u7lC#YOb|V2-ppA?5pbwMQd{W{HY16I9 zcicGq-AM+-b?2l~#3|3!N+?aw0^K&=PMrcIAI(M1S4ZXN3t4yNE9N*nKg-S@DR0aH zcvS$|Uu{YRbqRk&L;BaR51PE2bawMLLZTl;&ycb2PEyDiE|h0xZoc6W6q57mIzAASbCGdkSU`)@ni2KXCrSgy1>~s-&sMcA}B?67i#vg8IM@4G8e_>p`~#`hG%c6i@Q=U0(3T5d5wB z{J+0vt6G#tVj3Q6loe)R4BIA?=YQ+LX==g_^m=Q!C*WY^07V5>JU=q$e)X%H`CLgV zM~+qH%Xl4cdkZ`3a)aqym?Aj|mtI4lg?X)oYu2kB$OcnLK?Gw|lcyJC-nYq(kaM1wz)#UdChJOtja(6|4H@mx$t%M{KSe?gn#NziMaEA{wzENhJRO~-s%8j`2<<-yQ*Xwk} z5dD39x&%qYm*e45Jy!rd9j=qE*?ha7h5ow#e?p}PVu-*X#V;+jwQ(wY0#IP4x`0RJ zv^oP*^y*L1x?e+$@Z26dO~x7;GV(--#qUSNl$_)IrxpO`2#`KekIdq@`R#&T5PgP( z2*18i>kG{~Jrvgg=;7Fqe)(d&I}>t^3zmi+yNREn-)O=^0=Kc?nI*M94$N?JgB-R{Dch zlkVfO3hY_9T2Nd}h8**8{Ys_a85RM(2h4TohqXDos0wpb)jG*rx3h%nZ&=GWMC*wU zMU`tE642gKQZs&v&{zS7@a_(C}3gH;(Q93U;cdyAiGM zCuR+!WAk1tp}(}dYxMV;<4HMCmRhN?65Vo7+Jg$=Q@n-MF$7}tJ<;40vYUF^+cxP3 z>(#NP4h--;-Z#pey{3QEHcbyflODOk0xtv9t^lz6&`!WR-403|=*E}KzK-8{FNR7G~b2pD-5saq#4Zx0`kLBB9N)xs(r+e&s@-CFNCFxwDwo z-mSIBs;VkF$y2uEuU@e>6z#HV%Ri!jFFE`apzMQwU#rr-85p|FtlEVpUsd^VPG@=J zb-3HywgRi5hLXqJw~i#ggD9fAn^{|u;f3m?6gbAPJu~Ce?>a6Vz}aOPS$9;vtdx-* z8%ffXlN*BgjhkMXwHsz-*tTD3|KYK&(w8)}wP9va@~#o#T+2>O`h-Je=H|+AVX^_i zJ_4;zPlvu=vFaH^CCa$zfoP-XTZz|%Bt!uFtCS-Lub_I3<(JNq0L5 ztW7wok02ca1c+L!P$M~6+1b-h!{NUa%}x)a0lvMujdK8MDWATb9pCK<4i4@teJOwO z;`-gf(e)~DxK?h&xHm=&=wq&WQ7$DOlF0(%pYD!P`#dhUR3AWmSBJF|%{QLq!1H(( zlLQhGOVFw5y|=_B5G-^)Cray;Y%|gQm|?Z}3rIEz@6r=OMw#G8psMuD{JL==n|>k& zB_$^;ZXTgbWXn7{mQMqlDI`eF;xN3E+I@pA;4pbi93Y%k@XMRjg?X|ARl1%h%Yl zL2?wzE~drp8$u7MV3w7^{oM5LmhD5AHj%l5`boogA#|b*t_K~qSqMb;!fIu8UdfS> z{nmA~7QsOh$=E4!>MA)ZJF#0JA}41wN{Y`^+w#wr+X+&_^p{v+<0Tw$%Hg|>_niTMam{8(LXY3XO>>7BbQnpvy! z*6r`rtpZ8Fdtx8F`ACsAc{@8hd-Z3$aJNH^BRfQxRpKkpL(s?WTcP1eVI#DO@%&ahjTWhkl+4%6B-(N zJhIF*Bl22nu5OIy{*PpvcT#>6xxRkPy!M9U*UL|V2yQ%Bt<(2I)pHCSiM4X?$&1a#ivvbX*+6et~zpPG1 z>Iqt*4B74)7?m^eo@TeKck~KxJ0%{zme$^W29sVqBZ2FbH+|0qdn=|?{>Hh*)m04$ zp95vuanP{8k(Wq>htOoN7u;IDr;GB<%!O7$IpXtIWBL--H-Bemz7WI`b_RinZOCC* z`1(>aXM0w(VJJr9vXtjkw%qJiEZ20!&kL8{&E$W+AN5nuR%Ar^`9Gb&y!9Q2sxC^) z!Je0Ym8P9-?c>g{2NQ?X$ggALH>EiXufPo z7lH_L-(KF+*+OvOM|oAJ`+{SoweMm=RW|EmD>UNwOAZdKTU1uLN6!2sQDcjUHD7d*b-FF}} z!&(b}9z6B4t*zEwMvLfJO&dZX%jiCla^kdUT1nIJjnI-~ve#3j9)@2>@%of^&& zBvtzg%_87%gVbYIma~sGB8&T7qF7FO4lTaK7dL~~1##mv*#DSs=#d|0^sto%Ws3yL zWinP*#ogV#kVw>l-YCWMH6tto6(r-cXYX09-nxE0W!pD|-y!KUS_o{efgv-m%EIbu zXL0*XY(Fo8qZMO@(<-C3;o6F1DpHx&?`O4DL24qGn!r z7jq$#lIHlei{7gy9xkF(QwRN(veXVzpm0W3*&H};H|l!Q#O^Xd zJ6|u)eV%*wXxq+~cW-S-j26@kM`G7zenv3R&+fT7Np7TYH!fob`|1NDBah^@Yg6-L zXNu6H+7R$g%y;soJ^5t4+(_d>@2B?tU_AXPZm0gTt);qJy?+r2ns*jt7EKo ze{$7s8A;+e%oN_eR}Is*UK3GY1~AMk+Sc0$7uOkmQ;`? zRDmC_a%!vW03*jcd_5XxBrAozHPCZ7{I7NiW|DvQrrzJ)_uYgjyY(2;uAK)!OB66y z>(Jx|yVKgTg2Teza8U>Rl^`V8v&vqfIY_G^Ork11|L~JQKL@Ewk^Sfi_G_NE0USiw z374UfIOr62{;K=-+NSMwh_Uxg>rJ_ZCSF#6Qlh;X$~R8Si6XxL{4M;i`}pc)EEKS} z9xRM~WZKeS?2}v_FQN&`+-VL0J3Bj8@0~#CmV!SttU@m+O)WiC!@gLsi!raCwd62%=Q>z=#*gydP7BBy`v#))F_D~x?b?V=N^2=N`p@dq(bt6SvDsF!t)e8 zXiz!h|H{_RPR#7b#TAN#64W-)HB>DucS9RP*G&5O63ST+UtIUX!8cB#nZ+JkMrso3 zT=;b|)6E`<0^iG9VJle~Xzuoh8Ud!4PCDol9pnobF6#)XSV_2;Fr6 z%C&`}fr$dH&F)*Jp}M--gv~z0_vw$PuhX5p%fI1N_w1$r?Tgeu<0ZJ(J^aXjV-GBH z>=2%M&y7e}Q{FwUV_&g~LnlnR1G03@!(tF3bvX?0Z*Fw*PwU@?bE7LG#Uyt0M{b`C zLPmVm-JKr#2kFi^{WE9SrMws45o;eD`fe2+JIWpKia_B`L02m*uk|03^7wh&!4e^Z zqAQ6!Mp7Z1oZXp$q3yITKg!*=aJ8xVZ+4)3%n|)4Yve#c^Y1KY&qJ_2yy#fnUBsQ& zr+?ki8c{?b5X@Z=uemwga!qshnXtU_2w1st`A%`5UQXRGe+6^Y3a8h4gJ_OsMfur#JT~G-5ZWVC-&3HU1`GR1yI`g9ta zhtfYvC!;>-g~r}ng|fXl!6*1E^LQ9)a#RoOvtAPSk8N>cs`~dM{)>Nl%+B-V7c=#r z(X0Rav`OHh0J`G~uD_X0{GyNq#0UDTXzn=!)8Md!*e{}QJVPHycoc1;pKnM$#evDJ zExIL`l|CWsc)H&V&c6Dmm>G~z+yQUk@S(Dt(}a_jYeRcuhgzuvBS1{Q9RHV2zn{Ea z7#G$y7UNAzJh8YWkeQurnP*7S1&>Y3)wTJ;{HIT#{7Yx6HZUe#GK@77qwh0M5#61m z-#^xpuwJ+@?=&+Xm38|#xv5TVAfeE+R7eW>JMINN$Zfi!*)hl4E;8=q;&=53MuNlB zscX`{**3lT0y;wY=8J3Z?7kMMxLND8b+XZKE)$#UeP992tD4k9)HKhAZejG`!Q#5- z%%?eax{M172Pwf^m4{|w6!)S$;Lw*WNM~h7;Eyum(o8iTU!@bY%zahr)Z&9 zYhZD4xgGMy$R(P>besUTe9^IukCW43=Vz}}o$dzAsgk@AVL!|m0n#l%1<+4Uu5pAuWebrForsIbgG`(eaM%Ewu0;zkw*gSp zKTXnsA?#7CD$gF~{X`~uNbFQTeo-?2RS=|3!KE&Wd3sm7BC!Pe-6bvBl1AKRWxuU# z{N?2A?A+aK#f;fkbLZF@I!7ORO7=>Fsk4ud?#&0WP-NQtBh%eqj!8>Ak({CEKfbuw zUE1-9oZ&-b8Bnn|)}Vw`7#KQd?`-9DSI|rp6clg}V4_DAz*W6}P6yuzI*}V6bTD~L z@CE@_WUoZjT)TGdqJOmv{i!iUe)aZrilUET@hgl4|3r2|P$d#%exSF(LWxap?1!b` zmo4kD`G76x^1m-%E`nR}1(*~rtb1q<9eMKjN~=KVi>dq68JlRXzOP?p9BGCC#=7F% zURoT$8yz7}i&~7&=yTP&&kvtetRLI@_*g`@|Kf;#vvXzvcoFo8JsEQrlm2$<0pPI5 zrE0&{)L`NEQIkFqbh*2r7SVoCUv<`zQ#6UHk1JpMACT;14F~(#7SxfV17~jtzW~(nu|X0ejJkEiW&q834|^( z?%n3Y{gmE(_h4m@aKB%7#xAw4RuEjWB%=?kmMx_dczb6!!x zI(n%Ld|IHtr1+p%T#I>V;zAYlt6F)Q*xgWpkJ6_n@g+rd46;uK<$YoA}{&2&E@~MZ6V=$?9?V8b>yxf6Q}_(}90zKYqO2IQ>ig zQ8TLW-^f26>{$HS7`cd=#?+3FBz5(x?5!~cIQ-8LP9b1KM8IQ+m}p-#*5mdIvFw_# zD`#Q3HFh10k|qXx=vye^ZN0YB_?8YY%2SG`x0G;o!Je=?pa^F zNQ#L_GmV=ucOQrySu;CA&Z#}qFhqRR;Ct+hOikmj6R&RZ_JNwBYj5vSI)Co4#Bc@y z+iEqMDaa?p%ge)~ee4V=BTX?}8AFjbRy0$N@y>OV!-Di-#URR}*lDRGSBS1Dx||C_ zPTvxZ{chB6a<${l(X#sDD6B!paick7Riy9DN^yt5clr+>V$zLd%d_Ep49{!j)m^bh zxsLqcHY`6INzR~;Mc~Tk1J_-0bq%G9$W=;k`Q4KBOx(#*5ad=JjI~q#{Ojad=OH1 z5LlB7iu|rDyqB9=bV$k7t;*TcmZa(UCF)?bw1=nK!*`RM>ysmMNn;|-!!d$dgHmEE z)aUq>0bvOILhGUo_)oel&~?wbGeI1`Wq9tSs^upN>!N_V43cxa zWi)MrkVRQ6OFJx6ptfY8hT8S@>LQa=!@}6)Cj=6YT+0r55+r6(_t?w3RR5QNzQ4?@ z_-QM9*BsS`jNS2x-U{^XH->r<9q&KvEpq6+lPFsTxu_3JCoRFR#x>}I?22+A2nTbFOLOq@AyXXhKKX(;PG`T z`dAQZFPjtU^hi!2avaz0J+WwO$}&N!B*=(0EJB_x%b7DcAYLg`9iurKY1P)Gc5qr3 zQ@!2iFCjM{ea#9MjYs7_I>x%{cL&#N+uqGLDrn~~iY|1g4%z7D>k~7@?fau=7n!;& znraCt1~NzZE%HD1SAR10&ojz`+yJh=WF2D%EKUcH-3r=)07DNZy^MfvkF6o_>#jhYdmt7uTXyf7zOy6+HvRX^p;nzrgD&;nlp~{X4OwsKkby446j^fuxjVI@2z&$N@ z6R^{iVKuqAyvZD`&X8mA(`9V5hmo*tQ8+943V3S#(- z(0Jy(Ch;D6IjANH@@$?sKdL$|H8l;D;mqAsZdE+|{e}1Dazyy@jW+b6z*YhzmtUl^gM{k=zO>lXRGXN4bRBtLh!lXG3_8MHq~EL`<@wATbE=>8?Lgl@*Ll?&i*2=3NEZw zgwD#q;&3tT`$L603RbhF^RAPv>`f(I)+ECL4|=9RF?#d_q-JQQ-BD|Q-KNN|Ut;@< zjqA%DAbw&w$%%)035{9Tk%pzNl7{v4v(7V4wtxW|=o|?S2`64syra<2(7?A7F7F}N zuvn`c69swzWak%rJr1%lq?|lsc+}3O-8p8A3AM!xh6PnrKuIEOi+%}jg|E)|UDm59 z!$FiDLNW|#bUvGaPEN`&dIy;mHroT%aCw@S6K?Jl*yiiCbdiUr&bbfEl_%^o69WPI*26uZ3SL+a!nT?OoagIUY~emOEgB=q)#iAT{26eDNz+%2YL3 z68G^1ZP4D)@vm`OT3Q;jLq%3k_LODQPw;&M!#JcLN(#imD`(TZWeelHziG+-Ph`A#I)MbEb*-ctl zyKGCv%*Fj8HIF}Qg!QSl8B5trv5<%K0jti^H*xYFdW8d6{j5MpbI$>e@Upyqp!uqNZJUoAfZ0?28biPk+*MX6(AR7tF}mlm`*#)vhScC zvh}T0y6Lcn%`l8-Nl8O52QX?zp4gXcRYMw}^wA&+QH$)lj29g})ZG2(CQ>QsD`Gu6 zn1%l>*LV2CIA*u(=;fH0tmcVpJ5}yga=Wf?jeJ**Rc+pV_L%oRRwv6G(nokSnVaByMc%NFQpR?s@`f6e$!^Tu`9?VSA&~b_BG`K!A76A&ezJ#PlX}hcb%;Dfk6o#*4Vhk^CQJ{Je8_p4n(=do0&d(m$FFsn zWY+iC0S^mDKf24Bwj4`9T1!BF9At|$CJW=~;WB{dbe-{?u%r}9u`%eLI+c$l`Dgb7 z)(OaJ@E1XVW7^o&HMkf^+ciTvySrs1Zz93;a!EiAgEt`*S(~qzY-k<$t{|a z34|udx@w`ISWj@|<7fuueeke38fB?mSo=hO3;aF%jba^RZQKcmY)#@2sK}zK5))^s z82NZNFeThOcfZJ5s2Y}fBKry@r@?a2PdZiVuqGD69Vwa>516F5$sce3tuljQ$Gf4W zRsrN)s2O6seu>-Emn(L|(|C1bMs-Nq16_G{O}LNE3a7FlA#n(2Pi15KS!>d?_)1qE ztJ9Vb#9<^T)q1|*1GCLTb3n<|{wj6}{5ydh{fa<(URsv6o0#2V&P22R+Y!?!iSTeb zsh>CCp=ZCfG+zvP@+gqi-LTKk-<*vIf9%nAdZ4I3SrY2Z1PV*MhFuStQu$D@c)Bh$ zKJF?yGLv>036l)5QJh6%OjJA$2b$3)M=E`Jbxp{hM)c+nr@wxU>o2woHL_jU-rIyJ zYVr@KN49?~2;~`+Tn{-R+>tA}#0n-#d){3OFs$2;zeu2(*P798Ay=B|E7X5h!fY;6 zGAH?UH0VW<-d~rq8y*oxLb{Dch=g$rOmCo=fa~bplyT#g927^k&&2EorN1mOdRInA zdS}hDbIfYfuE94^s$BoYVb=Q~UU%EsJjVWwpa6DYrDwnn5aHd!*Q#|Q>cTsx3L@z2 zd=(egE@&>RH;YEk5T5Lho4Tw?jFjwDyH?ut+1`uUJTvYbV?)3W|z0^%Epk-;w9&w=$~9jJr4Cbsv|y!{~pvGNns`woei{p0!ekdWgfc^{)e` z#XSR{It;!yuGo9lj-h4;8nNLy%`Yi|$R2?Z*iuXShsf;l*}oO*ALVdIJkJIm<%}hB z!zU0m%t8Ouqy3XY{#$bYA2F`~nzXcVI}LYhD6~e%pch|Jy7Pq&Ml{5=fGFyk)U|BY zJnO^P{Dg4IznqiMig4qn#cZOnv!J&{0k_buM^{fJ9{sI*!fsb2e)Jy>(m@EI|34#Y z3ZM}^9IiN%_n)ozw{Rymt=`n_r`lU(zqqM?+t%_)PtHE(nu~|h_dWd`m(H}F@=}E* z>h_xe8OuGww|!sV?tcDPswV^YiTkPNl=Qm}2%dbmKle|nhMwM(nQ(oOAoaxYc^7l@ z$tADYzKFh!WZI|%jpomYu)9egfTBYT;Agh;?E4dexE}v|0F3kh_7`5Z-eEL~HoFi+ zBV7zm?I6Ov796lL2;Q5^p%Q4hN8s98nn&&bF3&{Le)Z9#Zb;vS?Ro@+Fe@&01qj zce!_6s=MCshz&C}_X52ACcp2|+p%-CF_}GH_uOu2XZMgJ=0t^%Hc1wMefn=0?p>hb zOcLu!xTH^F29vLPWZPiS?)j4Q5IyA@(j}zA5w>^kwlwu40VPjhP+QVd5tlT>&fZhk zDjh9i2u_U_F|*yfAAyKd&wxZ77>0zyd)rO_fB|B&dNkhvKji!S);q&B{;6rv23s9o zx@GCYn&r}q-;+HiGLs!za6Un7em3xN6@11XM{;oAMtkazFQt{2uvVj_o%c3TbBlM9 zTvc)A-#)akb0n;3Fr0)56`oVU_^u2I9;=2|4e066us}fT-?t$r+M1V>Jlto-E!r9# z@cMDQ_C`tic!SsZVdr}jBzT97{QA|CD@<3c${y+Z^SH5;?P4Md=K@_87h zJReAv^tj<*evf(=)11&BHNKQJxf}XScWI#Yqj`gOB62tBjwq}N`e;SFU+!kbX@XTI#j zA0Sw+M#{*S%Fht1laTBRC)yId*J+Glk!22}Ci$eXv2PU*>qi2%JIZwy%fg#m3S`-_ ztPMe`Gc65%t#sqStkbmbd%IGsn1^g)NX+v1leXm8Guo|fg3vlATxLa&W2jPeFi`=$ zJ}v4zgE~_9^M&kb;{CUr_<AU!&V2Z*W51OEZ{rU|s3zoy16(XCP z$^|>ju!Xf1=4(C{Chd(hlbqYJZ0vZ`?X7mNtus8sWi!F`UZQ&2$c*(^XyWOiVnGMF z)v8DzW2E|wlKNRIYk>f|(Zl*6ct$V0mtlF5cAA}CRZ=Q0eeP4Q`kPd3<-DHQRBdS% zf71@$T^J?vE?ugl0$7n$@l`$dNMzqfh6gNs8n0@N)IYBRQJoTtIv(JV7Z{qiFRWHW zJ<_zS`{RyB`dZ!2*U%{X+agirdmgaVmQqt{p`Y86b$Gcr-CF(Y;bG~8QAB@^^PBKf vwAH;3VZ2FTWO6h|Tz*+8uK%;MVf|pKrMTAC6_Y5qDFUgWdOQE7$;K#Yu5@Xpk2T6lj6q?nR5YxQC#@ zZ+O4E*7xtdSy{=_GiJ^O6DRVxc~PST<3pIyq4O15n4!4(Ma)X^Up>>gHnm&db`<*4EYQqZ<(Zv|R#a z#Pnz+>uGBVbZ~Q})pc;OMRRf3rRC+PwY2i2<>f{dc=$#6MMMSod5~~wG&HhRfSk0h zZ_eSekFIY2Vg~}g{QP&>TP#w!T3irMnjEn;;J~!F2HHzT3}$q+A_7AxRN}He5(U7Q z8Tvl6kP;q5Md8H6JSox!rNiJfw+vP zEVPTrUOryx{H9xiFZF1R^A7T+A(8~N5@3pWZ z`kN-gF+-)@_R3Ck7(f=U9$Q$~UT7&UpH5j**Q;%ZHGXxY# z_wxM|{#*ByAa~(yy4z>L>DS9@G)Zs6)b0dN;#d^oIu;gi_`uI0+R-v}nWB_*ufjT| zw6%$%ji`S8;!!v>-hllfTrb!e8eJ-tuj7miw>LQO_Hl1%!Db%KraC?16G%^5imnnM zG)$KY>=4|@I5vq9d?4&q!cX<$94_wH+5!5XT^IQ{RMBdd>z2(pI=fV16SUi>NXW0? zQuE-)R4)w#8Sx*zV|6jjF^X?oFBmfXOZ>9*tyHyIFH+9 zFi~3UQ)6z>i-N_@@>Ax|h@Bngd4JeIz+c)v>0hZ+ zOQpS)eVDql<^^qm_yFD`-CU009KR2r3Hv#fl0Nsa-+&iFg6UijN14D1Vd~7B!=(I1 zx%hlwrp21qeq5A2!Ys|6SvLlT{0H&b5~0tL&Vj6l$ z)JO@krr_`>nxO5T`={X8Hkxytmqb)V?!3SIMQo&oA%Ppd?V?Br|o_ZciOR`TvkN~VbvQI^CJQbPA!*Zov1byme%bN zD0*A{l029^WVJn0_{eKybX1ip3-Eh>!TqocI}0{5FkOg+A+;>pfSw@~!uqBmOO#qb zjVQ8t()dSs72hC~5zsXy_!Sv?_|asQ7x3bzGzmRZonxW*2by5IMJRC-T@#YCQH_OT8{=##{s) z(eL+dEnswViCU(iLg z1)shC)QY)zn2P|s!7L&u?mWhv@~inKuXmtE z!Do5mBQ>$xXoL1d`}&-8w_ARkIbt$!T^i6zqz?~pLJ>*1EZdRUty{AL-X0%Vz880_3z_q0`>AWO zou-G(y~b6_Ys|Vn^mR28A04eI&E)kn8A_Qs*i9xE^A~=6Jjw~=Vw&nHs7ofN*k9|n z&)E!gB(TX5isZd;HoBp(q`OB_uWH;h!k-Y52VX(1PD2P>A>Ekpr-tJV3dMGP1j$&< zJKcu)VP`wDbP!2+cgxOlJs;+!^B>eg+8WQqk(yIKyz9;7c2< zdCg~!%N6qmdaylTHnRs@j0i{SRK*yVz{O!?Ct~3;on3xYA5Ql3$f@6xGlVcLa_(m^^U{ zu|HEDZV-EMwj-8;ZLPSb)uIrAP|xFy)oI(#5cEQ)#xr_J=o<~9x+$31+nEkRJ8w05 z%I#s|X?~v7s*&3V*XpllG7skAfaH%+E%Jc6E+2b@>R23dW8L}g{-mN{pH8=0_vL`F z8@mC=hJq4{t3d0{iVqePs=;?CR`D~B8^mzrT8(l8WaGog#T}CN+>5vdBdneh`5-=1BT|)(jg!5`vL99fjdBd~NuQZK+ zr=dY6cxUQ{ZfEny@gBfh`^}T^FX2e9qYb(&A(t1SVDPKgcVBr6%n4cv;L2C<*JdOk z__hbwxCo7_=ojrH8ug`U4zH7UbI&&Pc|?%w!Ot)v-LESp%|nF3@UlUgGcevop}Wo* zDL26y*F-Xzj^*)kQTE!8pGbrq&CcCcpFa z1#g;P5vc0K_q*&@T7p}Ef#`9qc|HH)xlMy2G9Gk5Qo`oJGJeU_z6X#c%>M9APoD(i zan~mQq8`Y*5Hz|sl2aemBlk{vPWD5S<)VrXdI*ig*G`L$%kMP$`e_G}zGP@_`BSpC-_{7dyiDf8$UhcQ zJ9j)%5OEEr8|GEgj_|A4&_*9$5V*4J(_mm=AR-05Mzw6XC&~WvXdXs(5Uu~ z-CD4MXM;J_)bz&#E$?U-!q0@#r|W1k%&mmD)1NOK85+Ro?u`cH2R@X#zd`to=kSp^#k^Fho@>+mzOv!^Qc6#dW0yUxm! zS@izdQ0Z@b_(Qj8vadbXz-czRcq+`61!=ERZOTxEe`6M~CQX)=qzZ%BvIz#*gY8+3{TGe^LpPiug%JGUYlt+Seu#1F5Aucov@JB2)gOVk?1he_4m^nl6=j^dCdAk zGBV}*Gw+ORmVN%v+<*9)m+vDJf~}Qtsnx3 zU_d*2SX?oxnX`9j*%(lahc*me0i$IK3*v$tj#j|Fth04r@f{k+9Ro1{uY3$#zkIRF z5W>U^C@LxjC=J{aSo-r0H3T^rx8v=YZk|aX;akn_B%79oqHEyyO!f8sYwTXxsBUEzj5znAJvV@&u@Wp(ZZVt`CY;jL z-C#HCrYC4HM7CzFNs?qGXS;_MQ`A7w$g|%+$Z>6pkr+>1`o3Db92K=P6*Gk+7T(jJ zdxs5?!#ELm_fZ&LC6l!di*pNdOCh0EU;)R5H@WJV7H4i1K#=FgYB4h}Scva=*r&+E zcz0m!_C>Bc?N!*WncRYtBMt>SyNW+(e?Vw;e1zN02d-e@WDWlLbKVI9;EC_q_|N?j z>?ZDN@5Wh!u1yn`C03EfWwjFpMdl&4E1>xh;}0ciudQcEP;2a3TN{ePc3x@DF4z}BI;}E^`g~MD3GCLzI&w@Zve$k;OriH!1Nl!7&)^!=5`8vcN-NOU%!O#db3h^j;i4tv_Lk;_J zR05Q#%HgPDbuV z?&VQ|&FU<$F^Cs*R+_@0m6OC6!*_jZ>AX-UrU>0KASK;OVbddWa$;X`oJ_cDne~u3 zCfXM|9N>0C$wOk_$BmaNS{c$cKbR;X-h$>XF8pO{G->XIuRwLYli-oQQIiM7sw!DH zDzlK_U{o153{0A8jIXbiYp#$}P_PgEPA^e7XZ!MHrSCFM@(nnvIj>>LCELgqY^WpV z#Ti;5-5JPZb?h__CX+}&O(~`1-|VCPNc{UKy6*mo<{*uTAi=LYJ7j32Tp7~6IGbd` zK$1hzi$Q&7&R4^Hpfh)gJ1d!?$m>`u&%^7g?}rnS-r0@zcDETX zzl5)1B$Ybqu?eVE`Qhr01=V)CuIb^-8I5&>9*I!46(Ws5E`KVKJM*)7JSPcI15997D(P zW_D}q#I^Mee^0KgZ{LTA(hyLM!lE$A`*3Uhmr4D-;R6?HA)1A)d}zb^m3H%M^Bft; z@3|zbFW!Exj&$Ec2CGx8j-yn6W{U-&(Ry?|jWesas-WJaeW!cvYHA*~O$d{C6VYjb z#yht7N29H$9)$OqGsj|ih*7Se;ejqo_)0N?fV|^s>R|$6Ep{)ycGu@IYJNsB7v|=< z_uI_XL_$8_%(U*i6zHKdq?SW3iEjlH;iwxg8$#1NG7@(uHV1V^P~MJVmIO|~7B2Mq zsOzsjby`^5exo5n4E8^ch*~y(SA|DVa1L)Gv^av#@t}#zRLythDm3{ zSa*!Aq@}B?g6X)C^CC2zS;NX9rw`7{m&5?I`K4MiZZwcv+rk=eudCYTKbf2bjU9wY zjx+I|@Z4br;WO0K?EZE^)7OV&NO%)DrpDl#VkTsi$*0*$98BhGGpcM|AHqCuiHUf| zzvn6!e|z}xRZiTuYiu*5{o>a6FzGUbT(}UIPcV4!CMc^&mlffd+hFWXoW#I@%f2C_ z9j7#luZJ_=o7ejHz$ESX_;b+JkFp`ak=zPyd@D8P`My85$L%(M89bT+fV?ud*jma* zh#z7ytYUbr*KwhC@{{+R_@RB^JsyvxZQ!8*7R)R@w+auno&DX1+x^+mjL@Qwbf;$^ zc?gXK?oFf}!7!5(GLS}+>9_Gb$mCzhJV2XQiFZq$uxOg)e#9%TS2?)B_h3nVH=Fe= zbLq6758O#k(w!;ZK#S?$gQ#`TC(yn&^Mkr#*4geP#gO&R6c4AQ(wcm01o<`Me4p@i z13Na@uruqS$`m2e9LYMhg_x66L`QlfD63b047OsZOx*@~BmV@Ej%N2IX!IZ7x4_*6 zSTa@(sza)lqconc>CV2)*Re;g&s}|oPse-Re^MA<#kKQp)?v2e(i0%pCjCwDzSD!Kf=Kuc)IA`dU@sH*=|1Ml^glJ5BiyEDuS~&AqAm$n#zKEJ8E3; z-J6cb!l`jZCHQSjqB9YVGDbQI&asfK7feOEkiD?zj$Tas4=UhTk3 zRyNi9g{Ei}a1aUZN;eXy@Oa0PF{ool?E9DZd~bRy63(pImP0Hg>xM`(kOjfTdpZh> zc@Kq{uXNID;=Rb(je1;_n!u^10H%k$iwmsbQs*KoJ$obI$BxRx;pphw8nVi@-L5}w zE%p8vW9diDfZUm_LN)TtN4zVyIu2*^aP z_upzop}ioNh(IErQ7cGvEiA;K!gsBBWf`m0J@eC3e+1Hl1hq~TPyiq&cerS3&r_Vq z)EDg+c)M7#9bHcpm&%G-+*Y+e(?Js3Nxmp7fec2vz_)dRo8l#y%Sn>5Gav@4D7LJ_P$C`z}q`nAHiUq zQuPD%P8Kl#ZKNSM(-(G7tv6c_&UrrA#qKM{ zHfT`jxG;_HAcMz_>$Q7%7i}`-BJD6zk+i?7p1nDNm?@f0D2n}&ugZLK7e_KxEr5nw zEjd+UUTk3>{(!Kn$$Q)6QQz2Aii{uZ7Xkv6CyTQ)+Y3So4gN*3fAM-To#`hECC7n& z^}pV9@KyE953GG;6JTs3T#`=CVo|8u?ad>U=}b;uif(;PZAD39+Bc9-Nj!Esz#YgD zkeGtGSja?fa}TqRE?SWSzI>gSFK2UK^hAz?e%?k&Sq4H>Z-N0ff^;RMTwN-EQ`~^L z|4UIFj&!D;)6f}hhUV8LYF!TxWJWUjZ7sZ(uN1`aN*#9W2 zP;4+9BV4AiW44cN^CqxP76o&OQ81TR;b^J|R+m4aZAQsHo7%&$UPT9(P`Q0&C+|CB z$-+@NVJ2?#z3r3&`qT+uL@bq&jqOd9dZby+_$`J^o=$~s*))pdR${d~<@o6*UVc`5 z#EwEJ{0d%NBx$OVI*;v?IW81DX(4Rc_HPn|9PmIC@K6E z4lX-GgGe1Gx@_PJ&%hVgib4Q?${30F1ryGQd#3+&`V5H1R{wu6|NpxEA6_0zKRjJ_ X*95ZBGY+6$j-UbL)#a*XEI$7a>lvI?zBHs)Q4g4@Q-P4{*aMI9FQVNgkkajwyHZ&^gu15&=RSsW0<&@ZPMx-FS z$&muc#5Gu-ee&Ab%n~<-sFoxyj?ldq-*AKyy{AUeo`V#5^B_itO;1-JPX8c6^WSwL9_Q zz65O&$prI7)Rlg-!=?zX-V4Qu`=K-Zyc9i!C0)h`b4etV%xu<8J=yDAi{%Zwrh)32 z8Wf|Hwa!IFMg3iU@T<0)u9I4DfrJ9lRQV^G>P)4jVS6;H^8;aFv9P_yi0MLW85tRb zk=(yw;}WN#x%l?&XJl2C2!w-=Px|wfVEc^aX;6;SR>iF6S!AzE@@(sCZ&F*LJ%Mw=!3@JOz^v)7#vN4h~-DJ*7ll7f~ynEg{xe*P^8S1(nH zFoZaG9NjA*pzFAYK|p6NRrs+lHi>?j<-+N#Z_#|+`@*K)-m8w2fWGzbqwMS@DR?eb z)yh%6!6Wi)1LNw&ExY|YWPj&#;3jK6eBB*&w!?3m=pvIUAFbIhSmnG`(p(FJ%|}H? zm#81q9i7bM%9(8Jdz7!7BzTS6+~Q$xW7;1%T2bteS)M-1!dCA~_E=av(R3y+VQOn` z-nsr$6W>)_CFjqJBy%Oi=`mzQd#j{mI0!omev}u&yPG*^8dEe&9i1ZRoC)smdQbQX zqvp|x1u^8XM_uCjRohT$hJ1$m??k8Gs3PDY0uh}K4KTLXT+;GyKPD#k?aj@QH|L;E zP?l;Id6}#XFX^1V_-CYe;(T90f9vYnnqwbh(yu)>GV;q4ndxB%_p?LiCxs?F*D3!V z@JV9hqSt+Q#(pdO?B6=LMqH*Qe2P#ULVH_UdmAz}%Z*y5ij9{J+ha!V@2<=ocLcQ* zgNXVwkIYTxbu4~OV|`h*%6*(nN+NlL-)nQNYD_;){pV+%aW@n3IoIZel zx=SVT)o`As>%LR5ghk#|D`KEdzw4D<^jSU1IQLh~B64>7y{*}%7c2t~*wf+fHIZ@O z+KGZFNI3#$(x^)Noh;Y)Bv9jvE zGl$`=gK!N^NSOA>VE@o0y7bcNXETZD-z;#!j1u<0-q#a`{@ClF9YhPIW{1kVo}NX| zsqKKMyJYrmrON14sdik$4Hnb1H0spo=IbWLA(Uc0>6^V9reMW z+=X0Rs%&(4D?iP4(U9qAIz1DYlyy`yC^KolYxg-LaBa5EO{GCscN`UJGgHH9Sll!y z%sX98!5BO^_V@{2P*6aioV2w?94~SP?e~Oys0+!nOEjo2ML^^Y>%a7OL5na7xkhlj zO)t=_hke`JUkq2!jXqzOBJ4kLx$e>%-UXwhqKb8e^F1<=!(&FRb9Xi%K*~=jqO&b6 z?PXTK?u)s*-rw9^5ii!hOiyd<&6Rj`HgUJ?6eNrlDSS|=vG2DkZ+>+5D;mUm%5xgA zrKqXte019U(86l1KhAOcC;kC0)Kivt9~#%*eaHK2hB>P&WVXhiS*K#Pv-18HQzf}e z&8&lfyJ6(+^6AK=KU$d$v5>lYwg2Sh)D#a?wX^wzY`NZWA+h;=zsmT?arkD5NxRSC zA*MD(Sz=;81chW_@6A_Oc3z%ti%WgQczD|@o5*Q+%U}tQ2+K#QpG;pr&B$nlkg1v| zc$_37V;9-Q&%k$hpjh-ilwV4+!HEI-&$5l5w-cS8kl$OZPABXqh1; s6>Eq^>+Z z!ceBItF0)^bi`fsyUkirQ(a)8VvFKwu(5!}Q+3wyru>qU!INu)#U1V}i+pF88z1tn z7szmEUP7roDQsmG71nEW>4wHynwo?uVOWqZW?-^=ee^CPI~eap3J;G4;^8b z$jOW9>YhP8Z`c-=mg-j*FXW=JAqeCsk19f|7nxU)W&AT(chhrg?m{A>-_X2dvl4pL z{uG-zOIy}u)@-K2HJ2!^uy>}r`uoQhUjM5I*SsE5X@Y8>{^S!=ml?+f4UXmK<~G<} zh4fXKd0fBC@4oHp!^y!>TGW2hxa4!UCga>;u^>o#uf*UN40eTh{G_}FwjtPWjEe!C zU)zBh@R!J0E=cUvvj23)OY}jHf90?=HCQ(#0&@phr&6No_aPx6K@Lr-W8vFSb{<{X z{P6ta*Z$>3QwkqG+<{tp@p9>!q35qC>-eK8F<7d_Mb!LySs!DHipxW44cM=Vg0?vK zHi+YL%!tYO>}t}|%&Sknl+j>2sVMz}2+y`FrDwSvcUjMgx^zEiXsoX6@b(&h$qi5d ziCgOd8>YA2QJ?UbQJZP#8@8mMnXLJt`M-YrfMB)oh$=cQwUG;x{Kd4P%u$rLg#mM zJ*r^5RFoOFAk;KLq|c)?g&YtEU0q!X@W{9*`|Y2@SMSLhbg+9fWq54Ql*EjkOj>>Z zPDac3>w(@XQn4PvI12%Eh`~gzpZV4C0sK9zrL}d%ZY9V!L5f^`1C;c@=z=&sJ()ta z4`4j`-Nj3DEb8QOcb5l7>UCJFJ<96TOfW|+X6 z_hG1@++Pe69fkhZ+FHlt&VL3p=lWD6rPFY(dX0&iy5`fYBz1)A^a)B(YICv-1A^TP zeJSNb5BGdT@wKrE`KJU_p}vBx4qEz`FPn}SOv1XAlvJwuJ(wtFElQ${43)H`xBHEn z^P4ErK+b6k8H_jO3t@PclWNRmZ7FFkCcp1XJ~r?-uf?72d+cC9fdvemffu(fFS`o} zFO{fzxyS?wNslB9zI91qj}K18&m%vmnXUwghVJU54w}}Ul2SDobciDZFpuh;yW=iz z)RpKQ)0?|qe0>bo%&JGyEsun*hUs_Ym>BbX*6TfB*#Rqu+<4$RO)06vs^QzIbi1wV8s|*e%gI}A|`kOI5}In_OGjr<-pSK8})o(U2zZ4TlXj{di;Sr`2Bk}2bCDT8Y~>>cLbyqi|Fhsn|y zT$@y?_HzDC(7!OKX}M`6xSBUVAG$NJd*g%RJVQJn`qvaW`rkODF@s6Azla>b#szK0 z|NDzwo;-t<@tg_1zNn^F5^Yj(_pAST(k@Q`YX7Zup=TR{aMAy2vt+&hyW6b)_P*`^ z;Dn}0n%eUMtYD#H&^}sTTa%IKby;7<#e34|K~P^Zm9r67UG17g(kVAtYriBe!@lU~ z=qO_+IYogqS->5%Vnlc%jqiUdQMRaLB?=NGpy){yFxm)rZQ1hi@!3x7FVaCAxvcgY zvQFlYR)+RuJZR^zoFu^~VP>FQhwYlmclaLljo*lO6eto++-!G#wRq-4NtuB|wQ1gk zacXVmxG+%cm*gIL*|_fU);+Q(-@;F z;IS*G>!5;sox*PAvk_TN;sh4Tx-Au0QzWD+Q&TpwQvHUE9Z!vaU zBx2O4;bFd!@-=w-x9v(9iSzeBTI02oI-3};Cfe6bO^m#8i}bmY+}gi~YHJhYu;@)- zI|2zqJ7FFDcMP+r`=e(VQ0Fclbwn`s_H60RK&RL50Tn{y*F;#WDN+aOR#O#-(o#tg z5mNxBds*p;H*^G}$~oEDuR57&b|MqQD_l_?i{+h^=^!UAPaht36$a*Uv#<h5NNc8vp<|a*oHX^1*&?ND z=TpqT`Qj?APx|6wWLlxp)0Uv;0E|}TY0_l& zVUxN31rzG!?D!-xuZM>&IF&=d?WQvQ9ePDYe8S+ogl}Bu?Qqudg~i3vSR)>@FQ1Ex zKN_nPb{C+?DGbCcEUfL+Iz^YJ>f!v**;xax(~!TKPGM30Q8fj|qm-A5Rv$j##?YI{ zCe<&mk&l4bv)j5ODNK+MPxSpmNnec3lP3h|zc-dp2pBDo%krC&uAU9WCw-hL`W)nt zN}(DhCFMGj$+UIoPWWuC)l|ccA`CBqR6;^#oGA4c#FPGhilJ<(%5lDCl>YJEW5mkE z`gL;_Z$&-<0j@g2sDCUtFC!yErSMu{#}ME%T=V9b$-=eO)ntBy&9hHDv$ayo%gfp| zP6-{i&^~Sx6`b3foJ4P`e^5VP%-9n~ns73uVBW(rs^{=rZTbA`SJ3cUQL)+nx0cBJ zVi(}cO3JDa9^7YAf8%`o>Y;$Z+;Px0NXhMRNz3Z4=GqwkWY_r`)ICT<;`C z;l3>mRR*_iHMfJ`Vz_to82vN9)7xI(pPJWJaI2|L6B5LPMXhgzaIhs&j;mJu`n7#9 zOen{vi}%o|7Pe3bf3M0={*>#7ZevWE1yf<;i-i_CNnwlvjS@8t4LTYc=I7ZbMRHby z#Qfo=gr?k>2E^9cB$^-cxxFij{~1};fVmDPBv)LLkR+f|`1LI4b6bR>-5 zZSjj=_P##7R8Deuj#*q*zjj|&-yMiJZjM8$zz0huJ2&?lhs?3JwS1D3s^B}tlRmbX zs10p(?Hv^LpVcIclaq%4w=-yb1br8C%3UvTgGh1#s%VqfvCx2UDX%)ZMfAM+B_k>d zCRkl@F*HKkMz6}inymjWl5(o*}qIeYA@{jZa5{~B{Po+INKu=KmS zHiz4h%o-mDSdJkbz^>@D<6{V`MgcX^E-=- z#beeD8 z-k^KuPeBopY~H_*iFblU{PRcl^PA&1PSkT0a;y2{Ye_`(py@CC_sG*7iZYA&4fsP1~Vo$-;DSk}%kEz9`MZ+`}C z#~5@Q5Q!ky0xnCXU~={W(c~*Q%?(pz3e63i64LVH&nEf=>Q(# z+4Fg9=+)ycN`tR!IzMn68I1ODggjj zqB|)s5`_2;VAUgS3vhW;W0k&>1mx}8XBgOkpwDw%ZSdG5=R54^z6lSDv|CsV2AqwF zj(`&8D4=|@O@>6iPE363$xp2K@|b`ij2~}inM7k$2VuPw`~M}-(@Vn8OQ;|C+J0W>W)uNT{Sf|k%yzx_r;b#8;JHJMhTmJ zRIj(e=4XaUUvlks&RRDpfbQ7Ik&%%h@`}`g{C0~lYiqJ3S@7ru4TJ)U_rSjsdxnpim?SJkOr$N5&wg-v%?hT^ z`eBhA=a7ZfM>fm7!DX~8>nG9zQFqC#JUZH62U}h?1Stmk;k=jJf|Y&wrRjZWin0<6 z@enXAYRt*Vrs?skjlh}y^ACfc+U0m?vB@Q+U+D{Nl`RuvwXN=;w0HT4escXj_#XCDFY)5S=ht!1sTSq6f|_)nxS51XW+k%By=5yrdwan2+G}qhCyW+4QnWC_H>t-(V?0SwTl=`csVvn^ zPq&00KG{B>uUkGEBW`s?E2=6_Cjpw#CoP? z+%E2e#%7Iy*va0wZ)m8TkQM_kP0UpVxX5-&-N+NVs9O+W(afzT!XFz-NKFHwJ^`9nczBUSXO1+rqIN-)|LyIv?3kiC4t5rX-rhGO%KQy7 z&m|;fNiVI)*r5G=TjU;1Ol0_7C@M<%CO$^m&}v7R&yj|oVk@f@24xo%xGy2+CgeTS z4yxo1B#7fCMb1;<(?Ddao%5`Nt@wbO!u1BimXQ%bzWobvz#RgPAxoO|4abn@>dNpK znHdQNt}S_BczbJi~TeXm!fb-kh^;gB^O(Ty|=qWHcd+mX1D;i1o}J1GIuEZ8B1lvIdF?v9Yf#qz;cj z|FZv>Am-BY(&~gtLGy~{1&e4+3}C#&cV^^$S%`v`vXV#=;yFN-e6Zo*29Q;1x=CSm z)#jG@%`VYju3$tqDQ?|ny6R%++<+}hZjdOI)hK*n^~4DPF2D|?9AN^UTF1KntxbLf zIIpnpD}aBp^4KsTIy!n{ET4+#wvVl!TfTXyfP`K&f0iJd6#G3+RJN(%6Y6um^qw+D zppj9=%0-v8R%N(k2A}N_2^qadBu!DZz~6&h@=elesI<74eF7ADz>e z7N=;X?1v753IRk)pSuSBLSTj2p&ABV_<;}#h|NdDKa1f<@dBkoEm?AWbs#j{Pqr6U zu2!>d?H_s^Wn{ZdXO4aaElBt#OZ$wpu=dK-LsgEvI@n2Oak1&ve?9{h+MHEyGW@*d zJ*XDy>fFYe5%us(jk%uZG~+b%yqsK=bs(3<4*k*DapBnnYug8#MBnfS{qKIkw+-ay zHi)Su0Eq$n4SK^)apWe=xXIwHz>Gjo{gY@HS69mzW+gCb2?_4&IHG7C4L_Ha4iy2@ zc+xg2(RLSf#XsFn<)89&=#|UNWQm*}IWd?d=s58-xTI!`b>O-glw%@(oF5h&dC~mzZwwrpIINB&71TcJE05LVaZCfO zfx7EC3F0@9l>97C*OH1nX&Fj&-lz&`ZCfzUMLzoDM4ITQ2_1EhpNOQPt9)vS=cAi`A6~iaPT?u8$&CT^iT3aRyW+kOD-8RolE0y~B zc{$~CMv(9H){+XX9MmTLc_*R)!~n#fy1Loe+OBSu3w!|<`02s`kmdDt^OTg=N4g(% z>yC|H$3~aQ#4yI`swrJ=p45V}-}3%*BRNP~7ipE8b)=HY$OHj=WWh9#AgXiOsD*9Z>R&71J6#LOOK9FC zs4PrEX{eB0vveV?yo&d+SHGYT*c&e<;d6;`d6tCl+gnn&><7<-C{W63<5oY0341Gx z<9TZ{D>!&ohfg$-)792_@$p0;&+u0A`1uDcd(!fO-o#St*48b6mPg0N`pOc`%0_b2 za=QedpI!8-tTLC>*j-s~jI*NGvluJVun%mIQ>2lGCehQ=@4dY&IHgi4I3>UPwM4I* zY^(Li$;uw*&su+PH_~lmdUJ_gwMe7uBKlHuSgy0HkKc85(WkruC@`+)y3}&d5H6`k zaJaCN!_0z#39tN%zoecAMnIJk{jm5o8Gdj(V?}AAfl;>``m3z)?;G&ejjF2}t4`Vt zZIVuq8gAXX)IRfU{2Myo2ADT{a(EHVK^uy7b@P{mAnnGQ@o=-ymUow3l7-K0WFZQBU_b`+iey~GhB-B;E9FTckV)8zk`cj#f0R>bDE+?xlQCds^% zscDUV7EV+F+NGdIwf-OoEN#*|LcO4Gy58S4s%|JP@W|y;;VLS@8>C=XfE7 z7olKNTf-99lTu&~5;R!ofc&;2H zeq#9$!;1|h7Cdi21V21>tTNS-kjUwa(LQ{D$t!;}?fjXKk1y#dgOH$%-p8ACUniLa zGtuZs55`(Y zq2#+<0I30ydnwKtLuGqbGxzENvu=4wTAG58P|v~dkkZ3L&?ECw`JB3(OzqVjIYO}l zj*Hi`39D+8r3mqbHS*(xm+#iG*KIMPcW3kLDc;??5u1KQH!$;IDjSHSXQH(W(5-PTH9IW)vZIyM2&n=C6w7ytyrLvFL1E6U2F z{BGi1UB^xh%dCy!x?0j$&?%{ax{glCM3;iLOm#!*0{mk(=#WH`fZn!n%f1&k7YYlH zUVwFqie<*MS}J~G88q;9;&(d?ssgGC^~H&WtC2E0RELdeCC68(J$sk_5!WA=r+|oc zvC-l-FsL-^YB~7w!&vxPk{TKrC;X^`W@DY>BJ#r zxy=cjRtW}r)C>&A=l0hN=_Yv==65@gnk5dOe|WvM(oP!AAOYfMTN@P)Av-{C#kywo zP1Xj0cs{!*QZuGvVwxIh`DlO0?PMA=J-i0EDAH+6A??8J-&^BT0OUqRMeS0*(2u+QLR}p*`rYHLIhn=om?nd)L?9RPI3jQ_Y|iWb1@b)XO1C(63v&xAbl!~j zI2>l=Rr=Wh#Rj+yET>(=#J{8c*@YuPv^(!r<7Wl2J9PsU^AT6_>e3RwlZ&dJ-T?^$ zSz!GoCB+7{S`L;dklG^wM`EAXe5g$F>hWu~q&oY(?_a(M{WZM2d1|%ydFcvu!tcB} z5Pvca{8*st0j&JHw;$KJ>RFBmi}YFJguZ++EFaD!!d{=ZS&3%^koL4D8_W!g-in8zrWU#E%GzKRWzk7lD9Rtck}k!`GDLpUSxDplWw5D=wHP1 zZ8R@>br~k`$0a^65QqXUdF76$AB3{C-H_pj2k@AvBwht!tBu8KdR3bjU4QZSzad*YUmOK)#E>M10KWhN+$Z31f!LI< zYp`^EeCKOpEKloMiLYw6jJ>^m|C@yHhy+y)jS36Y1$izbAiK6K?9+S}#!!OAp9Oo(`;`gS`WO|=UldGG(jQxA3ai-!r4#M{wf2T+t3$A(Q zMu`x zS65(T`g|ANXIex1oOBhB<^g{;$lmv?1#q4)4!b?LlN44r8Bg79xU!Www`c%q_9*VX;3g za=%#^?!<5B)otjkS&FAn>f_Z#_sY!71VgVU`Bigl>@$iS=fd%!gPV#I6STbSu{$Xo z{%V_M9J&8_XS{IU=%_N2JR}nsFVP~@6)sNZnrW6tzSJUTfZVP|h$13x?rr8b3=^`} zX~^v=9$sTchq&`-1X!w7i;}_9j*fGRh_v2%D{4dliL}FVv-3yBhWrBMo(Wj)9}M^9 zJ3b}Z+z1*p&$ba4m!2#^+49N>2-bq>6r!cwXt9atcRg3&cc;wwshATP(SAyu^|J(w zZU-_ZuP`UrKN!OcaCcQ_l*&npdpCRF+)Kc8ln9p7~W(rb6;MT_?(`8SaaP!1V&tKVtM zOd6Jc|NeOw)QwKL=@dDdte@bAbBN@mE#%Z~1J&%pm+ZPXQ^Q2Z6XKh|yQ`>wl>G;_ zQB+VboNe(T=Z3G2o`P*_b;nneW6Ia(Jx6!9dI`Bqx8=C1l2V096p(VLW!`l3^c;AS zOV1E;8HRl+`QGpYLI6L(eSg}5vAyeM?~RfBzy$+3%5?{xt@m>RH$8(i$h<3>lvA5K zsfcF>4?wNwv7B+-9Z3Z<3ald&4CiH2H?=_tViuN`o4=`Xgnkx!hFqt&_k&&qaPsP) zi?0EuBu-AwuZ{OYgOWe~#D+k#w{+YNJ0luZQ8pu1fAcih<&YE`yD~RmNKUk=wUvsA z`su}srj4QC2Do9zVKMf1(6EYdur-PcGSrt`Mw&du4pAR_w_NE%HPiNl)G7l5;9C*x$)h};d(sfBf&*|ufq;fGJ zK)s)YZ;orK3-!rvr z1*%#Dzl=@4M!T#Im;K^fY0Jy3Gs?7OP<{!d3IHEGQFHVsrz~d2DuyeCUno@`xRp?V z$;l(*NooM<&9u=2!ag<($R?#y@Pw$y8gJ2J8|XV)Gcz+L%vx04DJ~6>VK~k_OZT9h z4PseBZ4GUHRyrr3b@q~M=jK^}jKGI<1H%6_e(0J#phu(tA84cEak$-D?$n*s$2B%K z%6|fji;q5_clRCWUtC(E^0fy}!0$_I(`926&i#7A7;*jaV%MDlTyJ3gArC=IEdU63 z-uH^`K>qao29MmO5|w_Lo1NX&(Nn5!tgLVmb(XFUxPZB_hQ`9Ufv_Q?gwZFanBWp;ClXbsvhUZy=Mos0&r}kN($GvMLpNh{3 z#4)D{sEX8AZTG?v^6c{-_LWPnj}4D+MALld*PO3w5fL5jUs+5sqF&>%`3NZVEWqjj zC?y2%%{80mJJ4xPG}Hgjy#RIpn{I!38o~F7B550fl^2WpX<(rwX|f5en}E~?W26ra z2N6#FXD31&l&-&0V@~cTc#Gby}yBW6qr99^n356KEip76Bf0> z?-XSGcEGo1yI-)J>5&PjUf}DClnB-|Pe~K%i`-`43yiy2nG5OZxEJ(5RidQM;^1J< zp{2jscD?P(Cge%*tnc2Za9!d-!3?&w^+11rL!%W3eeZjzx-kg}G}P3GWflvzV(ZM` znu%Y?4wc|uDe|xlt}QHNa&kERJ4{tox4*gh>VG+GKZp0P+A8$lwpU_+T;{l7Rb46C zaJZ`KdRgrLR}5OE$0ibff#{I8kc3>&>o~sD0`C}2%_xHFAq3_gKzHilRy>Y)s8(xT z=Tip+ik@UM)<`P<%T>K*G`aH(;ghoqXUp%FH}jRq=a%{idg#CiaO&wL_B8F^gQ4YK6ZaH?b~ z(kMq8I!Bo5TyJ%p-oR^T4zp)#b{&@g?55;WvQfFEe}&V$Kjn2)CIkahj93rw5K}PJ zRVQ9NDcF*=XEbrtU%99;NHbWJM0nhRGG2V8q-?oD|1za9aRc9umO%vGL z&@GAFovSA~R}pnpTN^7X$`ZZ~9~d9@4+>x`$~LuF_|~!v%&ym&;x*3*qjJ;Py88F} zsV^9IZrUrvpRE{c=kWtYW&W{po(QnkyoujSa8AL)yIFSfq#yg7enH~H#{JE6BBi^l zyJ)WJDx>(GMxqIqFyW&@!3t5J#D2hCKz?rA(Ml$2a^B?+2=GTGeF8+!eBlGUD>U>A zgxiA3F*g+xYgpB47MljW0QGHXG3|?%jdl)0XY|%|`}xelOb{1T<+--09V3-znU8NE zEOn@O1>;lpp~qDQJZXdLj*y$a$lzM!{>ORI2dg+MK1;`HH{0DZ>A=)}h&rvcO}tiH zJo(fPkD{8)7X+3kjA%rPn=4o&YIm!p}I+q@PD_HbpyQL>`9pzkj8nY#} zJFcHseV^rpXo@1NZU(5QhO;Z`#=}ClbfT8CGHJw~@z%wpgzotkys_!q_LD~})zg$pZiGBNn<;iG=Z|ERoh1A zIy@p02cNYac2~XG50?&@IX^e1LIYB{S<~>Cw0>H%`{b3@8r@I503u*gWj4%ejb6_3 zX+W~1m`Qq!Nae2eS`hj@1hG0&8}s;sHGBU{hJ8mpYdd4f<0KNo40oh?`IQ7P*=RfQ zM8)B0C&nzUE#>5;_fEwg3^szN)8VTxdM)2jO6eXw`DT%V!`F-8Q)Gf8BL|7{Q`V|d z%IS``H^O0in&hFUoV1+5P9OJ9zr}`u$8DJy5Jov4+S*q>RmhXcE#jr7XMYM=>)6xv zNtsnYNw@%;Zus4|FQ{l}nduuw8L!b`FqkTHa%aD!xLgpIn<;jb&>d*(MV;gDR3M@3 z>Gvow@jBJ|{z*GS+rQM{vn+a_i@<~%P|Rue#P@l~ox8ZwOO>jxeGC&OQoCSdQS?4( zpGOiGOW!h^Bo@o2bFZ51lnrF;kUc&+Fii6KnUOEs0Wze5#jMIaF?_xO@Nneu;20lf#>;1ciPu0sv%j{ zMMTL+xxC9Zqbqz{0w0TicJIk5wF&k6o$30hbw`fwCmB?*#E*ty$wVcd{Tyc;jwXr8 zvPKdWJ~ede2{rMO;N|CQwU6!sX09U+j=#WIcT#_`SqnZ`a!9z-LoLhEP71ct&8Em6 zlaP>v^6v7&Pt)dHB0_NoP2|XSXQk*U-^`f%GeSXw2~|DD}ZfPDpt2><|rdadi<39&tf2f$fAm$?_`XQkPt0{12ht!Uq~X+IYkSM;)`m z);|uj&O`uiRAowbJ#BK&Z!|1ZKRQ1@v#!;mj0VjIAAB*)H!G&1@ZbP{?a}VEtO{$d z;bM8WNj-edbc3isZR533=|T1I`-#f%xQ$5rtYu~mBoN3iZkUSgFtxfVq15e?68?!D+E?cU37HS%sQvaznapBH<9Dkv2Dm@ zZ?lbV6}o@_Q;Y?nMunh%pd|cqKRUC`&s)m!{gw>Y4bjH+pVhE;0niUNjX=vDDOK%4 zZJr0vu^10j%zZn*BYh^{qGZw(y&etXu+g$VJoYA_C!L!AX`wo;(Z``#?v~#6>g%Wl zXM#*ZspD`>^o#P*pL^)SO6-nkU}sBxlYDP9eTA|oIq}9C8Iok(q1k^p%V9P#Wk>T_ zlK||^YYzT32cyT-gh@Y{2$f}xyyo&nhg;RG zj9h=>8>@=uOj5v8;SxRuy~+`6`y!**_VV`deMMsx6=ipUPgJ*l3~w|w32}52#z|K` z6A*eYF1|kINYi|9!E+JOzApDHHB;ZDHYhvM(Y8Rd%; zpgiInRR_`}#D|U$>2b{dEGfZ-CZ2sU1~>#qmvQ}A4B{$wM!jo~D7}grvzoCssdd;0 zKZgbe-V);As5Lk&C?v4=#S}(tH5_3x(9s#!Ynx1sNQjEIdhE@Wai{!p8@Zgv$TBfh zFV*5?N#dbpF8ZM^XFyJqumo(UNxPx4A0X&yu+znMt7?M{+Q;@nbmL6LNFOYZ6;wrO z8Yb8`(nX(_>#u02?D+6|4qKe`JG9Ten$D`q)d#Ze?{+UdK#_#75894 zL3h25gL+~ocLNLJTFog${ih{AM6TALaE<;;J3ZPhl;2&bkW`x zhUORahD)hx!RF3N#58r(CnqM9bamwzo{$ghQL`|0`%2`y4xquS$wc@#x^KaR51Y{_2gmZOYg`2aRK+H)4#l|ch+ z$hI23_q$sqQVaD2%69*LrO;dz*;JIbl z? zdBX|9rS%T9h#&EUIWaGn_3~hN4QL&ojqZ()jj|A7>Ep1(NrPxwJofI{eg;jH^?y2O zs%GoWY-^?YRi1U+CN{Rv!}INPhM?;B2oC;1wb`$Pai*5GR&ocv#;4|GeZNIBLdKHh zRlqXVMu#x4$t%mWbJ-PUuR7TbDA0l1{v^SvjfNWS_oky}TGN%k#cg&u!vo7iiE-3SR=J$!UIECSg$( zu=Qfzzt5vvC+6@%0srg4$Z)se;kP9BN4QjgBd->89c%em{4Y1eO0O31B6n07=c|lV z(UTrQnZwl8bIuehCau)6rvOw?e67I!A6|fOJgS7!v-j_#*1DL!-}Va(yta*M`DwVw zi3U+pQloh_y>*3LPG{V&rj#*|I|C%V@xBSD=JpQ2W=7|2ZF#0N^T^84yrRr+Nd0^n zDVeHcClHmQS_~gYJJlQEeADwf;VJH_sz#WKdid4A2@eFWfaaC9_`6E(zRWyp9rgll z%L67lWl{Cc{u>lI=B-=8uO0_n+>5HH5Xz8Oj*Joz6N#YWMLw&sJ$T9)ocYGV*4C6r z{hH+^CIn0!7X?w*acA!gJ^Up)^KJeb4Bv{&zZKSws(PB0{ThPO3+({R!}a_Q$OFe>HAwqP(ApeFMbR?QJqkTr zBWBItkyB74nVXm(B6=)o&Cf+Ct!Qu?SIxol*?H|zRR8qpvs)^Rp@-OT}w|jw7%2(<3-iI3Xv$h8NKnF`w zIz~JDIHb*92cH%R=D>se@E$*2pVzfsA7}(xs$r$gkKr{&je|Dk=Tz*BwA?FGD`i_M z)45ox=K8O}=I@b_F(Hz#QW9qOu(A7Vz225m{(`ftjUpMZQtU>1XSmhy*j!ylJ>kmN z&MC|+HLQl0N%b+R_m)jGv@V?G9ND2qdDouAnREDFimQodr=^9%q#9P&*3t(}!Ipf2 zwG13V7IJjxhwo2AO-)>!Kj3{w#xJ-yI6o9}05USXf1shJ=I5fRtJ+@!n?=kkc-?{w zewCYVZN7Y&hW1um+>c!e%07!`$9(Vr;M`K3Ogegc8V<^rFK5h!sVJ#Qh!Uu&Gq$Hn zXqo8NgOQ3Wdcvuqs0d(lH+!S;PWI&_E7(X%ZOskRCF5TQ~*KKIiKbZbL3rwX4Q0xPqmu^^A|Koy8>X0 zFU!$YQxkWOq^_nYsAwja*VL41FlLP#2wA{_mXS_>eSAxVe|#&Dzlg`ac2A|;2WZ)1 z+sbKM;H_4GvBCaxZ%`+`!Oys0EkxgU;jQk+6oPnoc=_4+`r1{O)349}hOCH4RbfTc z3kn8?k$eQ4k)H6$wLnR7IbyVO45@|@i%yY?rk*5m}G)$vmwB_cuwN z22uCc-Ta0(@&$TTG7E^_`Oew-i>Jyj`Eq&Cs#HC(j}!v}Bx? zK^Y-fNNW#pQ4z*Oa+UP--G)d>cLKU{JF?Xv9724>4=Sa)wf>h%%B~a9!4{|FJafsu zY_ZaD`=_%gP3K*F8~4+*dYRT3SI9 z^2*9lvDx>cgsjfTH^Cw#;l-fy&do`!a7I2sVsK(SBBea~A57zx+p5Dl<%DJNX!=nRY;!Se?U&tQ+X8Zi;$)Z{5)dTRS zPC!iM74P3mm$>PHsEhtoXn2Z>8rgPWpd1rCSISX14%r@p=v1p!6irHQEYCLp~j3J3@&Rcb_<^iJrYbP1X~vaQo}8kKv`-8qfpaPXwJWrN0IP{Or^IMkVE~f&uXc4sKIc)(M`+Nvp!$ z8d{noiJ=s$UoS?pB+Y8W>B!k12uaq*l)Aa7Fzm*srm8vS#Otf8s*x+cw3EgN^D|Ly zx=2?>E=>IcVtGxiOkNHXrP`wcbp7X177Wfl>zRrQ!xhee^i5Sf#0SSr(>@;Ne70Tf zMsw@wbE>CRS3WZPM6oMI8RvB@`1oxhps&raRnXxnTkShl&|6ej6{7B`#a35hS?nITXq=*1U7TTki zq_>VayT)OS^%nDzB6TsN(?kZ=N7c`5;s@k~OP`*5kN8caIy!xr#ak@T*{#nGGJS9Y zCQZEOAWF)wQPzr#ju;-GIp*ZdJk_h1cj7c>xpRlNtShB1KF&CwUt*#v1ciYR zzb4?Gf?Hp{k++1D&o}B6Yb#sdOQQO!R${3{v8m0SFzGPo0)>hQJx<6sT&;6*<8?cn zvGTPxKnL-#3JQup97Fs;8I~F(s*D89LbprCZDMW�cyaz7myWXMgl){V3B%Sy@?! zyA^Mrr_C9|G&P;CQzK8b#V}UEp$1rOhDV+W24x;R8+$*3R7suJwh_U>!7a43GyQvL z9dpm)lHgy@H|#gjn({W*cIMi3d(DuTjm^KxT4=qDj8!r&*6eR{pB-M@l5b3O+ug_G zG-^GtGK<@*1_&G2SM?C+=1jrX_fG$8U%QIytkHL+=;`T2av+2ELzr=!QacW0XZxNS z1=$cJ>gwXCMRJY+5ekbL_ux0-m1SMpnmsN~lu?1hRV08JdQUII`Pn`-C%dHzx*IvY zSPzLrGUTR;S)soY)yx@XGLub<+0W(JrE1do`i4+#vl-Vr81Y5jEK5cAy4j2uo_4~? zX0(d6*rWNi3m5w&vO;dqxVdruS%1}aiqKMdJv_YaP!6u*-AjQq`PS+7+tBnRJ68&< zOF*04Rv@XG4(uHr%}1X42CJDOeqT#mBl4pdzg^TxGA2#F?onu+jwlA*8H9PocBZ!n_MzWU%lc$uovkk8RE1UU zM-P!=oh(tWO)tl6u!YNSS+Rb=N~a|y-orLn+RJ-mZ#*~XbiB;Crq-t$6rt(hXkonT zwEQO(PkGmSAkzeCwDB{VBEBQW&6)oKGom9O9$zqcDsup7d25+zFwWzZ0I7YOpPQT8 z8n6g;x3NRj<~!$|QXCP@8)f1THgDfPeRyE~ra#6vb$CN~&0(Rb#{1+accS#>mYt!f zt?xz517oSn`@vHf_aS7?{8a2SGMZZ3vBj{CBIH}~OyeB;cuRo-e_L415IJVH1am5) zTB5zjsXbI~v+}7wU9`z*7DVK?%598%+;HDDx>B#??l8_7%hrTBf52+sTZbzfg! zrQ}}ltCI0&#D`^?-FcOHZD$gry|fmx#qj=7QVpwr5oV*nWLG#p*pyk!}LR)Q(Il$;#bI*L8piLFPZ!< zf3)3E>p_dO(yud~H92`yeN_ODogS|-6*F`E>X`fK2$NB>2llecf1aOt7M{Q<>-hv5 z7Z7sMRah96-ayGP)ciV#1*mhj&U(7&*(|JgvM@d#tRAYjn-wVxsPK?$;M_8CSvuPQ z4`Q-!#mo%tREueQpsY;BCviy{=QGsMg?xCgUPXaKW9_?lkc!z#i@q+_{TAh^Rvl;AAEfc?fJtuX( z{D2z%UEpD7?1N6x(~LV^^O%ntL#IqlMy1!)bUU6mPadf*aCAg7N%~FrZajO#quLuP zH_>b6;9&T@qbS@AUD2Z=(^Ly=l9-qna8C%YmC}QnDOcUJXg)~Qz>H+}WELN6PIVyj z5;I*x*WzI>>+OUat+aX;79-`1j`4EMzu5811O^e!B)m}&dN`Odg=&B{$exE?XFbq4 zl@C8}W!ac;eOp4S=8K47nQG|&{ypbHqio@_bQ%{ z!-5ab6qRwmrr@0=sGM8OGj+&SAIozzo7JG#<(X=O2C55Kw$IU~0=lZ#xEY7@S#Nb8 zEuNnh0}GHGP*r*`&Fic{3+#OU*Gb7|nqBiMaJw@iC3V&)aR&3>6!0Ye7mSkv zs4DlZUb!})|CEe4A)oE9br>;?RPoil_IQ(KF-(!Rnqj@b+jzOdBMm+YHkftq5pElA ze__8eu3DgU;kZ~Tk=4p?$QLZ`_UHIpQBAX(4YV8o9Pd#^Ov%i5!BCMg!2beasD)h_ zb1ZYCO*3U~KDtioTWi`MSCXt=VN$iz(l9u*WQKA~8es2#bN+=xgYj%^rbh_doriB3 zWV(pcIcCsg`PuB@Bje9hZ999KZ73FR!YpUqQMy45^r=_0ISf+@*r1MxDJ#m#GHGMM zNYHTcUcg;PTe58@OWA`{L@i2>oRFT|Z_-R){=!T$&fdtiIOX4pCP>d}qiM}^lA92O zgBd2NUonPhk6WnP9=}aX>lMvBgP3xiSZ3q7#v(H@sTbjfYABkXnbGFNZQE_<<#YnO ztEuhr>9TEJo7*4^pom8`)$;J~MMbsQscBmAfYY7fpym*&!vGuD%^#QC{Q_dFzdlcs z5lqrzWSv^+sHqtqo%u+IG`FHcAow5AcW0qdhHL$4F28%GV=o!SZMT2Y*T}%&p%g3) z{=X->sTG-J8k?U-yz4h`C)nW`QFfLeaf8kDAFvnNN}Z_?Z`_|f>+ZA8lCrv}Vm~(3 z4dRsyN$bAD-hfgQJIuj$e859;}9}*1~qY zlzkq}UB@-LRtp-A!$sU`BOWlU{L|3dvG5I)YuP-MT-O~@@R5Xk!{h&$`KY-pF5dF< zJ6ALG_|`f^d9+W4le*$d8v=Lth6Y~n$~4!WxSuc>>x|CSI>1x)%N1GRo45D!UU8Q4 z?jw&eOg3yWdz}=Dzrj`&(wW z(SJ|w{eJ6Q9~l+tyqm2Fe;4wg6`LVxwoopE=i4{v%Me}KOTl^dlsI@l!xfCLKE1^U}klb7QJ@q`&hIN59Ru7o-59uMfK#$7eA_l*ey>;%UB*R z=jkAt7`IuDyyne>Z@8Ckj1>KyA{;gOI_(&hCtJ-8p6 z%g}$UEPS*jmoV;kH822o^Y3$rB(4X|f3F5$&{mje8U1;(^@UI4jIt{W$zS4=mu_V? z<3^Q>d??Rc489>cB!y{QTrLwV^%pd*d@)asbiN8|dahGFWdVmTtRH2;;oh^q{lMW# zDCsFU1d`u6Ae=*gfBhOb2z~3#$xcZzH-BH)_VEfbBR1Fc-Mf*sf%YYG^Jh#0ff?qT z;TOD35rHt_FJ(^R*If44ln$(3rx?rfY5wtit<&Yj%4>`-B+Opiop)Ks9;^94o&ewp?=}uBN20dZLcp3BPcYq#($1 zrTW@-6G4)$|ANrZhe*H`=HWS@cG~~H@ZUWV|6Vzl*MPZh&s7(HL1a=buVZIjQqnBl zV}RxY2lGZu%Z%VIN7(uHvTv%Inj`J1dK0Cn+br2RZKqfs!BUiBCmJ^wd=} zF_p(8(^GE(oK91Ag}3o1R*j_wz=z_8$p*??WpP*?ZIi=ONZYsrVJ zZyACaL)B^yIHtUUF~d5K(aIl)wx1?;k#y`6NM&TV~rcMw5u3BK53WDTCh}-J25CMMvprYqw9U)y#4dprIO?vFX;J` z)lrL~R@|Z~p8s4G4)@h-_Qu!qo!-2AUX|oec?~RBrCLTG8akA-U8McP8SIG{y;wL8 zYmbxw*|_WRI+u0f`Hu%2`RYupB2u2~$MGDd8#wckF)!=T?T2hdkWf$qI7`MSHX-3* zaCmt5OXcA|1DTldl0ti_Bjx_TScnYQYW_8?EgBZ|<_HiXe!cSf7MHEnIeO}z1a2-+ zx^TTj+s55xMz%;>6M4C~$;HLhgf63!FM4%@6(n=ZAm>(rt*yU$RrE*wIgsdhbwgE-dgM8=QLvd&I~T5K$0PHH$5p10ia zIWn594vac%(WiD@>G4`xUeU4|P^B)>E1UYN|KP#1HU(8(IiHI)<+K-9I5pxY9sVKklaj~aJ=_S-${|+ zioQ>F(EqQT&~L|%x`sNgm2JDM**-vOHzZ#5Ee{U<)m6C8D264HyWWdNf@b^jdvhR# zZ$H>1_Cj`cZ~EOnV&_*6OT20xSQHVFS*CVaOfvw0VDUfJx==8~n{yizpN}~3TOkC9 z|0dq3WDg|wp{4_mXP~46{ByGu@REU-493yJgPBr#PELgsWPcsIXk-Pi3}o_@_yAKB zO6Lzke)!-YXHZ7)jz+%nAHgSG98iL}=>LJ+xisaLLDZL}W9Q+5UD(r-wGS82icJ&( zZjV`2QK(;dmp;KKS81jCuRC4Q7clIc=)3g?I=?U=dU&V#FVTW%FL%s{=~}s;++&-K zMeSmT^Lzl)Y@r%DpH|pg!d)zM^g#CmH4acWPq}4eLgY>LzOy@;M2?Nx?-^!G)(2Ef z{+L0DEmZq8pxOf0r=~htbJH8PieDF)YPw+ z&!x#4{kF~q`O;PT>m5yMEZTbf5zR7jjEv-XkVPbY)C#w3 zzt7X#GIH?c`z*r8Z2|5+-}~qiic{TNeF?WqHqcy!B zB}TJkk&L%JeMTB@dG+--T-2i#3Q^~Vvi62zmkBhJ)qS>AHmPf7m+9bYt7w+O*JXPo z&`-G^evB!b-JL@opuH9m>2w^Q>B~n(eF6+udQ!C@urw)G7pL!Km5V;Abp7_PT21Vp zhr7#`Xe?ZUG3b&`WjG+A+#CfsoBy@2w zku4$@R@A+8P3k83LCHiRWWQNaq*!lbr*|;9!YDF2O2%{j4FYSUJfAM;?t6)p$?wmA zI|8LKX@@vHn=pD=zu zZru_w=*9AeR)@&hF1}S)cfJ8Ch9yhBLB}HuU07xfI^CYB_islZhGfj)Hu3YW3*^>g zuOxZOVFlXT^YAM9lj_W-qaw|ki^P&i+~#pVNWO6mJ7@4wN%!}{9%r>KiRhPElFfQC z1MwWu{*&3-v*`YGv9{0y%v{yhal~lJ#2G+E-Ddt&jZpL~HWS=5L@S^8T+^W(f7T;Lqtfc8Yu%MjYu-O*NK_FCSQ-JARaJp{nI?o$Gct;_lv5T+O-uRABqJ!v zzS^EG!0|H6+RV(jPDO$Bd8_QaMz(~U&%*u7K&60;=11Oh2|}=W?gX9(z?a4U{!PuU zk^S4}#K2cx-mcG<^|`jT+a^X#K3ufS&~6sVpP*9xD^&J`cLacN!2t!=E6{b{I+fkoN7X?C zeC2S0&%>gbQ0C&hHYFvxw|E zJH4;Cn>k{)AicT@EC^>*>pQt{9`o_8<18Gy720nsSsyQJt&Aue>+Y6out8qp9)P-` zK6eg0C+0%HX;y#Kz<30{j4gV4xwvFDUZS&5X=xpw?cZl_c{C*V=-#7sElW^7C-mT+ zav24w=ff3a)?e3JK`r`U$}w2E9cuYI?%bsnn((HCM$c}s{!Irq<8K83dpeu?*puKP z74SoebhuPGFUrsZAZxG<6_{q;@QbIAB5n4fad}cbJ*#Wig5(CgY^~&=7hkn*bpko$ z!+}HnOfLsYw7fP`qGSXae(w%xQB;UR7L6*M^z|lc##^@;Z)r9qq{F=&>_Y$|GZM6( z@{cu@R)xq;7Ut~ltlvMSgi)hW~^GMT^uQ!tmVj~rA4jO zDQ{h$_yLK0miuwiac-nu+T(1jQ}h8)Np%LdFkQXZZ28VkxP!4&sX_fK*vLMZ8m7XX zmu^*DxGUNh(#V6*($VhSnZqeYY-YpRc~_p)%*>3Mni{4_PeW7Yr|g{}Y!yAGA=lN> zacVs!%o>~*gg~`j**ci1D<+Zk=7nv&Q^*|f!M`Wlo~=^`n(0qafl>V&8Cljb|3>w0 zjlUvwlpVxxluXk1MIH$~obsSRNK_?(q`6SnCNftAPw_(XP(=#E6Ip`P}g6=;3;D%1a#JWv>L5 z#uYt$zp|voU21B4#k{JzdhE~B*<;TK589xrg2I^L zy5Dt-4Z&1!m(@b!l9^xK!gWN=hYX&$g`hEok3r91BxZ^?{b-MjP~YDkg#Vz<@4GGE z*p%SJsaCc~8m$scF$BRHx@D>I}mh4xsRZ8m#eznY$l$6KgeXaqX zhV7l5k=g-QNLfMLb~)z&vfO*4=IEhJ;zNuwv=op~Sog&pV7+s5M!{6C1&2Xp&Y5&X zV>A3)>TsSf{l%&BVwTWF(qm<}CTq#nrl-Vj1Z&#cK0ZBKu&%7;rqv1|_? z{;8|t9ls~W~g&Vi2QwnJfJMh%zWMrnMK3@1z zd>kBHU^-}&q58gH?7Vz+%>%rq0Gh^#+R+QUyr^Nn zxwU0iqEpluFqi~rmm2^tE@q2d-JGh!W;6`$YFSY*Nmsk=8u=xn0n`QH6hNlLp(If_ z)OebtS6{3dN9HGS8|=kNglzq?K>=9F=7kwRuaE)RDjRC-r%QKFX4qGYc8#@ZMV%CtJ4H$#tB|QvB7g8>E)p%;FAWamcLYu!Z+a!)4T$l9Uw+4~?`lcam)8wgx$jTR1L!iI zKYkwG+1oYs{#9!hbq57lW+dTxJe9ILDmw+Uopih_mAc+8_APgjXxzGTLr)OYiXSZ+{07|w52t~}NPgQ(hAYnvTeI*PH(+dkz zO1FtXh;8THA+d)p)&;v@4!LPizuFOgjM?9GF~z)rp9Mt(xd0Pb=K?Zjhvy2NmhMo( zkZJyBkV{=0Xx&_tnS_u6UzxrN1!93O{$GF}UmVuaafMoCHwsg5@i{VZQ$mfh$4ZT+swva#%_u*+|(zG?cR>aN2DSu zw;E|ok7$YZW?zNmA{`!fDzJyisoX#$-En)Ge%wufgujpg213wyeB}M(8}ZWYG*TP0 zjp$-a_7^vrsn=>usBtP%A*JB9fsUCDjul0MMKix=RZiqd{TTJ)i)D}@9~40&-wQ@8 zhQv6H)KJ9$7qDdTEBQ(sQes_m(cq&a2!6i@x;)t+P|;?Sx|zN$O}K3+01L9bo-*t9 zntQJj(YF9Wu1pVE4CyhXZ&VtvYcZr-2ZzS~TMy?=J`*zQdxrPc3pzG@!M|O9KfP>g z+$G?dNbCO)vDdV4Ckf6~5j-Zrhi-eh(wCfNA$Fx{m$z6l$1@49^g`O}vmAtt3uxCg zo-FcFLOR$d_+tyQN{IeN2OP_TUu~t*D^4D4y1e>K^==DZS-MTQ-#rq2ImJr_w|DW? zNwg9NS{i-U-^7ZFey?1oaZoE;pRO;A_)uL~7lG>Q@$e#t5qqmR`@e)^RSig4C3X4( z{9j6B@2==UxlH3{ACXNEp6xEnYT0#-c^32Z&h?*-dpuH!g_t;{wDp9+hkH>?7cCeO zOCv5D`;j{D4`GA99fE(=7ro~bDg2$Gq){a9EcR7v{7lAXx?bO-dHGK--Ctjm-8i${ zO9(QW(*Y^4A&4T0bCt^|%G+aHs*-oI=Vz2jo%zHk_TRiX#(e7%Lu=t4s7|llk+*Bw zDOEV}<%Y?V4%dG@6wO}i=2}kfIhoAzV>so0N?NsTl#&OlIx3X|ZSQ0!9-1A5P(^g7 znL$mMoA-;A>3fOnBh_bF?l4w37)+q0lBIRwR|{tBi7C!{6!;xcPOw9(_~-!c@rS#MXn5KKR?H0cmz4OCod&=?lkn9=voT|QZA zj{c-b>d1o<1wa2qS*%x?@r)nr;ZmrX$0?+LnrM(W(^&93w0ilK>i)y~{#(1=-{ao*P9uuvzFZD;nrKVR9j9Zn|tqSTm)tMEbN^sS}3yA)VY(f2b zQsf{Ht*EWRgw5{|tC0j$OZMUUK>Z6@GuB`o{-AoAGFX)iX!m=7K5h0eWkfhjRa?N5 z`Hy*wlFwU|C7s3I4dlLM{k8l%*DS!La4UlY9d-Kdi8f8aoF=}qFj(&FKA9l{gxnKa zan6hsAlLpx!>sydP1N^ReB$+8&4R3 z2k4IdAz7N#9rqxp4*D;`2k8#Jy-ult0oI5w**7PQN!JH(?Ys5yUj<_BZyt?43^h_F zM-<;%AwC0 z`)`c`=OraQ5RlJka~@ut>g6)$Xb`#!PJxZu+z659Oz>ui(##v92JpE&X_Pu$F3%0t zg+sm5umr;7DKTt6L?{2ETR(4zG { + const externalLinkSettingsPath = `/instance?id=privacypolicy`; + + const tosLink = 'https://zitadel.com/docs/legal/terms-of-service'; + const privacyPolicyLink = 'https://zitadel.com/docs/legal/privacy-policy'; + const helpLink = ''; + const supportEmail = ''; + const customLink = ''; + const customLinkText = ''; + const docsLink = 'https://zitadel.com/docs'; + + beforeEach(`ensure they are set`, () => { + apiAuth().then((apiCallProperties) => { + ensureExternalLinksSettingsSet(apiCallProperties, tosLink, privacyPolicyLink, docsLink); + cy.visit(externalLinkSettingsPath); + }); + }); + + it(`should have default settings`, () => { + cy.get('[formcontrolname="tosLink"]').should('value', tosLink); + cy.get('[formcontrolname="privacyLink"]').should('value', privacyPolicyLink); + cy.get('[formcontrolname="helpLink"]').should('value', helpLink); + cy.get('[formcontrolname="supportEmail"]').should('value', supportEmail); + cy.get('[formcontrolname="customLink"]').should('value', customLink); + cy.get('[formcontrolname="customLinkText"]').should('value', customLinkText); + cy.get('[formcontrolname="docsLink"]').should('value', docsLink); + }); + + it(`should update external links`, () => { + cy.get('[formcontrolname="tosLink"]').clear().type('tosLink2'); + cy.get('[formcontrolname="privacyLink"]').clear().type('privacyLink2'); + cy.get('[formcontrolname="helpLink"]').clear().type('helpLink'); + cy.get('[formcontrolname="supportEmail"]').clear().type('support@example.com'); + cy.get('[formcontrolname="customLink"]').clear().type('customLink'); + cy.get('[formcontrolname="customLinkText"]').clear().type('customLinkText'); + cy.get('[formcontrolname="docsLink"]').clear().type('docsLink'); + cy.get('[data-e2e="save-button"]').click(); + cy.shouldConfirmSuccess(); + }); + + it(`should return to default values`, () => { + cy.get('[formcontrolname="tosLink"]').should('value', tosLink); + cy.get('[formcontrolname="privacyLink"]').should('value', privacyPolicyLink); + cy.get('[formcontrolname="helpLink"]').should('value', helpLink); + cy.get('[formcontrolname="supportEmail"]').should('value', supportEmail); + cy.get('[formcontrolname="customLink"]').should('value', customLink); + cy.get('[formcontrolname="customLinkText"]').should('value', customLinkText); + cy.get('[formcontrolname="docsLink"]').should('value', docsLink); + }); +}); + +describe('instance external link settings', () => { + const externalLinkSettingsPath = `/org-settings?id=privacypolicy`; + + const tosLink = 'https://zitadel.com/docs/legal/terms-of-service'; + const privacyPolicyLink = 'https://zitadel.com/docs/legal/privacy-policy'; + const helpLink = ''; + const supportEmail = ''; + const customLink = ''; + const customLinkText = ''; + const docsLink = 'https://zitadel.com/docs'; + + beforeEach(() => { + cy.context().as('ctx'); + cy.visit(externalLinkSettingsPath); + }); + + it(`should have default settings`, () => { + cy.get('[formcontrolname="tosLink"]').should('value', tosLink); + cy.get('[formcontrolname="privacyLink"]').should('value', privacyPolicyLink); + cy.get('[formcontrolname="helpLink"]').should('value', helpLink); + cy.get('[formcontrolname="supportEmail"]').should('value', supportEmail); + cy.get('[formcontrolname="customLink"]').should('value', customLink); + cy.get('[formcontrolname="customLinkText"]').should('value', customLinkText); + cy.get('[formcontrolname="docsLink"]').should('value', docsLink); + }); + + it(`should update external links`, () => { + cy.get('[formcontrolname="tosLink"]').clear().type('tosLink2'); + cy.get('[formcontrolname="privacyLink"]').clear().type('privacyLink2'); + cy.get('[formcontrolname="helpLink"]').clear().type('helpLink'); + cy.get('[formcontrolname="supportEmail"]').clear().type('support@example.com'); + cy.get('[formcontrolname="customLink"]').clear().type('customLink'); + cy.get('[formcontrolname="customLinkText"]').clear().type('customLinkText'); + cy.get('[formcontrolname="docsLink"]').clear().type('docsLink'); + cy.get('[data-e2e="save-button"]').click(); + cy.shouldConfirmSuccess(); + }); + + it(`should return to default values`, () => { + cy.get('[data-e2e="reset-button"]').click(); + cy.get('[data-e2e="confirm-dialog-button"]').click(); + cy.get('[formcontrolname="tosLink"]').should('value', tosLink); + cy.get('[formcontrolname="privacyLink"]').should('value', privacyPolicyLink); + cy.get('[formcontrolname="helpLink"]').should('value', helpLink); + cy.get('[formcontrolname="supportEmail"]').should('value', supportEmail); + cy.get('[formcontrolname="customLink"]').should('value', customLink); + cy.get('[formcontrolname="customLinkText"]').should('value', customLinkText); + cy.get('[formcontrolname="docsLink"]').should('value', docsLink); + }); +}); diff --git a/e2e/cypress/support/api/external-links-settings.ts b/e2e/cypress/support/api/external-links-settings.ts new file mode 100644 index 0000000000..eb4e30a3a2 --- /dev/null +++ b/e2e/cypress/support/api/external-links-settings.ts @@ -0,0 +1,32 @@ +import { ensureSetting } from './ensure'; +import { API } from './types'; + +export function ensureExternalLinksSettingsSet(api: API, tosLink: string, privacyPolicyLink: string, docsLink: string) { + return ensureSetting( + api, + `${api.adminBaseURL}/policies/privacy`, + (body: any) => { + const result = { + sequence: body.policy?.details?.sequence, + id: body.policy.id, + entity: null, + }; + + if ( + body.policy && + body.policy.tosLink === tosLink && + body.policy.privacyLink === privacyPolicyLink && + body.policy.docsLink === docsLink + ) { + return { ...result, entity: body.policy }; + } + return result; + }, + `${api.adminBaseURL}/policies/privacy`, + { + tosLink, + privacyLink: privacyPolicyLink, + docsLink, + }, + ); +} diff --git a/internal/api/grpc/admin/export.go b/internal/api/grpc/admin/export.go index 13a11c14db..9a8f075c7c 100644 --- a/internal/api/grpc/admin/export.go +++ b/internal/api/grpc/admin/export.go @@ -534,10 +534,13 @@ func (s *Server) getPrivacyPolicy(ctx context.Context, orgID string) (_ *managem } if !queriedPrivacy.IsDefault { return &management_pb.AddCustomPrivacyPolicyRequest{ - TosLink: queriedPrivacy.TOSLink, - PrivacyLink: queriedPrivacy.PrivacyLink, - HelpLink: queriedPrivacy.HelpLink, - SupportEmail: string(queriedPrivacy.SupportEmail), + TosLink: queriedPrivacy.TOSLink, + PrivacyLink: queriedPrivacy.PrivacyLink, + HelpLink: queriedPrivacy.HelpLink, + SupportEmail: string(queriedPrivacy.SupportEmail), + DocsLink: queriedPrivacy.DocsLink, + CustomLink: queriedPrivacy.CustomLink, + CustomLinkText: queriedPrivacy.CustomLinkText, }, nil } return nil, nil diff --git a/internal/api/grpc/admin/privacy_policy_converter.go b/internal/api/grpc/admin/privacy_policy_converter.go index 910267e14e..3cb14dec15 100644 --- a/internal/api/grpc/admin/privacy_policy_converter.go +++ b/internal/api/grpc/admin/privacy_policy_converter.go @@ -7,9 +7,12 @@ import ( func UpdatePrivacyPolicyToDomain(req *admin_pb.UpdatePrivacyPolicyRequest) *domain.PrivacyPolicy { return &domain.PrivacyPolicy{ - TOSLink: req.TosLink, - PrivacyLink: req.PrivacyLink, - HelpLink: req.HelpLink, - SupportEmail: domain.EmailAddress(req.SupportEmail), + TOSLink: req.TosLink, + PrivacyLink: req.PrivacyLink, + HelpLink: req.HelpLink, + SupportEmail: domain.EmailAddress(req.SupportEmail), + DocsLink: req.DocsLink, + CustomLink: req.CustomLink, + CustomLinkText: req.CustomLinkText, } } diff --git a/internal/api/grpc/management/policy_privacy_converter.go b/internal/api/grpc/management/policy_privacy_converter.go index 323c162142..a3c77a8637 100644 --- a/internal/api/grpc/management/policy_privacy_converter.go +++ b/internal/api/grpc/management/policy_privacy_converter.go @@ -7,18 +7,24 @@ import ( func AddPrivacyPolicyToDomain(req *mgmt_pb.AddCustomPrivacyPolicyRequest) *domain.PrivacyPolicy { return &domain.PrivacyPolicy{ - TOSLink: req.TosLink, - PrivacyLink: req.PrivacyLink, - HelpLink: req.HelpLink, - SupportEmail: domain.EmailAddress(req.SupportEmail), + TOSLink: req.TosLink, + PrivacyLink: req.PrivacyLink, + HelpLink: req.HelpLink, + SupportEmail: domain.EmailAddress(req.SupportEmail), + DocsLink: req.DocsLink, + CustomLink: req.CustomLink, + CustomLinkText: req.CustomLinkText, } } func UpdatePrivacyPolicyToDomain(req *mgmt_pb.UpdateCustomPrivacyPolicyRequest) *domain.PrivacyPolicy { return &domain.PrivacyPolicy{ - TOSLink: req.TosLink, - PrivacyLink: req.PrivacyLink, - HelpLink: req.HelpLink, - SupportEmail: domain.EmailAddress(req.SupportEmail), + TOSLink: req.TosLink, + PrivacyLink: req.PrivacyLink, + HelpLink: req.HelpLink, + SupportEmail: domain.EmailAddress(req.SupportEmail), + DocsLink: req.DocsLink, + CustomLink: req.CustomLink, + CustomLinkText: req.CustomLinkText, } } diff --git a/internal/api/grpc/policy/privacy_policy.go b/internal/api/grpc/policy/privacy_policy.go index f86bc48e3f..ab87cd31d9 100644 --- a/internal/api/grpc/policy/privacy_policy.go +++ b/internal/api/grpc/policy/privacy_policy.go @@ -19,5 +19,8 @@ func ModelPrivacyPolicyToPb(policy *query.PrivacyPolicy) *policy_pb.PrivacyPolic policy.ChangeDate, policy.ResourceOwner, ), + DocsLink: policy.DocsLink, + CustomLink: policy.CustomLink, + CustomLinkText: policy.CustomLinkText, } } diff --git a/internal/api/grpc/settings/v2/settings_converter.go b/internal/api/grpc/settings/v2/settings_converter.go index f00bbf0f9d..78c440012a 100644 --- a/internal/api/grpc/settings/v2/settings_converter.go +++ b/internal/api/grpc/settings/v2/settings_converter.go @@ -154,6 +154,9 @@ func legalAndSupportSettingsToPb(current *query.PrivacyPolicy) *settings.LegalAn HelpLink: current.HelpLink, SupportEmail: string(current.SupportEmail), ResourceOwnerType: isDefaultToResourceOwnerTypePb(current.IsDefault), + DocsLink: current.DocsLink, + CustomLink: current.CustomLink, + CustomLinkText: current.CustomLinkText, } } diff --git a/internal/api/grpc/settings/v2/settings_converter_test.go b/internal/api/grpc/settings/v2/settings_converter_test.go index d1cde07b87..078483042a 100644 --- a/internal/api/grpc/settings/v2/settings_converter_test.go +++ b/internal/api/grpc/settings/v2/settings_converter_test.go @@ -316,17 +316,23 @@ func Test_domainSettingsToPb(t *testing.T) { func Test_legalSettingsToPb(t *testing.T) { arg := &query.PrivacyPolicy{ - TOSLink: "http://example.com/tos", - PrivacyLink: "http://example.com/pricacy", - HelpLink: "http://example.com/help", - SupportEmail: "support@zitadel.com", - IsDefault: true, + TOSLink: "http://example.com/tos", + PrivacyLink: "http://example.com/pricacy", + HelpLink: "http://example.com/help", + SupportEmail: "support@zitadel.com", + IsDefault: true, + DocsLink: "http://example.com/docs", + CustomLink: "http://example.com/custom", + CustomLinkText: "Custom", } want := &settings.LegalAndSupportSettings{ TosLink: "http://example.com/tos", PrivacyPolicyLink: "http://example.com/pricacy", HelpLink: "http://example.com/help", SupportEmail: "support@zitadel.com", + DocsLink: "http://example.com/docs", + CustomLink: "http://example.com/custom", + CustomLinkText: "Custom", ResourceOwnerType: settings.ResourceOwnerType_RESOURCE_OWNER_TYPE_INSTANCE, } got := legalAndSupportSettingsToPb(arg) diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request.go b/internal/auth/repository/eventsourcing/eventstore/auth_request.go index 129369a71f..782a2a83b0 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request.go @@ -1286,12 +1286,15 @@ func privacyPolicyToDomain(p *query.PrivacyPolicy) *domain.PrivacyPolicy { CreationDate: p.CreationDate, ChangeDate: p.ChangeDate, }, - State: p.State, - Default: p.IsDefault, - TOSLink: p.TOSLink, - PrivacyLink: p.PrivacyLink, - HelpLink: p.HelpLink, - SupportEmail: p.SupportEmail, + State: p.State, + Default: p.IsDefault, + TOSLink: p.TOSLink, + PrivacyLink: p.PrivacyLink, + HelpLink: p.HelpLink, + SupportEmail: p.SupportEmail, + DocsLink: p.DocsLink, + CustomLink: p.CustomLink, + CustomLinkText: p.CustomLinkText, } } diff --git a/internal/command/instance.go b/internal/command/instance.go index a31c00aadf..852e92ee6f 100644 --- a/internal/command/instance.go +++ b/internal/command/instance.go @@ -81,10 +81,13 @@ type InstanceSetup struct { PasswordChange bool } PrivacyPolicy struct { - TOSLink string - PrivacyLink string - HelpLink string - SupportEmail domain.EmailAddress + TOSLink string + PrivacyLink string + HelpLink string + SupportEmail domain.EmailAddress + DocsLink string + CustomLink string + CustomLinkText string } LabelPolicy struct { PrimaryColor string @@ -270,7 +273,7 @@ func (c *Commands) SetUpInstance(ctx context.Context, setup *InstanceSetup) (str */ prepareAddMultiFactorToDefaultLoginPolicy(instanceAgg, domain.MultiFactorTypeU2FWithPIN), - prepareAddDefaultPrivacyPolicy(instanceAgg, setup.PrivacyPolicy.TOSLink, setup.PrivacyPolicy.PrivacyLink, setup.PrivacyPolicy.HelpLink, setup.PrivacyPolicy.SupportEmail), + prepareAddDefaultPrivacyPolicy(instanceAgg, setup.PrivacyPolicy.TOSLink, setup.PrivacyPolicy.PrivacyLink, setup.PrivacyPolicy.HelpLink, setup.PrivacyPolicy.SupportEmail, setup.PrivacyPolicy.DocsLink, setup.PrivacyPolicy.CustomLink, setup.PrivacyPolicy.CustomLinkText), prepareAddDefaultNotificationPolicy(instanceAgg, setup.NotificationPolicy.PasswordChange), prepareAddDefaultLockoutPolicy(instanceAgg, setup.LockoutPolicy.MaxPasswordAttempts, setup.LockoutPolicy.MaxOTPAttempts, setup.LockoutPolicy.ShouldShowLockoutFailure), diff --git a/internal/command/instance_converter.go b/internal/command/instance_converter.go index 1ed1cc123a..e4e4d2ac4b 100644 --- a/internal/command/instance_converter.go +++ b/internal/command/instance_converter.go @@ -116,11 +116,14 @@ func writeModelToLockoutPolicy(wm *LockoutPolicyWriteModel) *domain.LockoutPolic func writeModelToPrivacyPolicy(wm *PrivacyPolicyWriteModel) *domain.PrivacyPolicy { return &domain.PrivacyPolicy{ - ObjectRoot: writeModelToObjectRoot(wm.WriteModel), - TOSLink: wm.TOSLink, - PrivacyLink: wm.PrivacyLink, - HelpLink: wm.HelpLink, - SupportEmail: wm.SupportEmail, + ObjectRoot: writeModelToObjectRoot(wm.WriteModel), + TOSLink: wm.TOSLink, + PrivacyLink: wm.PrivacyLink, + HelpLink: wm.HelpLink, + SupportEmail: wm.SupportEmail, + DocsLink: wm.DocsLink, + CustomLink: wm.CustomLink, + CustomLinkText: wm.CustomLinkText, } } diff --git a/internal/command/instance_policy_privacy.go b/internal/command/instance_policy_privacy.go index f239bad144..8ef8be4216 100644 --- a/internal/command/instance_policy_privacy.go +++ b/internal/command/instance_policy_privacy.go @@ -12,17 +12,37 @@ import ( "github.com/zitadel/zitadel/internal/zerrors" ) -func (c *Commands) AddDefaultPrivacyPolicy(ctx context.Context, tosLink, privacyLink, helpLink string, supportEmail domain.EmailAddress) (*domain.ObjectDetails, error) { +func (c *Commands) AddDefaultPrivacyPolicy(ctx context.Context, tosLink, privacyLink, helpLink string, supportEmail domain.EmailAddress, docsLink, customLink, customLinkText string) (*domain.ObjectDetails, error) { instanceAgg := instance.NewAggregate(authz.GetInstance(ctx).InstanceID()) - cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, prepareAddDefaultPrivacyPolicy(instanceAgg, tosLink, privacyLink, helpLink, supportEmail)) + + if supportEmail != "" { + if err := supportEmail.Validate(); err != nil { + return nil, err + } + supportEmail = supportEmail.Normalize() + } + + writeModel := NewInstancePrivacyPolicyWriteModel(ctx) + err := c.eventstore.FilterToQueryReducer(ctx, writeModel) if err != nil { return nil, err } - pushedEvents, err := c.eventstore.Push(ctx, cmds...) + if writeModel.State.Exists() { + return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-M00rJ", "Errors.Instance.PrivacyPolicy.AlreadyExists") + } + + event := instance.NewPrivacyPolicyAddedEvent(ctx, &instanceAgg.Aggregate, tosLink, privacyLink, helpLink, supportEmail, docsLink, customLink, customLinkText) + + pushedEvents, err := c.eventstore.Push(ctx, event) if err != nil { return nil, err } - return pushedEventsToObjectDetails(pushedEvents), nil + err = AppendAndReduce(writeModel, pushedEvents...) + if err != nil { + return nil, err + } + + return writeModelToObjectDetails(&writeModel.WriteModel), nil } func (c *Commands) ChangeDefaultPrivacyPolicy(ctx context.Context, policy *domain.PrivacyPolicy) (*domain.PrivacyPolicy, error) { @@ -42,7 +62,7 @@ func (c *Commands) ChangeDefaultPrivacyPolicy(ctx context.Context, policy *domai } instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.PrivacyPolicyWriteModel.WriteModel) - changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, instanceAgg, policy.TOSLink, policy.PrivacyLink, policy.HelpLink, policy.SupportEmail) + changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, instanceAgg, policy.TOSLink, policy.PrivacyLink, policy.HelpLink, policy.SupportEmail, policy.DocsLink, policy.CustomLink, policy.CustomLinkText) if !hasChanged { return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-9jJfs", "Errors.IAM.PrivacyPolicy.NotChanged") } @@ -89,6 +109,7 @@ func prepareAddDefaultPrivacyPolicy( privacyLink, helpLink string, supportEmail domain.EmailAddress, + docsLink, customLink, customLinkText string, ) preparation.Validation { return func() (preparation.CreateCommands, error) { if supportEmail != "" { @@ -111,7 +132,7 @@ func prepareAddDefaultPrivacyPolicy( return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-M00rJ", "Errors.Instance.PrivacyPolicy.AlreadyExists") } return []eventstore.Command{ - instance.NewPrivacyPolicyAddedEvent(ctx, &a.Aggregate, tosLink, privacyLink, helpLink, supportEmail), + instance.NewPrivacyPolicyAddedEvent(ctx, &a.Aggregate, tosLink, privacyLink, helpLink, supportEmail, docsLink, customLink, customLinkText), }, nil }, nil } diff --git a/internal/command/instance_policy_privacy_model.go b/internal/command/instance_policy_privacy_model.go index 24263a05de..630a28b92b 100644 --- a/internal/command/instance_policy_privacy_model.go +++ b/internal/command/instance_policy_privacy_model.go @@ -59,6 +59,7 @@ func (wm *InstancePrivacyPolicyWriteModel) NewChangedEvent( privacyLink, helpLink string, supportEmail domain.EmailAddress, + docsLink, customLink, customLinkText string, ) (*instance.PrivacyPolicyChangedEvent, bool) { changes := make([]policy.PrivacyPolicyChanges, 0) @@ -74,6 +75,15 @@ func (wm *InstancePrivacyPolicyWriteModel) NewChangedEvent( if wm.SupportEmail != supportEmail { changes = append(changes, policy.ChangeSupportEmail(supportEmail)) } + if wm.DocsLink != docsLink { + changes = append(changes, policy.ChangeDocsLink(docsLink)) + } + if wm.CustomLink != customLink { + changes = append(changes, policy.ChangeCustomLink(customLink)) + } + if wm.CustomLinkText != customLinkText { + changes = append(changes, policy.ChangeCustomLinkText(customLinkText)) + } if len(changes) == 0 { return nil, false } diff --git a/internal/command/instance_policy_privacy_test.go b/internal/command/instance_policy_privacy_test.go index a5b8932b38..ed09ba0f53 100644 --- a/internal/command/instance_policy_privacy_test.go +++ b/internal/command/instance_policy_privacy_test.go @@ -20,11 +20,14 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) { eventstore *eventstore.Eventstore } type args struct { - ctx context.Context - tosLink string - privacyLink string - helpLink string - supportEmail domain.EmailAddress + ctx context.Context + tosLink string + privacyLink string + helpLink string + supportEmail domain.EmailAddress + docsLink string + customLink string + customLinkText string } type res struct { want *domain.ObjectDetails @@ -49,17 +52,23 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "Custom", ), ), ), ), }, args: args{ - ctx: context.Background(), - tosLink: "TOSLink", - privacyLink: "PrivacyLink", - helpLink: "HelpLink", - supportEmail: "support@example.com", + ctx: context.Background(), + tosLink: "TOSLink", + privacyLink: "PrivacyLink", + helpLink: "HelpLink", + supportEmail: "support@example.com", + docsLink: "DocsLink", + customLink: "CustomLink", + customLinkText: "Custom", }, res: res{ err: zerrors.IsErrorAlreadyExists, @@ -78,16 +87,22 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "Custom", ), ), ), }, args: args{ - ctx: authz.WithInstanceID(context.Background(), "INSTANCE"), - tosLink: "TOSLink", - privacyLink: "PrivacyLink", - helpLink: "HelpLink", - supportEmail: "support@example.com", + ctx: authz.WithInstanceID(context.Background(), "INSTANCE"), + tosLink: "TOSLink", + privacyLink: "PrivacyLink", + helpLink: "HelpLink", + supportEmail: "support@example.com", + docsLink: "DocsLink", + customLink: "CustomLink", + customLinkText: "Custom", }, res: res{ want: &domain.ObjectDetails{ @@ -103,11 +118,14 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) { ), }, args: args{ - ctx: authz.WithInstanceID(context.Background(), "INSTANCE"), - tosLink: "TOSLink", - privacyLink: "PrivacyLink", - helpLink: "HelpLink", - supportEmail: "wrong email", + ctx: authz.WithInstanceID(context.Background(), "INSTANCE"), + tosLink: "TOSLink", + privacyLink: "PrivacyLink", + helpLink: "HelpLink", + supportEmail: "wrong email", + docsLink: "DocsLink", + customLink: "CustomLink", + customLinkText: "Custom", }, res: res{ err: zerrors.IsErrorInvalidArgument, @@ -126,6 +144,9 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) { "", "", "", + "", + "", + "", ), ), ), @@ -149,7 +170,7 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) { r := &Commands{ eventstore: tt.fields.eventstore, } - got, err := r.AddDefaultPrivacyPolicy(tt.args.ctx, tt.args.tosLink, tt.args.privacyLink, tt.args.helpLink, tt.args.supportEmail) + got, err := r.AddDefaultPrivacyPolicy(tt.args.ctx, tt.args.tosLink, tt.args.privacyLink, tt.args.helpLink, tt.args.supportEmail, tt.args.docsLink, tt.args.customLink, tt.args.customLinkText) if tt.res.err == nil { assert.NoError(t, err) } @@ -192,10 +213,13 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { args: args{ ctx: context.Background(), policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -215,6 +239,9 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "CustomLinkText", ), ), ), @@ -223,10 +250,13 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { args: args{ ctx: context.Background(), policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -243,10 +273,13 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { args: args{ ctx: context.Background(), policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "wrong email", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "wrong email", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -266,6 +299,9 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "CustomLinkText", ), ), ), @@ -275,6 +311,9 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { "PrivacyLinkChanged", "HelpLinkChanged", "support2@example.com", + "DocsLinkChanged", + "CustomLinkChanged", + "CustomLinkTextChanged", ), ), ), @@ -282,10 +321,13 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { args: args{ ctx: context.Background(), policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLinkChanged", - PrivacyLink: "PrivacyLinkChanged", - HelpLink: "HelpLinkChanged", - SupportEmail: "support2@example.com", + TOSLink: "TOSLinkChanged", + PrivacyLink: "PrivacyLinkChanged", + HelpLink: "HelpLinkChanged", + SupportEmail: "support2@example.com", + DocsLink: "DocsLinkChanged", + CustomLink: "CustomLinkChanged", + CustomLinkText: "CustomLinkTextChanged", }, }, res: res{ @@ -295,10 +337,13 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { ResourceOwner: "INSTANCE", InstanceID: "INSTANCE", }, - TOSLink: "TOSLinkChanged", - PrivacyLink: "PrivacyLinkChanged", - HelpLink: "HelpLinkChanged", - SupportEmail: "support2@example.com", + TOSLink: "TOSLinkChanged", + PrivacyLink: "PrivacyLinkChanged", + HelpLink: "HelpLinkChanged", + SupportEmail: "support2@example.com", + DocsLink: "DocsLinkChanged", + CustomLink: "CustomLinkChanged", + CustomLinkText: "CustomLinkTextChanged", }, }, }, @@ -322,7 +367,7 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) { } } -func newDefaultPrivacyPolicyChangedEvent(ctx context.Context, tosLink, privacyLink, helpLink, supportEmail string) *instance.PrivacyPolicyChangedEvent { +func newDefaultPrivacyPolicyChangedEvent(ctx context.Context, tosLink, privacyLink, helpLink, supportEmail, docsLink, customLink, customLinkText string) *instance.PrivacyPolicyChangedEvent { event, _ := instance.NewPrivacyPolicyChangedEvent(ctx, &instance.NewAggregate("INSTANCE").Aggregate, []policy.PrivacyPolicyChanges{ @@ -330,6 +375,9 @@ func newDefaultPrivacyPolicyChangedEvent(ctx context.Context, tosLink, privacyLi policy.ChangePrivacyLink(privacyLink), policy.ChangeHelpLink(helpLink), policy.ChangeSupportEmail(domain.EmailAddress(supportEmail)), + policy.ChangeDocsLink(docsLink), + policy.ChangeCustomLink(customLink), + policy.ChangeCustomLinkText(customLinkText), }, ) return event diff --git a/internal/command/org_converter.go b/internal/command/org_converter.go index 667dae1984..e9bd3351f1 100644 --- a/internal/command/org_converter.go +++ b/internal/command/org_converter.go @@ -46,10 +46,13 @@ func orgDomainWriteModelToOrgDomain(wm *OrgDomainWriteModel) *domain.OrgDomain { func orgWriteModelToPrivacyPolicy(wm *OrgPrivacyPolicyWriteModel) *domain.PrivacyPolicy { return &domain.PrivacyPolicy{ - ObjectRoot: writeModelToObjectRoot(wm.PrivacyPolicyWriteModel.WriteModel), - TOSLink: wm.TOSLink, - PrivacyLink: wm.PrivacyLink, - HelpLink: wm.HelpLink, - SupportEmail: wm.SupportEmail, + ObjectRoot: writeModelToObjectRoot(wm.PrivacyPolicyWriteModel.WriteModel), + TOSLink: wm.TOSLink, + PrivacyLink: wm.PrivacyLink, + HelpLink: wm.HelpLink, + SupportEmail: wm.SupportEmail, + DocsLink: wm.DocsLink, + CustomLink: wm.CustomLink, + CustomLinkText: wm.CustomLinkText, } } diff --git a/internal/command/org_policy_privacy.go b/internal/command/org_policy_privacy.go index c4cf6f4591..3e0497ccb4 100644 --- a/internal/command/org_policy_privacy.go +++ b/internal/command/org_policy_privacy.go @@ -58,7 +58,10 @@ func (c *Commands) AddPrivacyPolicy(ctx context.Context, resourceOwner string, p policy.TOSLink, policy.PrivacyLink, policy.HelpLink, - policy.SupportEmail)) + policy.SupportEmail, + policy.DocsLink, + policy.CustomLink, + policy.CustomLinkText)) if err != nil { return nil, err } @@ -91,7 +94,7 @@ func (c *Commands) ChangePrivacyPolicy(ctx context.Context, resourceOwner string } orgAgg := OrgAggregateFromWriteModel(&existingPolicy.PrivacyPolicyWriteModel.WriteModel) - changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, orgAgg, policy.TOSLink, policy.PrivacyLink, policy.HelpLink, policy.SupportEmail) + changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, orgAgg, policy.TOSLink, policy.PrivacyLink, policy.HelpLink, policy.SupportEmail, policy.DocsLink, policy.CustomLink, policy.CustomLinkText) if !hasChanged { return nil, zerrors.ThrowPreconditionFailed(nil, "Org-4N9fs", "Errors.Org.PrivacyPolicy.NotChanged") } diff --git a/internal/command/org_policy_privacy_model.go b/internal/command/org_policy_privacy_model.go index 262935e0ff..d4b5a8547e 100644 --- a/internal/command/org_policy_privacy_model.go +++ b/internal/command/org_policy_privacy_model.go @@ -60,6 +60,7 @@ func (wm *OrgPrivacyPolicyWriteModel) NewChangedEvent( privacyLink, helpLink string, supportEmail domain.EmailAddress, + docsLink, customLink, customLinkText string, ) (*org.PrivacyPolicyChangedEvent, bool) { changes := make([]policy.PrivacyPolicyChanges, 0) @@ -75,6 +76,15 @@ func (wm *OrgPrivacyPolicyWriteModel) NewChangedEvent( if wm.SupportEmail != supportEmail { changes = append(changes, policy.ChangeSupportEmail(supportEmail)) } + if wm.DocsLink != docsLink { + changes = append(changes, policy.ChangeDocsLink(docsLink)) + } + if wm.CustomLink != customLink { + changes = append(changes, policy.ChangeCustomLink(customLink)) + } + if wm.CustomLinkText != customLinkText { + changes = append(changes, policy.ChangeCustomLinkText(customLinkText)) + } if len(changes) == 0 { return nil, false } diff --git a/internal/command/org_policy_privacy_test.go b/internal/command/org_policy_privacy_test.go index 3b251326d8..147d4d3e56 100644 --- a/internal/command/org_policy_privacy_test.go +++ b/internal/command/org_policy_privacy_test.go @@ -43,10 +43,13 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { args: args{ ctx: context.Background(), policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -66,7 +69,9 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", - ), + "DocsLink", + "CustomLink", + "CustomLinkText"), ), ), ), @@ -75,10 +80,13 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -98,6 +106,9 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "CustomLinkText", ), ), ), @@ -106,10 +117,13 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -118,10 +132,13 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { AggregateID: "org1", ResourceOwner: "org1", }, - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, }, @@ -136,10 +153,13 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "wrong email", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "wrong email", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -159,6 +179,9 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { "", "", "", + "", + "", + "", ), ), ), @@ -167,10 +190,13 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "", - PrivacyLink: "", - HelpLink: "", - SupportEmail: "", + TOSLink: "", + PrivacyLink: "", + HelpLink: "", + SupportEmail: "", + DocsLink: "", + CustomLink: "", + CustomLinkText: "", }, }, res: res{ @@ -179,10 +205,13 @@ func TestCommandSide_AddPrivacyPolicy(t *testing.T) { AggregateID: "org1", ResourceOwner: "org1", }, - TOSLink: "", - PrivacyLink: "", - HelpLink: "", - SupportEmail: "", + TOSLink: "", + PrivacyLink: "", + HelpLink: "", + SupportEmail: "", + DocsLink: "", + CustomLink: "", + CustomLinkText: "", }, }, }, @@ -235,10 +264,13 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { args: args{ ctx: context.Background(), policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -257,10 +289,13 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -280,6 +315,9 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "CustomLinkText", ), ), ), @@ -289,10 +327,13 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLink", - PrivacyLink: "PrivacyLink", - HelpLink: "HelpLink", - SupportEmail: "support@example.com", + TOSLink: "TOSLink", + PrivacyLink: "PrivacyLink", + HelpLink: "HelpLink", + SupportEmail: "support@example.com", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -305,10 +346,13 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLinkChange", - PrivacyLink: "PrivacyLinkChange", - HelpLink: "HelpLinkChange", - SupportEmail: "wrong email", + TOSLink: "TOSLinkChange", + PrivacyLink: "PrivacyLinkChange", + HelpLink: "HelpLinkChange", + SupportEmail: "wrong email", + DocsLink: "DocsLink", + CustomLink: "CustomLink", + CustomLinkText: "CustomLinkText", }, }, res: res{ @@ -328,11 +372,14 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "CustomLinkText", ), ), ), expectPush( - newPrivacyPolicyChangedEvent(context.Background(), "org1", "TOSLinkChange", "PrivacyLinkChange", "HelpLinkChange", "support2@example.com"), + newPrivacyPolicyChangedEvent(context.Background(), "org1", "TOSLinkChange", "PrivacyLinkChange", "HelpLinkChange", "support2@example.com", "DocsLinkChange", "CustomLinkChange", "CustomLinkTextChange"), ), ), }, @@ -340,10 +387,13 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "TOSLinkChange", - PrivacyLink: "PrivacyLinkChange", - HelpLink: "HelpLinkChange", - SupportEmail: "support2@example.com", + TOSLink: "TOSLinkChange", + PrivacyLink: "PrivacyLinkChange", + HelpLink: "HelpLinkChange", + SupportEmail: "support2@example.com", + DocsLink: "DocsLinkChange", + CustomLink: "CustomLinkChange", + CustomLinkText: "CustomLinkTextChange", }, }, res: res{ @@ -352,10 +402,13 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { AggregateID: "org1", ResourceOwner: "org1", }, - TOSLink: "TOSLinkChange", - PrivacyLink: "PrivacyLinkChange", - HelpLink: "HelpLinkChange", - SupportEmail: "support2@example.com", + TOSLink: "TOSLinkChange", + PrivacyLink: "PrivacyLinkChange", + HelpLink: "HelpLinkChange", + SupportEmail: "support2@example.com", + DocsLink: "DocsLinkChange", + CustomLink: "CustomLinkChange", + CustomLinkText: "CustomLinkTextChange", }, }, }, @@ -372,11 +425,14 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "CustomLinkText", ), ), ), expectPush( - newPrivacyPolicyChangedEvent(context.Background(), "org1", "", "", "", ""), + newPrivacyPolicyChangedEvent(context.Background(), "org1", "", "", "", "", "", "", ""), ), ), }, @@ -384,10 +440,13 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { ctx: context.Background(), orgID: "org1", policy: &domain.PrivacyPolicy{ - TOSLink: "", - PrivacyLink: "", - HelpLink: "", - SupportEmail: "", + TOSLink: "", + PrivacyLink: "", + HelpLink: "", + SupportEmail: "", + DocsLink: "", + CustomLink: "", + CustomLinkText: "", }, }, res: res{ @@ -396,10 +455,13 @@ func TestCommandSide_ChangePrivacyPolicy(t *testing.T) { AggregateID: "org1", ResourceOwner: "org1", }, - TOSLink: "", - PrivacyLink: "", - HelpLink: "", - SupportEmail: "", + TOSLink: "", + PrivacyLink: "", + HelpLink: "", + SupportEmail: "", + DocsLink: "", + CustomLink: "", + CustomLinkText: "", }, }, }, @@ -484,6 +546,9 @@ func TestCommandSide_RemovePrivacyPolicy(t *testing.T) { "PrivacyLink", "HelpLink", "support@example.com", + "DocsLink", + "CustomLink", + "CustomLinkText", ), ), ), @@ -523,7 +588,7 @@ func TestCommandSide_RemovePrivacyPolicy(t *testing.T) { } } -func newPrivacyPolicyChangedEvent(ctx context.Context, orgID string, tosLink, privacyLink, helpLink, supportEmail string) *org.PrivacyPolicyChangedEvent { +func newPrivacyPolicyChangedEvent(ctx context.Context, orgID string, tosLink, privacyLink, helpLink, supportEmail, docsLink, customLink, customLinkText string) *org.PrivacyPolicyChangedEvent { event, _ := org.NewPrivacyPolicyChangedEvent(ctx, &org.NewAggregate(orgID).Aggregate, []policy.PrivacyPolicyChanges{ @@ -531,6 +596,9 @@ func newPrivacyPolicyChangedEvent(ctx context.Context, orgID string, tosLink, pr policy.ChangePrivacyLink(privacyLink), policy.ChangeHelpLink(helpLink), policy.ChangeSupportEmail(domain.EmailAddress(supportEmail)), + policy.ChangeDocsLink(docsLink), + policy.ChangeCustomLink(customLink), + policy.ChangeCustomLinkText(customLinkText), }, ) return event diff --git a/internal/command/policy_privacy_model.go b/internal/command/policy_privacy_model.go index 1831176d7a..aba64f7f6b 100644 --- a/internal/command/policy_privacy_model.go +++ b/internal/command/policy_privacy_model.go @@ -9,11 +9,14 @@ import ( type PrivacyPolicyWriteModel struct { eventstore.WriteModel - TOSLink string - PrivacyLink string - HelpLink string - SupportEmail domain.EmailAddress - State domain.PolicyState + TOSLink string + PrivacyLink string + HelpLink string + SupportEmail domain.EmailAddress + State domain.PolicyState + DocsLink string + CustomLink string + CustomLinkText string } func (wm *PrivacyPolicyWriteModel) Reduce() error { @@ -25,6 +28,9 @@ func (wm *PrivacyPolicyWriteModel) Reduce() error { wm.HelpLink = e.HelpLink wm.SupportEmail = e.SupportEmail wm.State = domain.PolicyStateActive + wm.DocsLink = e.DocsLink + wm.CustomLink = e.CustomLink + wm.CustomLinkText = e.CustomLinkText case *policy.PrivacyPolicyChangedEvent: if e.PrivacyLink != nil { wm.PrivacyLink = *e.PrivacyLink @@ -38,6 +44,15 @@ func (wm *PrivacyPolicyWriteModel) Reduce() error { if e.SupportEmail != nil { wm.SupportEmail = *e.SupportEmail } + if e.DocsLink != nil { + wm.DocsLink = *e.DocsLink + } + if e.CustomLink != nil { + wm.CustomLink = *e.CustomLink + } + if e.CustomLinkText != nil { + wm.CustomLinkText = *e.CustomLinkText + } case *policy.PrivacyPolicyRemovedEvent: wm.State = domain.PolicyStateRemoved } diff --git a/internal/domain/policy_privacy.go b/internal/domain/policy_privacy.go index 0851582815..7e254bd2da 100644 --- a/internal/domain/policy_privacy.go +++ b/internal/domain/policy_privacy.go @@ -10,8 +10,11 @@ type PrivacyPolicy struct { State PolicyState Default bool - TOSLink string - PrivacyLink string - HelpLink string - SupportEmail EmailAddress + TOSLink string + PrivacyLink string + HelpLink string + SupportEmail EmailAddress + DocsLink string + CustomLink string + CustomLinkText string } diff --git a/internal/query/privacy_policy.go b/internal/query/privacy_policy.go index 5540c34f5f..59394e92b1 100644 --- a/internal/query/privacy_policy.go +++ b/internal/query/privacy_policy.go @@ -26,10 +26,13 @@ type PrivacyPolicy struct { ResourceOwner string State domain.PolicyState - TOSLink string - PrivacyLink string - HelpLink string - SupportEmail domain.EmailAddress + TOSLink string + PrivacyLink string + HelpLink string + SupportEmail domain.EmailAddress + DocsLink string + CustomLink string + CustomLinkText string IsDefault bool } @@ -91,6 +94,18 @@ var ( name: projection.PrivacyPolicyOwnerRemovedCol, table: privacyTable, } + PrivacyColDocsLink = Column{ + name: projection.PrivacyPolicyDocsLinkCol, + table: privacyTable, + } + PrivacyColCustomLink = Column{ + name: projection.PrivacyPolicyCustomLinkCol, + table: privacyTable, + } + PrivacyColCustomLinkText = Column{ + name: projection.PrivacyPolicyCustomLinkTextCol, + table: privacyTable, + } ) func (q *Queries) PrivacyPolicyByOrg(ctx context.Context, shouldTriggerBulk bool, orgID string, withOwnerRemoved bool) (policy *PrivacyPolicy, err error) { @@ -168,6 +183,9 @@ func preparePrivacyPolicyQuery(ctx context.Context, db prepareDatabase) (sq.Sele PrivacyColTOSLink.identifier(), PrivacyColHelpLink.identifier(), PrivacyColSupportEmail.identifier(), + PrivacyColDocsLink.identifier(), + PrivacyColCustomLink.identifier(), + PrivacyColCustomLinkText.identifier(), PrivacyColIsDefault.identifier(), PrivacyColState.identifier(), ). @@ -185,6 +203,9 @@ func preparePrivacyPolicyQuery(ctx context.Context, db prepareDatabase) (sq.Sele &policy.TOSLink, &policy.HelpLink, &policy.SupportEmail, + &policy.DocsLink, + &policy.CustomLink, + &policy.CustomLinkText, &policy.IsDefault, &policy.State, ) @@ -200,10 +221,13 @@ func preparePrivacyPolicyQuery(ctx context.Context, db prepareDatabase) (sq.Sele func (p *PrivacyPolicy) ToDomain() *domain.PrivacyPolicy { return &domain.PrivacyPolicy{ - TOSLink: p.TOSLink, - PrivacyLink: p.PrivacyLink, - HelpLink: p.HelpLink, - SupportEmail: p.SupportEmail, - Default: p.IsDefault, + TOSLink: p.TOSLink, + PrivacyLink: p.PrivacyLink, + HelpLink: p.HelpLink, + SupportEmail: p.SupportEmail, + Default: p.IsDefault, + DocsLink: p.DocsLink, + CustomLink: p.CustomLink, + CustomLinkText: p.CustomLinkText, } } diff --git a/internal/query/privacy_policy_test.go b/internal/query/privacy_policy_test.go index 55671eef6d..ade541d0cc 100644 --- a/internal/query/privacy_policy_test.go +++ b/internal/query/privacy_policy_test.go @@ -13,18 +13,21 @@ import ( ) var ( - preparePrivacyPolicyStmt = `SELECT projections.privacy_policies3.id,` + - ` projections.privacy_policies3.sequence,` + - ` projections.privacy_policies3.creation_date,` + - ` projections.privacy_policies3.change_date,` + - ` projections.privacy_policies3.resource_owner,` + - ` projections.privacy_policies3.privacy_link,` + - ` projections.privacy_policies3.tos_link,` + - ` projections.privacy_policies3.help_link,` + - ` projections.privacy_policies3.support_email,` + - ` projections.privacy_policies3.is_default,` + - ` projections.privacy_policies3.state` + - ` FROM projections.privacy_policies3` + + preparePrivacyPolicyStmt = `SELECT projections.privacy_policies4.id,` + + ` projections.privacy_policies4.sequence,` + + ` projections.privacy_policies4.creation_date,` + + ` projections.privacy_policies4.change_date,` + + ` projections.privacy_policies4.resource_owner,` + + ` projections.privacy_policies4.privacy_link,` + + ` projections.privacy_policies4.tos_link,` + + ` projections.privacy_policies4.help_link,` + + ` projections.privacy_policies4.support_email,` + + ` projections.privacy_policies4.docs_link,` + + ` projections.privacy_policies4.custom_link,` + + ` projections.privacy_policies4.custom_link_text,` + + ` projections.privacy_policies4.is_default,` + + ` projections.privacy_policies4.state` + + ` FROM projections.privacy_policies4` + ` AS OF SYSTEM TIME '-1 ms'` preparePrivacyPolicyCols = []string{ "id", @@ -36,6 +39,9 @@ var ( "tos_link", "help_link", "support_email", + "docs_link", + "custom_link", + "custom_link_text", "is_default", "state", } @@ -87,23 +93,29 @@ func Test_PrivacyPolicyPrepares(t *testing.T) { "tos.ch", "help.ch", "support@example.com", + "zitadel.com/docs", + "zitadel.com", + "Zitadel", true, domain.PolicyStateActive, }, ), }, object: &PrivacyPolicy{ - ID: "pol-id", - CreationDate: testNow, - ChangeDate: testNow, - Sequence: 20211109, - ResourceOwner: "ro", - State: domain.PolicyStateActive, - PrivacyLink: "privacy.ch", - TOSLink: "tos.ch", - HelpLink: "help.ch", - SupportEmail: "support@example.com", - IsDefault: true, + ID: "pol-id", + CreationDate: testNow, + ChangeDate: testNow, + Sequence: 20211109, + ResourceOwner: "ro", + State: domain.PolicyStateActive, + PrivacyLink: "privacy.ch", + TOSLink: "tos.ch", + HelpLink: "help.ch", + SupportEmail: "support@example.com", + DocsLink: "zitadel.com/docs", + CustomLink: "zitadel.com", + CustomLinkText: "Zitadel", + IsDefault: true, }, }, { diff --git a/internal/query/projection/privacy_policy.go b/internal/query/projection/privacy_policy.go index 2bec8fea18..1fb4c4acb8 100644 --- a/internal/query/projection/privacy_policy.go +++ b/internal/query/projection/privacy_policy.go @@ -14,21 +14,24 @@ import ( ) const ( - PrivacyPolicyTable = "projections.privacy_policies3" + PrivacyPolicyTable = "projections.privacy_policies4" - PrivacyPolicyIDCol = "id" - PrivacyPolicyCreationDateCol = "creation_date" - PrivacyPolicyChangeDateCol = "change_date" - PrivacyPolicySequenceCol = "sequence" - PrivacyPolicyStateCol = "state" - PrivacyPolicyIsDefaultCol = "is_default" - PrivacyPolicyResourceOwnerCol = "resource_owner" - PrivacyPolicyInstanceIDCol = "instance_id" - PrivacyPolicyPrivacyLinkCol = "privacy_link" - PrivacyPolicyTOSLinkCol = "tos_link" - PrivacyPolicyHelpLinkCol = "help_link" - PrivacyPolicySupportEmailCol = "support_email" - PrivacyPolicyOwnerRemovedCol = "owner_removed" + PrivacyPolicyIDCol = "id" + PrivacyPolicyCreationDateCol = "creation_date" + PrivacyPolicyChangeDateCol = "change_date" + PrivacyPolicySequenceCol = "sequence" + PrivacyPolicyStateCol = "state" + PrivacyPolicyIsDefaultCol = "is_default" + PrivacyPolicyResourceOwnerCol = "resource_owner" + PrivacyPolicyInstanceIDCol = "instance_id" + PrivacyPolicyPrivacyLinkCol = "privacy_link" + PrivacyPolicyTOSLinkCol = "tos_link" + PrivacyPolicyHelpLinkCol = "help_link" + PrivacyPolicySupportEmailCol = "support_email" + PrivacyPolicyDocsLinkCol = "docs_link" + PrivacyPolicyCustomLinkCol = "custom_link" + PrivacyPolicyCustomLinkTextCol = "custom_link_text" + PrivacyPolicyOwnerRemovedCol = "owner_removed" ) type privacyPolicyProjection struct{} @@ -56,6 +59,9 @@ func (*privacyPolicyProjection) Init() *old_handler.Check { handler.NewColumn(PrivacyPolicyTOSLinkCol, handler.ColumnTypeText), handler.NewColumn(PrivacyPolicyHelpLinkCol, handler.ColumnTypeText), handler.NewColumn(PrivacyPolicySupportEmailCol, handler.ColumnTypeText), + handler.NewColumn(PrivacyPolicyDocsLinkCol, handler.ColumnTypeText, handler.Default("https://zitadel.com/docs")), + handler.NewColumn(PrivacyPolicyCustomLinkCol, handler.ColumnTypeText), + handler.NewColumn(PrivacyPolicyCustomLinkTextCol, handler.ColumnTypeText), handler.NewColumn(PrivacyPolicyOwnerRemovedCol, handler.ColumnTypeBool, handler.Default(false)), }, handler.NewPrimaryKey(PrivacyPolicyInstanceIDCol, PrivacyPolicyIDCol), @@ -132,6 +138,9 @@ func (p *privacyPolicyProjection) reduceAdded(event eventstore.Event) (*handler. handler.NewCol(PrivacyPolicyTOSLinkCol, policyEvent.TOSLink), handler.NewCol(PrivacyPolicyHelpLinkCol, policyEvent.HelpLink), handler.NewCol(PrivacyPolicySupportEmailCol, policyEvent.SupportEmail), + handler.NewCol(PrivacyPolicyDocsLinkCol, policyEvent.DocsLink), + handler.NewCol(PrivacyPolicyCustomLinkCol, policyEvent.CustomLink), + handler.NewCol(PrivacyPolicyCustomLinkTextCol, policyEvent.CustomLinkText), handler.NewCol(PrivacyPolicyIsDefaultCol, isDefault), handler.NewCol(PrivacyPolicyResourceOwnerCol, policyEvent.Aggregate().ResourceOwner), handler.NewCol(PrivacyPolicyInstanceIDCol, policyEvent.Aggregate().InstanceID), @@ -164,6 +173,15 @@ func (p *privacyPolicyProjection) reduceChanged(event eventstore.Event) (*handle if policyEvent.SupportEmail != nil { cols = append(cols, handler.NewCol(PrivacyPolicySupportEmailCol, *policyEvent.SupportEmail)) } + if policyEvent.DocsLink != nil { + cols = append(cols, handler.NewCol(PrivacyPolicyDocsLinkCol, *policyEvent.DocsLink)) + } + if policyEvent.CustomLink != nil { + cols = append(cols, handler.NewCol(PrivacyPolicyCustomLinkCol, *policyEvent.CustomLink)) + } + if policyEvent.CustomLinkText != nil { + cols = append(cols, handler.NewCol(PrivacyPolicyCustomLinkTextCol, *policyEvent.CustomLinkText)) + } return handler.NewUpdateStatement( &policyEvent, cols, diff --git a/internal/query/projection/privacy_policy_test.go b/internal/query/projection/privacy_policy_test.go index 2d768f7e4b..fadd121e73 100644 --- a/internal/query/projection/privacy_policy_test.go +++ b/internal/query/projection/privacy_policy_test.go @@ -32,6 +32,9 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { "tosLink": "http://tos.link", "privacyLink": "http://privacy.link", "helpLink": "http://help.link", + "docsLink": "http://docs.link", + "customLink": "http://custom.link", + "customLinkText": "Custom Link", "supportEmail": "support@example.com"}`), ), org.PrivacyPolicyAddedEventMapper), }, @@ -42,7 +45,7 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "INSERT INTO projections.privacy_policies3 (creation_date, change_date, sequence, id, state, privacy_link, tos_link, help_link, support_email, is_default, resource_owner, instance_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)", + expectedStmt: "INSERT INTO projections.privacy_policies4 (creation_date, change_date, sequence, id, state, privacy_link, tos_link, help_link, support_email, docs_link, custom_link, custom_link_text, is_default, resource_owner, instance_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)", expectedArgs: []interface{}{ anyArg{}, anyArg{}, @@ -53,6 +56,9 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { "http://tos.link", "http://help.link", domain.EmailAddress("support@example.com"), + "http://docs.link", + "http://custom.link", + "Custom Link", false, "ro-id", "instance-id", @@ -74,6 +80,9 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { "tosLink": "http://tos.link", "privacyLink": "http://privacy.link", "helpLink": "http://help.link", + "docsLink": "http://docs.link", + "customLink": "http://custom.link", + "customLinkText": "Custom Link", "supportEmail": "support@example.com"}`), ), org.PrivacyPolicyChangedEventMapper), }, @@ -83,7 +92,7 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "UPDATE projections.privacy_policies3 SET (change_date, sequence, privacy_link, tos_link, help_link, support_email) = ($1, $2, $3, $4, $5, $6) WHERE (id = $7) AND (instance_id = $8)", + expectedStmt: "UPDATE projections.privacy_policies4 SET (change_date, sequence, privacy_link, tos_link, help_link, support_email, docs_link, custom_link, custom_link_text) = ($1, $2, $3, $4, $5, $6, $7, $8, $9) WHERE (id = $10) AND (instance_id = $11)", expectedArgs: []interface{}{ anyArg{}, uint64(15), @@ -91,6 +100,9 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { "http://tos.link", "http://help.link", domain.EmailAddress("support@example.com"), + "http://docs.link", + "http://custom.link", + "Custom Link", "agg-id", "instance-id", }, @@ -116,7 +128,7 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "DELETE FROM projections.privacy_policies3 WHERE (id = $1) AND (instance_id = $2)", + expectedStmt: "DELETE FROM projections.privacy_policies4 WHERE (id = $1) AND (instance_id = $2)", expectedArgs: []interface{}{ "agg-id", "instance-id", @@ -142,7 +154,7 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "DELETE FROM projections.privacy_policies3 WHERE (instance_id = $1)", + expectedStmt: "DELETE FROM projections.privacy_policies4 WHERE (instance_id = $1)", expectedArgs: []interface{}{ "agg-id", }, @@ -163,6 +175,9 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { "tosLink": "http://tos.link", "privacyLink": "http://privacy.link", "helpLink": "http://help.link", + "docsLink": "http://docs.link", + "customLink": "http://custom.link", + "customLinkText": "Custom Link", "supportEmail": "support@example.com"}`), ), instance.PrivacyPolicyAddedEventMapper), }, @@ -172,7 +187,7 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "INSERT INTO projections.privacy_policies3 (creation_date, change_date, sequence, id, state, privacy_link, tos_link, help_link, support_email, is_default, resource_owner, instance_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)", + expectedStmt: "INSERT INTO projections.privacy_policies4 (creation_date, change_date, sequence, id, state, privacy_link, tos_link, help_link, support_email, docs_link, custom_link, custom_link_text, is_default, resource_owner, instance_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)", expectedArgs: []interface{}{ anyArg{}, anyArg{}, @@ -183,6 +198,9 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { "http://tos.link", "http://help.link", domain.EmailAddress("support@example.com"), + "http://docs.link", + "http://custom.link", + "Custom Link", true, "ro-id", "instance-id", @@ -204,6 +222,9 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { "tosLink": "http://tos.link", "privacyLink": "http://privacy.link", "helpLink": "http://help.link", + "docsLink": "http://docs.link", + "customLink": "http://custom.link", + "customLinkText": "Custom Link", "supportEmail": "support@example.com"}`), ), instance.PrivacyPolicyChangedEventMapper), }, @@ -213,7 +234,7 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "UPDATE projections.privacy_policies3 SET (change_date, sequence, privacy_link, tos_link, help_link, support_email) = ($1, $2, $3, $4, $5, $6) WHERE (id = $7) AND (instance_id = $8)", + expectedStmt: "UPDATE projections.privacy_policies4 SET (change_date, sequence, privacy_link, tos_link, help_link, support_email, docs_link, custom_link, custom_link_text) = ($1, $2, $3, $4, $5, $6, $7, $8, $9) WHERE (id = $10) AND (instance_id = $11)", expectedArgs: []interface{}{ anyArg{}, uint64(15), @@ -221,6 +242,9 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { "http://tos.link", "http://help.link", domain.EmailAddress("support@example.com"), + "http://docs.link", + "http://custom.link", + "Custom Link", "agg-id", "instance-id", }, @@ -246,7 +270,7 @@ func TestPrivacyPolicyProjection_reduces(t *testing.T) { executer: &testExecuter{ executions: []execution{ { - expectedStmt: "DELETE FROM projections.privacy_policies3 WHERE (instance_id = $1) AND (resource_owner = $2)", + expectedStmt: "DELETE FROM projections.privacy_policies4 WHERE (instance_id = $1) AND (resource_owner = $2)", expectedArgs: []interface{}{ "instance-id", "agg-id", diff --git a/internal/repository/instance/policy_privacy.go b/internal/repository/instance/policy_privacy.go index ec374583b7..ff1ed75be3 100644 --- a/internal/repository/instance/policy_privacy.go +++ b/internal/repository/instance/policy_privacy.go @@ -24,6 +24,7 @@ func NewPrivacyPolicyAddedEvent( privacyLink, helpLink string, supportEmail domain.EmailAddress, + docsLink, customLink, customLinkText string, ) *PrivacyPolicyAddedEvent { return &PrivacyPolicyAddedEvent{ PrivacyPolicyAddedEvent: *policy.NewPrivacyPolicyAddedEvent( @@ -34,7 +35,10 @@ func NewPrivacyPolicyAddedEvent( tosLink, privacyLink, helpLink, - supportEmail), + supportEmail, + docsLink, + customLink, + customLinkText), } } diff --git a/internal/repository/org/policy_privacy.go b/internal/repository/org/policy_privacy.go index 98916b1124..aad53b79c2 100644 --- a/internal/repository/org/policy_privacy.go +++ b/internal/repository/org/policy_privacy.go @@ -25,6 +25,7 @@ func NewPrivacyPolicyAddedEvent( privacyLink, helpLink string, supportEmail domain.EmailAddress, + docsLink, customLink, customLinkText string, ) *PrivacyPolicyAddedEvent { return &PrivacyPolicyAddedEvent{ PrivacyPolicyAddedEvent: *policy.NewPrivacyPolicyAddedEvent( @@ -35,7 +36,10 @@ func NewPrivacyPolicyAddedEvent( tosLink, privacyLink, helpLink, - supportEmail), + supportEmail, + docsLink, + customLink, + customLinkText), } } diff --git a/internal/repository/policy/policy_privacy.go b/internal/repository/policy/policy_privacy.go index 0b674fff64..8b140026b6 100644 --- a/internal/repository/policy/policy_privacy.go +++ b/internal/repository/policy/policy_privacy.go @@ -15,10 +15,13 @@ const ( type PrivacyPolicyAddedEvent struct { eventstore.BaseEvent `json:"-"` - TOSLink string `json:"tosLink,omitempty"` - PrivacyLink string `json:"privacyLink,omitempty"` - HelpLink string `json:"helpLink,omitempty"` - SupportEmail domain.EmailAddress `json:"supportEmail,omitempty"` + TOSLink string `json:"tosLink,omitempty"` + PrivacyLink string `json:"privacyLink,omitempty"` + HelpLink string `json:"helpLink,omitempty"` + SupportEmail domain.EmailAddress `json:"supportEmail,omitempty"` + DocsLink string `json:"docsLink,omitempty"` + CustomLink string `json:"customLink,omitempty"` + CustomLinkText string `json:"customLinkText,omitempty"` } func (e *PrivacyPolicyAddedEvent) Payload() interface{} { @@ -35,13 +38,17 @@ func NewPrivacyPolicyAddedEvent( privacyLink, helpLink string, supportEmail domain.EmailAddress, + docsLink, customLink, customLinkText string, ) *PrivacyPolicyAddedEvent { return &PrivacyPolicyAddedEvent{ - BaseEvent: *base, - TOSLink: tosLink, - PrivacyLink: privacyLink, - HelpLink: helpLink, - SupportEmail: supportEmail, + BaseEvent: *base, + TOSLink: tosLink, + PrivacyLink: privacyLink, + HelpLink: helpLink, + SupportEmail: supportEmail, + DocsLink: docsLink, + CustomLink: customLink, + CustomLinkText: customLinkText, } } @@ -60,10 +67,13 @@ func PrivacyPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, er type PrivacyPolicyChangedEvent struct { eventstore.BaseEvent `json:"-"` - TOSLink *string `json:"tosLink,omitempty"` - PrivacyLink *string `json:"privacyLink,omitempty"` - HelpLink *string `json:"helpLink,omitempty"` - SupportEmail *domain.EmailAddress `json:"supportEmail,omitempty"` + TOSLink *string `json:"tosLink,omitempty"` + PrivacyLink *string `json:"privacyLink,omitempty"` + HelpLink *string `json:"helpLink,omitempty"` + SupportEmail *domain.EmailAddress `json:"supportEmail,omitempty"` + DocsLink *string `json:"docsLink,omitempty"` + CustomLink *string `json:"customLink,omitempty"` + CustomLinkText *string `json:"customLinkText,omitempty"` } func (e *PrivacyPolicyChangedEvent) Payload() interface{} { @@ -116,6 +126,24 @@ func ChangeSupportEmail(supportEmail domain.EmailAddress) func(*PrivacyPolicyCha } } +func ChangeDocsLink(docsLink string) func(*PrivacyPolicyChangedEvent) { + return func(e *PrivacyPolicyChangedEvent) { + e.DocsLink = &docsLink + } +} + +func ChangeCustomLink(customLink string) func(*PrivacyPolicyChangedEvent) { + return func(e *PrivacyPolicyChangedEvent) { + e.CustomLink = &customLink + } +} + +func ChangeCustomLinkText(customLinkText string) func(*PrivacyPolicyChangedEvent) { + return func(e *PrivacyPolicyChangedEvent) { + e.CustomLinkText = &customLinkText + } +} + func PrivacyPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) { e := &PrivacyPolicyChangedEvent{ BaseEvent: *eventstore.BaseEventFromRepo(event), diff --git a/proto/zitadel/admin.proto b/proto/zitadel/admin.proto index 27e222589f..374ad3c88d 100644 --- a/proto/zitadel/admin.proto +++ b/proto/zitadel/admin.proto @@ -6817,6 +6817,23 @@ message UpdatePrivacyPolicyRequest { description: "help / support email address." } ]; + string docs_link = 5 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"https://zitadel.com/docs\""; + } + ]; + string custom_link = 6 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to an external resource that will be available to users in the console."; + example: "\"https://external.link\""; + } + ]; + string custom_link_text = 7 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "The button text that would be shown in console pointing to custom link."; + example: "\"External\""; + } + ]; } message UpdatePrivacyPolicyResponse { diff --git a/proto/zitadel/management.proto b/proto/zitadel/management.proto index d5b102b7e3..9b59f13be4 100644 --- a/proto/zitadel/management.proto +++ b/proto/zitadel/management.proto @@ -10495,6 +10495,24 @@ message AddCustomPrivacyPolicyRequest { description: "help / support email address." } ]; + string docs_link = 5 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to documentation to be shown in the console."; + example: "\"https://zitadel.com/docs\""; + } + ]; + string custom_link = 6 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to an external resource that will be available to users in the console."; + example: "\"https://external.link\""; + } + ]; + string custom_link_text = 7 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "The button text that would be shown in console pointing to custom link."; + example: "\"External\""; + } + ]; } message AddCustomPrivacyPolicyResponse { @@ -10527,6 +10545,24 @@ message UpdateCustomPrivacyPolicyRequest { description: "help / support email address." } ]; + string docs_link = 5 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to documentation to be shown in the console."; + example: "\"https://zitadel.com/docs\""; + } + ]; + string custom_link = 6 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to an external resource that will be available to users in the console."; + example: "\"https://external.link\""; + } + ]; + string custom_link_text = 7 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "The button text that would be shown in console pointing to custom link."; + example: "\"External\""; + } + ]; } message UpdateCustomPrivacyPolicyResponse { diff --git a/proto/zitadel/policy.proto b/proto/zitadel/policy.proto index 75d8472103..02b7e453f3 100644 --- a/proto/zitadel/policy.proto +++ b/proto/zitadel/policy.proto @@ -375,6 +375,25 @@ message PrivacyPolicy { description: "help / support email address." } ]; + string docs_link = 7 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to documentation to be shown in the console."; + example: "\"https://zitadel.com/docs\""; + } + ]; + string custom_link = 8 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to an external resource that will be available to users in the console."; + example: "\"https://external.link\""; + } + ]; + string custom_link_text = 9 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "The button text that would be shown in console pointing to custom link."; + example: "\"External\""; + } + ]; + } message NotificationPolicy { diff --git a/proto/zitadel/settings/v2beta/legal_settings.proto b/proto/zitadel/settings/v2beta/legal_settings.proto index b170d5f894..882a99cdba 100644 --- a/proto/zitadel/settings/v2beta/legal_settings.proto +++ b/proto/zitadel/settings/v2beta/legal_settings.proto @@ -37,4 +37,22 @@ message LegalAndSupportSettings { description: "resource_owner_type returns if the setting is managed on the organization or on the instance"; } ]; + string docs_link = 6 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to documentation to be shown in the console."; + example: "\"https://zitadel.com/docs\""; + } +]; +string custom_link = 7 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "Link to an external resource that will be available to users in the console."; + example: "\"https://external.link\""; + } +]; +string custom_link_text = 8 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "The button text that would be shown in console pointing to custom link."; + example: "\"External\""; + } +]; } From 0e9ebed8d0a0373bd82712de288df9912251d1e7 Mon Sep 17 00:00:00 2001 From: Stefan Benz <46600784+stebenz@users.noreply.github.com> Date: Tue, 14 May 2024 09:20:31 +0200 Subject: [PATCH 05/35] fix: import totp in add human user with secret (#7936) * fix: import totp in add human user with secret * fix: import totp in add human user with secret * fix: import totp in add human user with secret * fix: review comment changes --- .../session/v2/session_integration_test.go | 221 ++++++++++++++---- internal/api/grpc/user/v2/user.go | 1 + .../api/grpc/user/v2/user_integration_test.go | 46 ++++ internal/command/session_test.go | 4 +- internal/command/user_human.go | 3 + internal/command/user_human_otp.go | 8 +- internal/command/user_human_otp_test.go | 4 +- internal/command/user_v2_human.go | 11 + internal/command/user_v2_human_test.go | 95 ++++++++ internal/command/user_v2_totp_test.go | 5 +- internal/domain/human_otp.go | 10 +- internal/integration/client.go | 31 +++ proto/zitadel/user/v2beta/user_service.proto | 11 + 13 files changed, 397 insertions(+), 53 deletions(-) diff --git a/internal/api/grpc/session/v2/session_integration_test.go b/internal/api/grpc/session/v2/session_integration_test.go index 6818b627e8..645db76733 100644 --- a/internal/api/grpc/session/v2/session_integration_test.go +++ b/internal/api/grpc/session/v2/session_integration_test.go @@ -13,6 +13,7 @@ import ( "github.com/pquerna/otp/totp" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "github.com/zitadel/logging" "google.golang.org/grpc/metadata" "google.golang.org/protobuf/proto" "google.golang.org/protobuf/types/known/durationpb" @@ -43,26 +44,43 @@ func TestMain(m *testing.M) { Client = Tester.Client.SessionV2 CTX, _ = Tester.WithAuthorization(ctx, integration.OrgOwner), errCtx - User = Tester.CreateHumanUser(CTX) - Tester.Client.UserV2.VerifyEmail(CTX, &user.VerifyEmailRequest{ - UserId: User.GetUserId(), - VerificationCode: User.GetEmailCode(), - }) - Tester.Client.UserV2.VerifyPhone(CTX, &user.VerifyPhoneRequest{ - UserId: User.GetUserId(), - VerificationCode: User.GetPhoneCode(), - }) - Tester.SetUserPassword(CTX, User.GetUserId(), integration.UserPassword, false) - Tester.RegisterUserPasskey(CTX, User.GetUserId()) - DeactivatedUser = Tester.CreateHumanUser(CTX) - Tester.Client.UserV2.DeactivateUser(CTX, &user.DeactivateUserRequest{UserId: DeactivatedUser.GetUserId()}) - LockedUser = Tester.CreateHumanUser(CTX) - Tester.Client.UserV2.LockUser(CTX, &user.LockUserRequest{UserId: LockedUser.GetUserId()}) + User = createFullUser(CTX) + DeactivatedUser = createDeactivatedUser(CTX) + LockedUser = createLockedUser(CTX) return m.Run() }()) } -func verifyCurrentSession(t testing.TB, id, token string, sequence uint64, window time.Duration, metadata map[string][]byte, userAgent *session.UserAgent, expirationWindow time.Duration, factors ...wantFactor) *session.Session { +func createFullUser(ctx context.Context) *user.AddHumanUserResponse { + userResp := Tester.CreateHumanUser(ctx) + Tester.Client.UserV2.VerifyEmail(ctx, &user.VerifyEmailRequest{ + UserId: userResp.GetUserId(), + VerificationCode: userResp.GetEmailCode(), + }) + Tester.Client.UserV2.VerifyPhone(ctx, &user.VerifyPhoneRequest{ + UserId: userResp.GetUserId(), + VerificationCode: userResp.GetPhoneCode(), + }) + Tester.SetUserPassword(ctx, userResp.GetUserId(), integration.UserPassword, false) + Tester.RegisterUserPasskey(ctx, userResp.GetUserId()) + return userResp +} + +func createDeactivatedUser(ctx context.Context) *user.AddHumanUserResponse { + userResp := Tester.CreateHumanUser(ctx) + _, err := Tester.Client.UserV2.DeactivateUser(ctx, &user.DeactivateUserRequest{UserId: userResp.GetUserId()}) + logging.OnError(err).Fatal("deactivate human user") + return userResp +} + +func createLockedUser(ctx context.Context) *user.AddHumanUserResponse { + userResp := Tester.CreateHumanUser(ctx) + _, err := Tester.Client.UserV2.LockUser(ctx, &user.LockUserRequest{UserId: userResp.GetUserId()}) + logging.OnError(err).Fatal("lock human user") + return userResp +} + +func verifyCurrentSession(t testing.TB, id, token string, sequence uint64, window time.Duration, metadata map[string][]byte, userAgent *session.UserAgent, expirationWindow time.Duration, userID string, factors ...wantFactor) *session.Session { t.Helper() require.NotEmpty(t, id) require.NotEmpty(t, token) @@ -89,7 +107,7 @@ func verifyCurrentSession(t testing.TB, id, token string, sequence uint64, windo assert.WithinRange(t, s.GetExpirationDate().AsTime(), time.Now().Add(-expirationWindow), time.Now().Add(expirationWindow)) } - verifyFactors(t, s.GetFactors(), window, factors) + verifyFactors(t, s.GetFactors(), window, userID, factors) return s } @@ -106,14 +124,14 @@ const ( wantOTPEmailFactor ) -func verifyFactors(t testing.TB, factors *session.Factors, window time.Duration, want []wantFactor) { +func verifyFactors(t testing.TB, factors *session.Factors, window time.Duration, userID string, want []wantFactor) { for _, w := range want { switch w { case wantUserFactor: uf := factors.GetUser() assert.NotNil(t, uf) assert.WithinRange(t, uf.GetVerifiedAt().AsTime(), time.Now().Add(-window), time.Now().Add(window)) - assert.Equal(t, User.GetUserId(), uf.GetId()) + assert.Equal(t, userID, uf.GetId()) case wantPasswordFactor: pf := factors.GetPassword() assert.NotNil(t, pf) @@ -318,7 +336,7 @@ func TestServer_CreateSession(t *testing.T) { require.NoError(t, err) integration.AssertDetails(t, tt.want, got) - verifyCurrentSession(t, got.GetSessionId(), got.GetSessionToken(), got.GetDetails().GetSequence(), time.Minute, tt.req.GetMetadata(), tt.wantUserAgent, tt.wantExpirationWindow, tt.wantFactors...) + verifyCurrentSession(t, got.GetSessionId(), got.GetSessionToken(), got.GetDetails().GetSequence(), time.Minute, tt.req.GetMetadata(), tt.wantUserAgent, tt.wantExpirationWindow, User.GetUserId(), tt.wantFactors...) }) } } @@ -341,7 +359,7 @@ func TestServer_CreateSession_webauthn(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) assertionData, err := Tester.WebAuthN.CreateAssertionResponse(createResp.GetChallenges().GetWebAuthN().GetPublicKeyCredentialRequestOptions(), true) require.NoError(t, err) @@ -357,7 +375,7 @@ func TestServer_CreateSession_webauthn(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), updateResp.GetSessionToken(), updateResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantWebAuthNFactorUserVerified) + verifyCurrentSession(t, createResp.GetSessionId(), updateResp.GetSessionToken(), updateResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantWebAuthNFactorUserVerified) } func TestServer_CreateSession_successfulIntent(t *testing.T) { @@ -372,7 +390,7 @@ func TestServer_CreateSession_successfulIntent(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) intentID, token, _, _ := Tester.CreateSuccessfulOAuthIntent(t, CTX, idpID, User.GetUserId(), "id") updateResp, err := Client.SetSession(CTX, &session.SetSessionRequest{ @@ -386,7 +404,7 @@ func TestServer_CreateSession_successfulIntent(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), updateResp.GetSessionToken(), updateResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantIntentFactor) + verifyCurrentSession(t, createResp.GetSessionId(), updateResp.GetSessionToken(), updateResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantIntentFactor) } func TestServer_CreateSession_successfulIntent_instant(t *testing.T) { @@ -407,7 +425,7 @@ func TestServer_CreateSession_successfulIntent_instant(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantIntentFactor) + verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantIntentFactor) } func TestServer_CreateSession_successfulIntentUnknownUserID(t *testing.T) { @@ -423,7 +441,7 @@ func TestServer_CreateSession_successfulIntentUnknownUserID(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) idpUserID := "id" intentID, token, _, _ := Tester.CreateSuccessfulOAuthIntent(t, CTX, idpID, "", idpUserID) @@ -451,7 +469,7 @@ func TestServer_CreateSession_successfulIntentUnknownUserID(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), updateResp.GetSessionToken(), updateResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantIntentFactor) + verifyCurrentSession(t, createResp.GetSessionId(), updateResp.GetSessionToken(), updateResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantIntentFactor) } func TestServer_CreateSession_startedIntentFalseToken(t *testing.T) { @@ -467,7 +485,7 @@ func TestServer_CreateSession_startedIntentFalseToken(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), createResp.GetSessionToken(), createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) intentID := Tester.CreateIntent(t, CTX, idpID) _, err = Client.SetSession(CTX, &session.SetSessionRequest{ @@ -514,12 +532,14 @@ func registerOTPEmail(ctx context.Context, t *testing.T, userID string) { require.NoError(t, err) } -func TestServer_SetSession_flow(t *testing.T) { +func TestServer_SetSession_flow_totp(t *testing.T) { + userExisting := createFullUser(CTX) + // create new, empty session createResp, err := Client.CreateSession(CTX, &session.CreateSessionRequest{}) require.NoError(t, err) sessionToken := createResp.GetSessionToken() - verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, "") t.Run("check user", func(t *testing.T) { resp, err := Client.SetSession(CTX, &session.SetSessionRequest{ @@ -528,14 +548,14 @@ func TestServer_SetSession_flow(t *testing.T) { Checks: &session.Checks{ User: &session.CheckUser{ Search: &session.CheckUser_UserId{ - UserId: User.GetUserId(), + UserId: userExisting.GetUserId(), }, }, }, }) require.NoError(t, err) sessionToken = resp.GetSessionToken() - verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor) + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, userExisting.GetUserId(), wantUserFactor) }) t.Run("check webauthn, user verified (passkey)", func(t *testing.T) { @@ -550,7 +570,7 @@ func TestServer_SetSession_flow(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, userExisting.GetUserId()) sessionToken = resp.GetSessionToken() assertionData, err := Tester.WebAuthN.CreateAssertionResponse(resp.GetChallenges().GetWebAuthN().GetPublicKeyCredentialRequestOptions(), true) @@ -567,7 +587,126 @@ func TestServer_SetSession_flow(t *testing.T) { }) require.NoError(t, err) sessionToken = resp.GetSessionToken() - verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantWebAuthNFactorUserVerified) + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, userExisting.GetUserId(), wantUserFactor, wantWebAuthNFactorUserVerified) + }) + + userAuthCtx := Tester.WithAuthorizationToken(CTX, sessionToken) + Tester.RegisterUserU2F(userAuthCtx, userExisting.GetUserId()) + totpSecret := registerTOTP(userAuthCtx, t, userExisting.GetUserId()) + registerOTPSMS(userAuthCtx, t, userExisting.GetUserId()) + registerOTPEmail(userAuthCtx, t, userExisting.GetUserId()) + + t.Run("check TOTP", func(t *testing.T) { + code, err := totp.GenerateCode(totpSecret, time.Now()) + require.NoError(t, err) + resp, err := Client.SetSession(CTX, &session.SetSessionRequest{ + SessionId: createResp.GetSessionId(), + SessionToken: sessionToken, + Checks: &session.Checks{ + Totp: &session.CheckTOTP{ + Code: code, + }, + }, + }) + require.NoError(t, err) + sessionToken = resp.GetSessionToken() + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, userExisting.GetUserId(), wantUserFactor, wantTOTPFactor) + }) + + userImport := Tester.CreateHumanUserWithTOTP(CTX, totpSecret) + createRespImport, err := Client.CreateSession(CTX, &session.CreateSessionRequest{}) + require.NoError(t, err) + sessionTokenImport := createRespImport.GetSessionToken() + verifyCurrentSession(t, createRespImport.GetSessionId(), sessionTokenImport, createRespImport.GetDetails().GetSequence(), time.Minute, nil, nil, 0, "") + + t.Run("check user", func(t *testing.T) { + resp, err := Client.SetSession(CTX, &session.SetSessionRequest{ + SessionId: createRespImport.GetSessionId(), + SessionToken: sessionTokenImport, + Checks: &session.Checks{ + User: &session.CheckUser{ + Search: &session.CheckUser_UserId{ + UserId: userImport.GetUserId(), + }, + }, + }, + }) + require.NoError(t, err) + sessionTokenImport = resp.GetSessionToken() + verifyCurrentSession(t, createRespImport.GetSessionId(), sessionTokenImport, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, userImport.GetUserId(), wantUserFactor) + }) + t.Run("check TOTP", func(t *testing.T) { + code, err := totp.GenerateCode(totpSecret, time.Now()) + require.NoError(t, err) + resp, err := Client.SetSession(CTX, &session.SetSessionRequest{ + SessionId: createRespImport.GetSessionId(), + SessionToken: sessionTokenImport, + Checks: &session.Checks{ + Totp: &session.CheckTOTP{ + Code: code, + }, + }, + }) + require.NoError(t, err) + sessionTokenImport = resp.GetSessionToken() + verifyCurrentSession(t, createRespImport.GetSessionId(), sessionTokenImport, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, userImport.GetUserId(), wantUserFactor, wantTOTPFactor) + }) +} + +func TestServer_SetSession_flow(t *testing.T) { + // create new, empty session + createResp, err := Client.CreateSession(CTX, &session.CreateSessionRequest{}) + require.NoError(t, err) + sessionToken := createResp.GetSessionToken() + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, createResp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) + + t.Run("check user", func(t *testing.T) { + resp, err := Client.SetSession(CTX, &session.SetSessionRequest{ + SessionId: createResp.GetSessionId(), + SessionToken: sessionToken, + Checks: &session.Checks{ + User: &session.CheckUser{ + Search: &session.CheckUser_UserId{ + UserId: User.GetUserId(), + }, + }, + }, + }) + require.NoError(t, err) + sessionToken = resp.GetSessionToken() + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor) + }) + + t.Run("check webauthn, user verified (passkey)", func(t *testing.T) { + resp, err := Client.SetSession(CTX, &session.SetSessionRequest{ + SessionId: createResp.GetSessionId(), + SessionToken: sessionToken, + Challenges: &session.RequestChallenges{ + WebAuthN: &session.RequestChallenges_WebAuthN{ + Domain: Tester.Config.ExternalDomain, + UserVerificationRequirement: session.UserVerificationRequirement_USER_VERIFICATION_REQUIREMENT_REQUIRED, + }, + }, + }) + require.NoError(t, err) + verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) + sessionToken = resp.GetSessionToken() + + assertionData, err := Tester.WebAuthN.CreateAssertionResponse(resp.GetChallenges().GetWebAuthN().GetPublicKeyCredentialRequestOptions(), true) + require.NoError(t, err) + + resp, err = Client.SetSession(CTX, &session.SetSessionRequest{ + SessionId: createResp.GetSessionId(), + SessionToken: sessionToken, + Checks: &session.Checks{ + WebAuthN: &session.CheckWebAuthN{ + CredentialAssertionData: assertionData, + }, + }, + }) + require.NoError(t, err) + sessionToken = resp.GetSessionToken() + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantWebAuthNFactorUserVerified) }) userAuthCtx := Tester.WithAuthorizationToken(CTX, sessionToken) @@ -594,7 +733,7 @@ func TestServer_SetSession_flow(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) sessionToken = resp.GetSessionToken() assertionData, err := Tester.WebAuthN.CreateAssertionResponse(resp.GetChallenges().GetWebAuthN().GetPublicKeyCredentialRequestOptions(), false) @@ -611,7 +750,7 @@ func TestServer_SetSession_flow(t *testing.T) { }) require.NoError(t, err) sessionToken = resp.GetSessionToken() - verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantWebAuthNFactor) + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantWebAuthNFactor) }) } }) @@ -630,7 +769,7 @@ func TestServer_SetSession_flow(t *testing.T) { }) require.NoError(t, err) sessionToken = resp.GetSessionToken() - verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantWebAuthNFactor, wantTOTPFactor) + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantWebAuthNFactor, wantTOTPFactor) }) t.Run("check OTP SMS", func(t *testing.T) { @@ -642,7 +781,7 @@ func TestServer_SetSession_flow(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) sessionToken = resp.GetSessionToken() otp := resp.GetChallenges().GetOtpSms() @@ -659,7 +798,7 @@ func TestServer_SetSession_flow(t *testing.T) { }) require.NoError(t, err) sessionToken = resp.GetSessionToken() - verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantWebAuthNFactor, wantOTPSMSFactor) + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantWebAuthNFactor, wantOTPSMSFactor) }) t.Run("check OTP Email", func(t *testing.T) { @@ -673,7 +812,7 @@ func TestServer_SetSession_flow(t *testing.T) { }, }) require.NoError(t, err) - verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0) + verifyCurrentSession(t, createResp.GetSessionId(), resp.GetSessionToken(), resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId()) sessionToken = resp.GetSessionToken() otp := resp.GetChallenges().GetOtpEmail() @@ -690,7 +829,7 @@ func TestServer_SetSession_flow(t *testing.T) { }) require.NoError(t, err) sessionToken = resp.GetSessionToken() - verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, wantUserFactor, wantWebAuthNFactor, wantOTPEmailFactor) + verifyCurrentSession(t, createResp.GetSessionId(), sessionToken, resp.GetDetails().GetSequence(), time.Minute, nil, nil, 0, User.GetUserId(), wantUserFactor, wantWebAuthNFactor, wantOTPEmailFactor) }) } diff --git a/internal/api/grpc/user/v2/user.go b/internal/api/grpc/user/v2/user.go index 6ff420a44b..dc91fe3eff 100644 --- a/internal/api/grpc/user/v2/user.go +++ b/internal/api/grpc/user/v2/user.go @@ -95,6 +95,7 @@ func AddUserRequestToAddHuman(req *user.AddHumanUserRequest) (*command.AddHuman, Register: false, Metadata: metadata, Links: links, + TOTPSecret: req.GetTotpSecret(), }, nil } diff --git a/internal/api/grpc/user/v2/user_integration_test.go b/internal/api/grpc/user/v2/user_integration_test.go index 132ed0b30f..19ce0aecc6 100644 --- a/internal/api/grpc/user/v2/user_integration_test.go +++ b/internal/api/grpc/user/v2/user_integration_test.go @@ -449,6 +449,52 @@ func TestServer_AddHumanUser(t *testing.T) { }, }, }, + { + name: "with totp", + args: args{ + CTX, + &user.AddHumanUserRequest{ + Organization: &object.Organization{ + Org: &object.Organization_OrgId{ + OrgId: Tester.Organisation.ID, + }, + }, + Profile: &user.SetHumanProfile{ + GivenName: "Donald", + FamilyName: "Duck", + NickName: gu.Ptr("Dukkie"), + DisplayName: gu.Ptr("Donald Duck"), + PreferredLanguage: gu.Ptr("en"), + Gender: user.Gender_GENDER_DIVERSE.Enum(), + }, + Email: &user.SetHumanEmail{ + Email: "livio@zitadel.com", + Verification: &user.SetHumanEmail_IsVerified{ + IsVerified: true, + }, + }, + Metadata: []*user.SetMetadataEntry{ + { + Key: "somekey", + Value: []byte("somevalue"), + }, + }, + PasswordType: &user.AddHumanUserRequest_Password{ + Password: &user.Password{ + Password: "DifficultPW666!", + ChangeRequired: false, + }, + }, + TotpSecret: gu.Ptr("secret"), + }, + }, + want: &user.AddHumanUserResponse{ + Details: &object.Details{ + ChangeDate: timestamppb.Now(), + ResourceOwner: Tester.Organisation.ID, + }, + }, + }, { name: "password not complexity conform", args: args{ diff --git a/internal/command/session_test.go b/internal/command/session_test.go index 58f5f73706..09d5a8a4e5 100644 --- a/internal/command/session_test.go +++ b/internal/command/session_test.go @@ -829,7 +829,9 @@ func TestCheckTOTP(t *testing.T) { ctx := authz.NewMockContext("instance1", "org1", "user1") cryptoAlg := crypto.CreateMockEncryptionAlg(gomock.NewController(t)) - key, secret, err := domain.NewTOTPKey("example.com", "user1", cryptoAlg) + key, err := domain.NewTOTPKey("example.com", "user1") + require.NoError(t, err) + secret, err := crypto.Encrypt([]byte(key.Secret()), cryptoAlg) require.NoError(t, err) sessAgg := &session.NewAggregate("session1", "instance1").Aggregate diff --git a/internal/command/user_human.go b/internal/command/user_human.go index 41ce13f950..7f117751b7 100644 --- a/internal/command/user_human.go +++ b/internal/command/user_human.go @@ -68,6 +68,9 @@ type AddHuman struct { // Links are optional Links []*AddLink + // TOTPSecret is optional + TOTPSecret string + // Details are set after a successful execution of the command Details *domain.ObjectDetails diff --git a/internal/command/user_human_otp.go b/internal/command/user_human_otp.go index a24751f570..c368167b3d 100644 --- a/internal/command/user_human_otp.go +++ b/internal/command/user_human_otp.go @@ -106,7 +106,11 @@ func (c *Commands) createHumanTOTP(ctx context.Context, userID, resourceOwner st if issuer == "" { issuer = authz.GetInstance(ctx).RequestedDomain() } - key, secret, err := domain.NewTOTPKey(issuer, accountName, c.multifactors.OTP.CryptoMFA) + key, err := domain.NewTOTPKey(issuer, accountName) + if err != nil { + return nil, err + } + encryptedSecret, err := crypto.Encrypt([]byte(key.Secret()), c.multifactors.OTP.CryptoMFA) if err != nil { return nil, err } @@ -115,7 +119,7 @@ func (c *Commands) createHumanTOTP(ctx context.Context, userID, resourceOwner st userAgg: userAgg, key: key, cmds: []eventstore.Command{ - user.NewHumanOTPAddedEvent(ctx, userAgg, secret), + user.NewHumanOTPAddedEvent(ctx, userAgg, encryptedSecret), }, }, nil } diff --git a/internal/command/user_human_otp_test.go b/internal/command/user_human_otp_test.go index 0cfba917c7..81615a4f6e 100644 --- a/internal/command/user_human_otp_test.go +++ b/internal/command/user_human_otp_test.go @@ -620,7 +620,9 @@ func TestCommands_HumanCheckMFATOTPSetup(t *testing.T) { ctx := authz.NewMockContext("", "org1", "user1") cryptoAlg := crypto.CreateMockEncryptionAlg(gomock.NewController(t)) - key, secret, err := domain.NewTOTPKey("example.com", "user1", cryptoAlg) + key, err := domain.NewTOTPKey("example.com", "user1") + require.NoError(t, err) + secret, err := crypto.Encrypt([]byte(key.Secret()), cryptoAlg) require.NoError(t, err) userAgg := &user.NewAggregate("user1", "org1").Aggregate userAgg2 := &user.NewAggregate("user2", "org1").Aggregate diff --git a/internal/command/user_v2_human.go b/internal/command/user_v2_human.go index 68955b4a07..c89629ec44 100644 --- a/internal/command/user_v2_human.go +++ b/internal/command/user_v2_human.go @@ -218,6 +218,17 @@ func (c *Commands) AddUserHuman(ctx context.Context, resourceOwner string, human cmds = append(cmds, cmd) } + if human.TOTPSecret != "" { + encryptedSecret, err := crypto.Encrypt([]byte(human.TOTPSecret), c.multifactors.OTP.CryptoMFA) + if err != nil { + return err + } + cmds = append(cmds, + user.NewHumanOTPAddedEvent(ctx, &existingHuman.Aggregate().Aggregate, encryptedSecret), + user.NewHumanOTPVerifiedEvent(ctx, &existingHuman.Aggregate().Aggregate, ""), + ) + } + if len(cmds) == 0 { human.Details = writeModelToObjectDetails(&existingHuman.WriteModel) return nil diff --git a/internal/command/user_v2_human_test.go b/internal/command/user_v2_human_test.go index 59f0935968..e3dccde360 100644 --- a/internal/command/user_v2_human_test.go +++ b/internal/command/user_v2_human_test.go @@ -8,6 +8,7 @@ import ( "github.com/muhlemmer/gu" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "go.uber.org/mock/gomock" "golang.org/x/text/language" @@ -47,6 +48,11 @@ func TestCommandSide_AddUserHuman(t *testing.T) { userAgg := user.NewAggregate("user1", "org1") + cryptoAlg := crypto.CreateMockEncryptionAlg(gomock.NewController(t)) + totpSecret := "TOTPSecret" + totpSecretEnc, err := crypto.Encrypt([]byte(totpSecret), cryptoAlg) + require.NoError(t, err) + tests := []struct { name string fields fields @@ -1394,6 +1400,89 @@ func TestCommandSide_AddUserHuman(t *testing.T) { wantID: "user1", }, }, + { + name: "register human with TOTPSecret, ok", + fields: fields{ + eventstore: expectEventstore( + expectFilter(), + expectFilter( + eventFromEventPusher( + org.NewDomainPolicyAddedEvent(context.Background(), + &userAgg.Aggregate, + true, + true, + true, + ), + ), + ), + expectPush( + user.NewHumanRegisteredEvent(context.Background(), + &userAgg.Aggregate, + "username", + "firstname", + "lastname", + "", + "firstname lastname", + language.English, + domain.GenderUnspecified, + "email@test.ch", + true, + "userAgentID", + ), + user.NewHumanInitialCodeAddedEvent(context.Background(), + &userAgg.Aggregate, + &crypto.CryptoValue{ + CryptoType: crypto.TypeEncryption, + Algorithm: "enc", + KeyID: "id", + Crypted: []byte("userinit"), + }, + time.Hour*1, + "authRequestID", + ), + user.NewHumanOTPAddedEvent(context.Background(), + &userAgg.Aggregate, + totpSecretEnc, + ), + user.NewHumanOTPVerifiedEvent(context.Background(), + &userAgg.Aggregate, + "", + ), + ), + ), + checkPermission: newMockPermissionCheckAllowed(), + idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"), + newCode: mockEncryptedCode("userinit", time.Hour), + }, + args: args{ + ctx: context.Background(), + orgID: "org1", + human: &AddHuman{ + Username: "username", + FirstName: "firstname", + LastName: "lastname", + Email: Email{ + Address: "email@test.ch", + }, + PreferredLanguage: language.English, + Register: true, + UserAgentID: "userAgentID", + AuthRequestID: "authRequestID", + TOTPSecret: totpSecret, + }, + secretGenerator: GetMockSecretGenerator(t), + allowInitMail: true, + codeAlg: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + res: res{ + want: &domain.ObjectDetails{ + Sequence: 0, + EventDate: time.Time{}, + ResourceOwner: "org1", + }, + wantID: "user1", + }, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { @@ -1403,6 +1492,12 @@ func TestCommandSide_AddUserHuman(t *testing.T) { idGenerator: tt.fields.idGenerator, newEncryptedCode: tt.fields.newCode, checkPermission: tt.fields.checkPermission, + multifactors: domain.MultifactorConfigs{ + OTP: domain.OTPConfig{ + Issuer: "zitadel.com", + CryptoMFA: cryptoAlg, + }, + }, } err := r.AddUserHuman(tt.args.ctx, tt.args.orgID, tt.args.human, tt.args.allowInitMail, tt.args.codeAlg) if tt.res.err == nil { diff --git a/internal/command/user_v2_totp_test.go b/internal/command/user_v2_totp_test.go index d05bdc9647..f1a4968275 100644 --- a/internal/command/user_v2_totp_test.go +++ b/internal/command/user_v2_totp_test.go @@ -262,8 +262,11 @@ func TestCommands_CheckUserTOTP(t *testing.T) { ctx := authz.NewMockContext("", "org1", "user1") cryptoAlg := crypto.CreateMockEncryptionAlg(gomock.NewController(t)) - key, secret, err := domain.NewTOTPKey("example.com", "user1", cryptoAlg) + key, err := domain.NewTOTPKey("example.com", "user1") require.NoError(t, err) + secret, err := crypto.Encrypt([]byte(key.Secret()), cryptoAlg) + require.NoError(t, err) + userAgg := &user.NewAggregate("user1", "org1").Aggregate code, err := totp.GenerateCode(key.Secret(), time.Now()) diff --git a/internal/domain/human_otp.go b/internal/domain/human_otp.go index 68b4b4ca0d..fcadb32a72 100644 --- a/internal/domain/human_otp.go +++ b/internal/domain/human_otp.go @@ -15,16 +15,12 @@ type TOTP struct { URI string } -func NewTOTPKey(issuer, accountName string, cryptoAlg crypto.EncryptionAlgorithm) (*otp.Key, *crypto.CryptoValue, error) { +func NewTOTPKey(issuer, accountName string) (*otp.Key, error) { key, err := totp.Generate(totp.GenerateOpts{Issuer: issuer, AccountName: accountName}) if err != nil { - return nil, nil, zerrors.ThrowInternal(err, "TOTP-ieY3o", "Errors.Internal") + return nil, zerrors.ThrowInternal(err, "TOTP-ieY3o", "Errors.Internal") } - encryptedSecret, err := crypto.Encrypt([]byte(key.Secret()), cryptoAlg) - if err != nil { - return nil, nil, err - } - return key, encryptedSecret, nil + return key, nil } func VerifyTOTP(code string, secret *crypto.CryptoValue, cryptoAlg crypto.EncryptionAlgorithm) error { diff --git a/internal/integration/client.go b/internal/integration/client.go index 3ebd4fea51..4b843f68eb 100644 --- a/internal/integration/client.go +++ b/internal/integration/client.go @@ -150,6 +150,37 @@ func (s *Tester) CreateHumanUser(ctx context.Context) *user.AddHumanUserResponse return resp } +func (s *Tester) CreateHumanUserWithTOTP(ctx context.Context, secret string) *user.AddHumanUserResponse { + resp, err := s.Client.UserV2.AddHumanUser(ctx, &user.AddHumanUserRequest{ + Organization: &object.Organization{ + Org: &object.Organization_OrgId{ + OrgId: s.Organisation.ID, + }, + }, + Profile: &user.SetHumanProfile{ + GivenName: "Mickey", + FamilyName: "Mouse", + PreferredLanguage: gu.Ptr("nl"), + Gender: gu.Ptr(user.Gender_GENDER_MALE), + }, + Email: &user.SetHumanEmail{ + Email: fmt.Sprintf("%d@mouse.com", time.Now().UnixNano()), + Verification: &user.SetHumanEmail_ReturnCode{ + ReturnCode: &user.ReturnEmailVerificationCode{}, + }, + }, + Phone: &user.SetHumanPhone{ + Phone: "+41791234567", + Verification: &user.SetHumanPhone_ReturnCode{ + ReturnCode: &user.ReturnPhoneVerificationCode{}, + }, + }, + TotpSecret: gu.Ptr(secret), + }) + logging.OnError(err).Fatal("create human user") + return resp +} + func (s *Tester) CreateOrganization(ctx context.Context, name, adminEmail string) *org.AddOrganizationResponse { resp, err := s.Client.OrgV2.AddOrganization(ctx, &org.AddOrganizationRequest{ Name: name, diff --git a/proto/zitadel/user/v2beta/user_service.proto b/proto/zitadel/user/v2beta/user_service.proto index cbf20d6790..f3d8de747c 100644 --- a/proto/zitadel/user/v2beta/user_service.proto +++ b/proto/zitadel/user/v2beta/user_service.proto @@ -931,6 +931,17 @@ message AddHumanUserRequest{ HashedPassword hashed_password = 8; } repeated IDPLink idp_links = 9; + + // An Implementation of RFC 6238 is used, with HMAC-SHA-1 and time-step of 30 seconds. + // Currently no other options are supported, and if anything different is used the validation will fail. + optional string totp_secret = 12 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + min_length: 1; + max_length: 200; + example: "\"TJOPWSDYILLHXFV4MLKNNJOWFG7VSDCK\""; + } + ]; } message AddHumanUserResponse { From e029b2cabe1fabbe20e94101cdcc91cc50860ab9 Mon Sep 17 00:00:00 2001 From: JayPe <37151973+JayPe69@users.noreply.github.com> Date: Tue, 14 May 2024 15:54:37 +0200 Subject: [PATCH 06/35] fix: typo in the fr translation file for login ui sms otp mfa (#7946) fix typo in the fr translation file for login ui sms otp mfa Co-authored-by: Jean-Philippe Novent --- internal/api/ui/login/static/i18n/fr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/api/ui/login/static/i18n/fr.yaml b/internal/api/ui/login/static/i18n/fr.yaml index de5d1ca495..df717b7aa4 100644 --- a/internal/api/ui/login/static/i18n/fr.yaml +++ b/internal/api/ui/login/static/i18n/fr.yaml @@ -103,7 +103,7 @@ InitMFAOTP: NextButtonText: Suivant CancelButtonText: Annuler -InitMFASMS: +InitMFAOTPSMS: Title: Vérification à deux facteurs DescriptionPhone: Créez votre 2-facteurs. Entrez votre numéro de téléphone pour le vérifier. DescriptionCode: Créez votre 2-facteurs. Entrez le code reçu pour vérifier votre numéro de téléphone. From 6cf9ca9f7e1fc3238d6658adfae118b215cc467a Mon Sep 17 00:00:00 2001 From: Max Peintner Date: Wed, 15 May 2024 11:24:54 +0200 Subject: [PATCH 07/35] docs: update typescript repo state (#7953) --- .../integrate/login-ui/typescript-repo.mdx | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/docs/docs/guides/integrate/login-ui/typescript-repo.mdx b/docs/docs/guides/integrate/login-ui/typescript-repo.mdx index a47090eb3b..817a99645a 100644 --- a/docs/docs/guides/integrate/login-ui/typescript-repo.mdx +++ b/docs/docs/guides/integrate/login-ui/typescript-repo.mdx @@ -76,12 +76,14 @@ The application can then request a token calling the /token endpoint of the logi - [ ] AuthRequest UI locales - Multifactor - [x] Passkeys - - [ ] TOTP + - [x] TOTP + - [x] OTP via email + - [x] OTP via SMS - Passwordless - [x] Passkeys - Security Prompts - [x] Setup Passkey as Passwordless method - - [ ] Setup TOTP as Multifactor + - [x] Setup TOTP as Multifactor - [ ] Password Change - Login - [x] Email Password @@ -89,7 +91,7 @@ The application can then request a token calling the /token endpoint of the logi - [x] IDPs - [x] Google - [ ] GitHub - - [ ] GitLab + - [x] GitLab - [ ] Azure - [ ] Apple - Register @@ -104,8 +106,12 @@ Authenticated users are directly able to self service their account. - [ ] Change user information - [ ] Password Change - [x] Setup Passkey -- [ ] Setup Multifactor TOTP -- [ ] Setup Multifactor Passkey (U2F) +- [x] Setup Multifactor + - [x] Passkeys + - [x] TOTP + - [x] OTP via email + - [x] OTP via SMS +- [x] Setup Multifactor Passkey (U2F) - [ ] Validate Account (email verification) ### Setup From 8e0c8393e9b0ebf80cac20735ab6928f147dc630 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20M=C3=B6hlmann?= Date: Thu, 16 May 2024 08:07:56 +0300 Subject: [PATCH 08/35] perf(oidc): optimize token creation (#7822) * implement code exchange * port tokenexchange to v2 tokens * implement refresh token * implement client credentials * implement jwt profile * implement device token * cleanup unused code * fix current unit tests * add user agent unit test * unit test domain package * need refresh token as argument * test commands create oidc session * test commands device auth * fix device auth build error * implicit for oidc session API * implement authorize callback handler for legacy implicit mode * upgrade oidc module to working draft * add missing auth methods and time * handle all errors in defer * do not fail auth request on error the oauth2 Go client automagically retries on any error. If we fail the auth request on the first error, the next attempt will always fail with the Errors.AuthRequest.NoCode, because the auth request state is already set to failed. The original error is then already lost and the oauth2 library does not return the original error. Therefore we should not fail the auth request. Might be worth discussing and perhaps send a bug report to Oauth2? * fix code flow tests by explicitly setting code exchanged * fix unit tests in command package * return allowed scope from client credential client * add device auth done reducer * carry nonce thru session into ID token * fix token exchange integration tests * allow project role scope prefix in client credentials client * gci formatting * do not return refresh token in client credentials and jwt profile * check org scope * solve linting issue on authorize callback error * end session based on v2 session ID * use preferred language and user agent ID for v2 access tokens * pin oidc v3.23.2 * add integration test for jwt profile and client credentials with org scopes * refresh token v1 to v2 * add user token v2 audit event * add activity trigger * cleanup and set panics for unused methods * use the encrypted code for v1 auth request get by code * add missing event translation * fix pipeline errors (hopefully) * fix another test * revert pointer usage of preferred language * solve browser info panic in device auth * remove duplicate entries in AMRToAuthMethodTypes to prevent future `mfa` claim * revoke v1 refresh token to prevent reuse * fix terminate oidc session * always return a new refresh toke in refresh token grant --------- Co-authored-by: Livio Spring --- go.mod | 36 +- go.sum | 72 +- internal/api/grpc/admin/feature.go | 1 - internal/api/grpc/oidc/v2/oidc.go | 2 +- internal/api/grpc/session/v2/session.go | 8 +- internal/api/oidc/access_token.go | 81 +- internal/api/oidc/amr.go | 8 +- internal/api/oidc/auth_request.go | 343 +++--- internal/api/oidc/client.go | 26 +- internal/api/oidc/client_converter.go | 48 +- internal/api/oidc/client_credentials.go | 4 +- internal/api/oidc/client_integration_test.go | 72 -- internal/api/oidc/device_auth.go | 54 +- internal/api/oidc/op.go | 3 + internal/api/oidc/server.go | 47 +- internal/api/oidc/token.go | 198 +++ internal/api/oidc/token_client_credentials.go | 51 + ...ken_client_credentials_integration_test.go | 143 +++ internal/api/oidc/token_code.go | 125 ++ internal/api/oidc/token_device.go | 46 + internal/api/oidc/token_exchange.go | 193 +-- internal/api/oidc/token_exchange_converter.go | 61 +- .../oidc/token_exchange_integration_test.go | 2 +- internal/api/oidc/token_jwt_profile.go | 99 ++ .../token_jwt_profile_integration_test.go | 103 ++ internal/api/oidc/token_refresh.go | 101 ++ internal/api/oidc/userinfo.go | 4 +- internal/api/ui/login/device_auth.go | 3 +- .../eventsourcing/eventstore/auth_request.go | 5 + .../eventstore/token_verifier.go | 21 +- internal/command/auth_request.go | 51 +- internal/command/auth_request_model.go | 2 + internal/command/auth_request_test.go | 182 +-- internal/command/device_auth.go | 107 +- internal/command/device_auth_model.go | 36 +- internal/command/device_auth_test.go | 529 ++++++++- internal/command/oidc_session.go | 358 ++++-- internal/command/oidc_session_model.go | 10 + internal/command/oidc_session_test.go | 1057 ++++++++++++----- internal/command/session.go | 10 +- internal/command/session_model.go | 6 + internal/command/session_test.go | 20 +- internal/command/user.go | 86 -- internal/command/user_converter.go | 25 - internal/command/user_human_refresh_token.go | 157 --- .../command/user_human_refresh_token_test.go | 690 ----------- internal/command/user_test.go | 86 -- internal/domain/auth_request.go | 1 + internal/domain/browser_info.go | 14 + internal/domain/device_auth.go | 1 + internal/domain/deviceauthstate_string.go | 7 +- internal/domain/oidc_error_reason.go | 25 + internal/domain/oidc_error_reason_test.go | 51 + internal/domain/token.go | 17 - internal/domain/user_agent.go | 7 + internal/domain/user_agent_test.go | 42 + internal/integration/oidc.go | 21 + internal/query/access_token.go | 37 +- internal/query/authn_key.go | 2 +- internal/query/device_auth.go | 29 - internal/query/device_auth_model.go | 59 - internal/query/device_auth_test.go | 149 --- internal/query/projection/device_auth.go | 6 +- .../repository/authrequest/auth_request.go | 59 +- internal/repository/deviceauth/device_auth.go | 62 +- internal/repository/deviceauth/eventstore.go | 1 + .../repository/oidcsession/oidc_session.go | 42 +- internal/repository/session/session.go | 11 +- internal/repository/user/eventstore.go | 1 + internal/repository/user/user.go | 34 + internal/static/i18n/bg.yaml | 1 + internal/static/i18n/cs.yaml | 1 + internal/static/i18n/de.yaml | 1 + internal/static/i18n/en.yaml | 1 + internal/static/i18n/es.yaml | 1 + internal/static/i18n/fr.yaml | 1 + internal/static/i18n/it.yaml | 1 + internal/static/i18n/ja.yaml | 1 + internal/static/i18n/mk.yaml | 1 + internal/static/i18n/nl.yaml | 1 + internal/static/i18n/pl.yaml | 1 + internal/static/i18n/pt.yaml | 1 + internal/static/i18n/ru.yaml | 1 + internal/static/i18n/zh.yaml | 1 + 84 files changed, 3429 insertions(+), 2635 deletions(-) create mode 100644 internal/api/oidc/token.go create mode 100644 internal/api/oidc/token_client_credentials.go create mode 100644 internal/api/oidc/token_client_credentials_integration_test.go create mode 100644 internal/api/oidc/token_code.go create mode 100644 internal/api/oidc/token_device.go create mode 100644 internal/api/oidc/token_jwt_profile.go create mode 100644 internal/api/oidc/token_jwt_profile_integration_test.go create mode 100644 internal/api/oidc/token_refresh.go create mode 100644 internal/domain/oidc_error_reason_test.go create mode 100644 internal/domain/user_agent_test.go delete mode 100644 internal/query/device_auth_model.go diff --git a/go.mod b/go.mod index cb443c0053..9d0da91cba 100644 --- a/go.mod +++ b/go.mod @@ -49,7 +49,7 @@ require ( github.com/nicksnyder/go-i18n/v2 v2.4.0 github.com/pquerna/otp v1.4.0 github.com/rakyll/statik v0.1.7 - github.com/rs/cors v1.10.1 + github.com/rs/cors v1.11.0 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/sony/sonyflake v1.2.0 github.com/spf13/cobra v1.8.0 @@ -58,20 +58,20 @@ require ( github.com/superseriousbusiness/exifremove v0.0.0-20210330092427-6acd27eac203 github.com/ttacon/libphonenumber v1.2.1 github.com/zitadel/logging v0.6.0 - github.com/zitadel/oidc/v3 v3.21.0 + github.com/zitadel/oidc/v3 v3.23.2 github.com/zitadel/passwap v0.5.0 github.com/zitadel/saml v0.1.3 github.com/zitadel/schema v1.3.0 - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.50.0 - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.50.0 - go.opentelemetry.io/otel v1.25.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.25.0 - go.opentelemetry.io/otel/exporters/prometheus v0.47.0 - go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.25.0 - go.opentelemetry.io/otel/metric v1.25.0 - go.opentelemetry.io/otel/sdk v1.25.0 - go.opentelemetry.io/otel/sdk/metric v1.25.0 - go.opentelemetry.io/otel/trace v1.25.0 + go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.51.0 + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.51.0 + go.opentelemetry.io/otel v1.26.0 + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.26.0 + go.opentelemetry.io/otel/exporters/prometheus v0.48.0 + go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.26.0 + go.opentelemetry.io/otel/metric v1.26.0 + go.opentelemetry.io/otel/sdk v1.26.0 + go.opentelemetry.io/otel/sdk/metric v1.26.0 + go.opentelemetry.io/otel/trace v1.26.0 go.uber.org/mock v0.4.0 golang.org/x/crypto v0.22.0 golang.org/x/exp v0.0.0-20240409090435-93d18d7e34b8 @@ -80,9 +80,9 @@ require ( golang.org/x/sync v0.7.0 golang.org/x/text v0.14.0 google.golang.org/api v0.172.0 - google.golang.org/genproto/googleapis/api v0.0.0-20240412170617-26222e5d3d56 + google.golang.org/genproto/googleapis/api v0.0.0-20240429193739-8cf5692501f6 google.golang.org/grpc v1.63.2 - google.golang.org/protobuf v1.33.0 + google.golang.org/protobuf v1.34.0 sigs.k8s.io/yaml v1.4.0 ) @@ -116,7 +116,7 @@ require ( go.uber.org/multierr v1.11.0 // indirect golang.org/x/time v0.5.0 // indirect google.golang.org/genproto v0.0.0-20240412170617-26222e5d3d56 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20240412170617-26222e5d3d56 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20240429193739-8cf5692501f6 // indirect ) require ( @@ -183,8 +183,8 @@ require ( github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/prometheus/client_golang v1.19.0 github.com/prometheus/client_model v0.6.1 // indirect - github.com/prometheus/common v0.52.3 // indirect - github.com/prometheus/procfs v0.13.0 // indirect + github.com/prometheus/common v0.53.0 // indirect + github.com/prometheus/procfs v0.14.0 // indirect github.com/rs/xid v1.5.0 // indirect github.com/russellhaering/goxmldsig v1.4.0 // indirect github.com/sirupsen/logrus v1.9.3 @@ -196,7 +196,7 @@ require ( github.com/x448/float16 v0.8.4 // indirect github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect go.opencensus.io v0.24.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.25.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.26.0 // indirect go.opentelemetry.io/proto/otlp v1.2.0 // indirect golang.org/x/sys v0.19.0 gopkg.in/ini.v1 v1.67.0 // indirect diff --git a/go.sum b/go.sum index 85420a32f2..dd1521bb3f 100644 --- a/go.sum +++ b/go.sum @@ -618,16 +618,16 @@ github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8 github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA= github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.15.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s= -github.com/prometheus/common v0.52.3 h1:5f8uj6ZwHSscOGNdIQg6OiZv/ybiK2CO2q2drVZAQSA= -github.com/prometheus/common v0.52.3/go.mod h1:BrxBKv3FWBIGXw89Mg1AeBq7FSyRzXWI3l3e7W3RN5U= +github.com/prometheus/common v0.53.0 h1:U2pL9w9nmJwJDa4qqLQ3ZaePJ6ZTwt7cMD3AG3+aLCE= +github.com/prometheus/common v0.53.0/go.mod h1:BrxBKv3FWBIGXw89Mg1AeBq7FSyRzXWI3l3e7W3RN5U= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A= github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= github.com/prometheus/procfs v0.3.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= -github.com/prometheus/procfs v0.13.0 h1:GqzLlQyfsPbaEHaQkO7tbDlriv/4o5Hudv6OXHGKX7o= -github.com/prometheus/procfs v0.13.0/go.mod h1:cd4PFCR54QLnGKPaKGA6l+cfuNXtht43ZKY6tow0Y1g= +github.com/prometheus/procfs v0.14.0 h1:Lw4VdGGoKEZilJsayHf0B+9YgLGREba2C6xr+Fdfq6s= +github.com/prometheus/procfs v0.14.0/go.mod h1:XL+Iwz8k8ZabyZfMFHPiilCniixqQarAy5Mu67pHlNQ= github.com/rakyll/statik v0.1.7 h1:OF3QCZUuyPxuGEP7B4ypUa7sB/iHtqOTDYZXGM8KOdQ= github.com/rakyll/statik v0.1.7/go.mod h1:AlZONWzMtEnMs7W4e/1LURLiI49pIMmp6V9Unghqrcc= github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4= @@ -639,8 +639,8 @@ github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6po github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog= github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU= -github.com/rs/cors v1.10.1 h1:L0uuZVXIKlI1SShY2nhFfo44TYvDPQ1w4oFkUJNfhyo= -github.com/rs/cors v1.10.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= +github.com/rs/cors v1.11.0 h1:0B9GE/r9Bc2UxRMMtymBkHTenPkHDv0CW4Y98GBY+po= +github.com/rs/cors v1.11.0/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc= github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg= github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys= @@ -731,8 +731,8 @@ github.com/zenazn/goji v1.0.1 h1:4lbD8Mx2h7IvloP7r2C0D6ltZP6Ufip8Hn0wmSK5LR8= github.com/zenazn/goji v1.0.1/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q= github.com/zitadel/logging v0.6.0 h1:t5Nnt//r+m2ZhhoTmoPX+c96pbMarqJvW1Vq6xFTank= github.com/zitadel/logging v0.6.0/go.mod h1:Y4CyAXHpl3Mig6JOszcV5Rqqsojj+3n7y2F591Mp/ow= -github.com/zitadel/oidc/v3 v3.21.0 h1:dvhPLAOCJQHxZq+1vqd2+TYu1EzwrHhnPSSh4nVamgo= -github.com/zitadel/oidc/v3 v3.21.0/go.mod h1:3uCwJc680oWoTBdzIppMZQS+VNxq+sVcwgodbreuatM= +github.com/zitadel/oidc/v3 v3.23.2 h1:vRUM6SKudr6WR/lqxue4cvCbgR+IdEJGVBklucKKXgk= +github.com/zitadel/oidc/v3 v3.23.2/go.mod h1:9snlhm3W/GNURqxtchjL1AAuClWRZ2NTkn9sLs1WYfM= github.com/zitadel/passwap v0.5.0 h1:kFMoRyo0GnxtOz7j9+r/CsRwSCjHGRaAKoUe69NwPvs= github.com/zitadel/passwap v0.5.0/go.mod h1:uqY7D3jqdTFcKsW0Q3Pcv5qDMmSHpVTzUZewUKC1KZA= github.com/zitadel/saml v0.1.3 h1:LI4DOCVyyU1qKPkzs3vrGcA5J3H4pH3+CL9zr9ShkpM= @@ -746,28 +746,28 @@ go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk= go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0= go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.50.0 h1:zvpPXY7RfYAGSdYQLjp6zxdJNSYD/+FFoCTQN9IPxBs= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.50.0/go.mod h1:BMn8NB1vsxTljvuorms2hyOs8IBuuBEq0pl7ltOfy30= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.50.0 h1:cEPbyTSEHlQR89XVlyo78gqluF8Y3oMeBkXGWzQsfXY= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.50.0/go.mod h1:DKdbWcT4GH1D0Y3Sqt/PFXt2naRKDWtU+eE6oLdFNA8= -go.opentelemetry.io/otel v1.25.0 h1:gldB5FfhRl7OJQbUHt/8s0a7cE8fbsPAtdpRaApKy4k= -go.opentelemetry.io/otel v1.25.0/go.mod h1:Wa2ds5NOXEMkCmUou1WA7ZBfLTHWIsp034OVD7AO+Vg= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.25.0 h1:dT33yIHtmsqpixFsSQPwNeY5drM9wTcoL8h0FWF4oGM= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.25.0/go.mod h1:h95q0LBGh7hlAC08X2DhSeyIG02YQ0UyioTCVAqRPmc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.25.0 h1:vOL89uRfOCCNIjkisd0r7SEdJF3ZJFyCNY34fdZs8eU= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.25.0/go.mod h1:8GlBGcDk8KKi7n+2S4BT/CPZQYH3erLu0/k64r1MYgo= -go.opentelemetry.io/otel/exporters/prometheus v0.47.0 h1:OL6yk1Z/pEGdDnrBbxSsH+t4FY1zXfBRGd7bjwhlMLU= -go.opentelemetry.io/otel/exporters/prometheus v0.47.0/go.mod h1:xF3N4OSICZDVbbYZydz9MHFro1RjmkPUKEvar2utG+Q= -go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.25.0 h1:0vZZdECYzhTt9MKQZ5qQ0V+J3MFu4MQaQ3COfugF+FQ= -go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.25.0/go.mod h1:e7iXx3HjaSSBXfy9ykVUlupS2Vp7LBIBuT21ousM2Hk= -go.opentelemetry.io/otel/metric v1.25.0 h1:LUKbS7ArpFL/I2jJHdJcqMGxkRdxpPHE0VU/D4NuEwA= -go.opentelemetry.io/otel/metric v1.25.0/go.mod h1:rkDLUSd2lC5lq2dFNrX9LGAbINP5B7WBkC78RXCpH5s= -go.opentelemetry.io/otel/sdk v1.25.0 h1:PDryEJPC8YJZQSyLY5eqLeafHtG+X7FWnf3aXMtxbqo= -go.opentelemetry.io/otel/sdk v1.25.0/go.mod h1:oFgzCM2zdsxKzz6zwpTZYLLQsFwc+K0daArPdIhuxkw= -go.opentelemetry.io/otel/sdk/metric v1.25.0 h1:7CiHOy08LbrxMAp4vWpbiPcklunUshVpAvGBrdDRlGw= -go.opentelemetry.io/otel/sdk/metric v1.25.0/go.mod h1:LzwoKptdbBBdYfvtGCzGwk6GWMA3aUzBOwtQpR6Nz7o= -go.opentelemetry.io/otel/trace v1.25.0 h1:tqukZGLwQYRIFtSQM2u2+yfMVTgGVeqRLPUYx1Dq6RM= -go.opentelemetry.io/otel/trace v1.25.0/go.mod h1:hCCs70XM/ljO+BeQkyFnbK28SBIJ/Emuha+ccrCRT7I= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.51.0 h1:A3SayB3rNyt+1S6qpI9mHPkeHTZbD7XILEqWnYZb2l0= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.51.0/go.mod h1:27iA5uvhuRNmalO+iEUdVn5ZMj2qy10Mm+XRIpRmyuU= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.51.0 h1:Xs2Ncz0gNihqu9iosIZ5SkBbWo5T8JhhLJFMQL1qmLI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.51.0/go.mod h1:vy+2G/6NvVMpwGX/NyLqcC41fxepnuKHk16E6IZUcJc= +go.opentelemetry.io/otel v1.26.0 h1:LQwgL5s/1W7YiiRwxf03QGnWLb2HW4pLiAhaA5cZXBs= +go.opentelemetry.io/otel v1.26.0/go.mod h1:UmLkJHUAidDval2EICqBMbnAd0/m2vmpf/dAM+fvFs4= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.26.0 h1:1u/AyyOqAWzy+SkPxDpahCNZParHV8Vid1RnI2clyDE= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.26.0/go.mod h1:z46paqbJ9l7c9fIPCXTqTGwhQZ5XoTIsfeFYWboizjs= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.26.0 h1:Waw9Wfpo/IXzOI8bCB7DIk+0JZcqqsyn1JFnAc+iam8= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.26.0/go.mod h1:wnJIG4fOqyynOnnQF/eQb4/16VlX2EJAHhHgqIqWfAo= +go.opentelemetry.io/otel/exporters/prometheus v0.48.0 h1:sBQe3VNGUjY9IKWQC6z2lNqa5iGbDSxhs60ABwK4y0s= +go.opentelemetry.io/otel/exporters/prometheus v0.48.0/go.mod h1:DtrbMzoZWwQHyrQmCfLam5DZbnmorsGbOtTbYHycU5o= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.26.0 h1:0W5o9SzoR15ocYHEQfvfipzcNog1lBxOLfnex91Hk6s= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.26.0/go.mod h1:zVZ8nz+VSggWmnh6tTsJqXQ7rU4xLwRtna1M4x5jq58= +go.opentelemetry.io/otel/metric v1.26.0 h1:7S39CLuY5Jgg9CrnA9HHiEjGMF/X2VHvoXGgSllRz30= +go.opentelemetry.io/otel/metric v1.26.0/go.mod h1:SY+rHOI4cEawI9a7N1A4nIg/nTQXe1ccCNWYOJUrpX4= +go.opentelemetry.io/otel/sdk v1.26.0 h1:Y7bumHf5tAiDlRYFmGqetNcLaVUZmh4iYfmGxtmz7F8= +go.opentelemetry.io/otel/sdk v1.26.0/go.mod h1:0p8MXpqLeJ0pzcszQQN4F0S5FVjBLgypeGSngLsmirs= +go.opentelemetry.io/otel/sdk/metric v1.26.0 h1:cWSks5tfriHPdWFnl+qpX3P681aAYqlZHcAyHw5aU9Y= +go.opentelemetry.io/otel/sdk/metric v1.26.0/go.mod h1:ClMFFknnThJCksebJwz7KIyEDHO+nTB6gK8obLy8RyE= +go.opentelemetry.io/otel/trace v1.26.0 h1:1ieeAUb4y0TE26jUFrCIXKpTuVK7uJGN9/Z/2LP5sQA= +go.opentelemetry.io/otel/trace v1.26.0/go.mod h1:4iDxvGDQuUkHve82hJJ8UqrwswHYsZuWCBllGV2U2y0= go.opentelemetry.io/proto/otlp v1.2.0 h1:pVeZGk7nXDC9O2hncA6nHldxEjm6LByfA2aN8IOkz94= go.opentelemetry.io/proto/otlp v1.2.0/go.mod h1:gGpR8txAl5M03pDhMC79G6SdqNV26naRm/KDsgaHD8A= go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE= @@ -991,10 +991,10 @@ google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEY google.golang.org/genproto v0.0.0-20210126160654-44e461bb6506/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20240412170617-26222e5d3d56 h1:LlcUFJ4BLmJVS4Kly+WCK7LQqcevmycHj88EPgyhNx8= google.golang.org/genproto v0.0.0-20240412170617-26222e5d3d56/go.mod h1:n1CaIKYMIlxFt1zJE/1kU40YpSL0drGMbl0Idum1VSs= -google.golang.org/genproto/googleapis/api v0.0.0-20240412170617-26222e5d3d56 h1:KuFzeG+qPmpT8KpJXcrKAyeHhn64dgEICWlccP9qp0U= -google.golang.org/genproto/googleapis/api v0.0.0-20240412170617-26222e5d3d56/go.mod h1:wTHjrkbcS8AoQbb/0v9bFIPItZQPAsyVfgG9YPUhjAM= -google.golang.org/genproto/googleapis/rpc v0.0.0-20240412170617-26222e5d3d56 h1:zviK8GX4VlMstrK3JkexM5UHjH1VOkRebH9y3jhSBGk= -google.golang.org/genproto/googleapis/rpc v0.0.0-20240412170617-26222e5d3d56/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY= +google.golang.org/genproto/googleapis/api v0.0.0-20240429193739-8cf5692501f6 h1:DTJM0R8LECCgFeUwApvcEJHz85HLagW8uRENYxHh1ww= +google.golang.org/genproto/googleapis/api v0.0.0-20240429193739-8cf5692501f6/go.mod h1:10yRODfgim2/T8csjQsMPgZOMvtytXKTDRzH6HRGzRw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20240429193739-8cf5692501f6 h1:DujSIu+2tC9Ht0aPNA7jgj23Iq8Ewi5sgkQ++wdvonE= +google.golang.org/genproto/googleapis/rpc v0.0.0-20240429193739-8cf5692501f6/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY= google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.0/go.mod h1:chYK+tFQF0nDUGJgXMSgLCQk3phJEuONr2DCgLDdAQM= @@ -1022,8 +1022,8 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4= google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= -google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI= -google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= +google.golang.org/protobuf v1.34.0 h1:Qo/qEd2RZPCf2nKuorzksSknv0d3ERwp1vFG38gSmH4= +google.golang.org/protobuf v1.34.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/internal/api/grpc/admin/feature.go b/internal/api/grpc/admin/feature.go index a63825171a..cac9d99f28 100644 --- a/internal/api/grpc/admin/feature.go +++ b/internal/api/grpc/admin/feature.go @@ -4,7 +4,6 @@ import ( "context" "github.com/muhlemmer/gu" - "github.com/zitadel/logging" object_pb "github.com/zitadel/zitadel/internal/api/grpc/object" diff --git a/internal/api/grpc/oidc/v2/oidc.go b/internal/api/grpc/oidc/v2/oidc.go index 258ebd6a69..7a13c7ea99 100644 --- a/internal/api/grpc/oidc/v2/oidc.go +++ b/internal/api/grpc/oidc/v2/oidc.go @@ -112,7 +112,7 @@ func (s *Server) linkSessionToAuthRequest(ctx context.Context, authRequestID str if aar.ResponseType == domain.OIDCResponseTypeCode { callback, err = oidc.CreateCodeCallbackURL(ctx, authReq, s.op.Provider()) } else { - callback, err = oidc.CreateTokenCallbackURL(ctx, authReq, s.op.Provider()) + callback, err = s.op.CreateTokenCallbackURL(ctx, authReq) } if err != nil { return nil, err diff --git a/internal/api/grpc/session/v2/session.go b/internal/api/grpc/session/v2/session.go index df07602e85..6fac6a8727 100644 --- a/internal/api/grpc/session/v2/session.go +++ b/internal/api/grpc/session/v2/session.go @@ -7,6 +7,7 @@ import ( "time" "github.com/muhlemmer/gu" + "golang.org/x/text/language" "google.golang.org/protobuf/types/known/structpb" "google.golang.org/protobuf/types/known/timestamppb" @@ -352,7 +353,12 @@ func (s *Server) checksToCommand(ctx context.Context, checks *session.Checks) ([ if !user.State.IsEnabled() { return nil, zerrors.ThrowPreconditionFailed(nil, "SESSION-Gj4ko", "Errors.User.NotActive") } - sessionChecks = append(sessionChecks, command.CheckUser(user.ID, user.ResourceOwner)) + + var preferredLanguage *language.Tag + if user.Human != nil && !user.Human.PreferredLanguage.IsRoot() { + preferredLanguage = &user.Human.PreferredLanguage + } + sessionChecks = append(sessionChecks, command.CheckUser(user.ID, user.ResourceOwner, preferredLanguage)) } if password := checks.GetPassword(); password != nil { sessionChecks = append(sessionChecks, command.CheckPassword(password.GetPassword())) diff --git a/internal/api/oidc/access_token.go b/internal/api/oidc/access_token.go index fce600b62b..4ac1646edf 100644 --- a/internal/api/oidc/access_token.go +++ b/internal/api/oidc/access_token.go @@ -6,8 +6,10 @@ import ( "strings" "time" + "github.com/muhlemmer/gu" "github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/op" + "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/command" @@ -19,19 +21,20 @@ import ( ) type accessToken struct { - tokenID string - userID string - resourceOwner string - subject string - clientID string - audience []string - scope []string - authMethods []domain.UserAuthMethodType - authTime time.Time - tokenCreation time.Time - tokenExpiration time.Time - isPAT bool - actor *domain.TokenActor + tokenID string + userID string + resourceOwner string + subject string + preferredLanguage *language.Tag + clientID string + audience []string + scope []string + authMethods []domain.UserAuthMethodType + authTime time.Time + tokenCreation time.Time + tokenExpiration time.Time + isPAT bool + actor *domain.TokenActor } var ErrInvalidTokenFormat = errors.New("invalid token format") @@ -73,35 +76,41 @@ func (s *Server) verifyAccessToken(ctx context.Context, tkn string) (_ *accessTo } func accessTokenV1(tokenID, subject string, token *model.TokenView) *accessToken { + var preferredLanguage *language.Tag + if token.PreferredLanguage != "" { + preferredLanguage = gu.Ptr(language.Make(token.PreferredLanguage)) + } return &accessToken{ - tokenID: tokenID, - userID: token.UserID, - resourceOwner: token.ResourceOwner, - subject: subject, - clientID: token.ApplicationID, - audience: token.Audience, - scope: token.Scopes, - tokenCreation: token.CreationDate, - tokenExpiration: token.Expiration, - isPAT: token.IsPAT, - actor: token.Actor, + tokenID: tokenID, + userID: token.UserID, + resourceOwner: token.ResourceOwner, + subject: subject, + preferredLanguage: preferredLanguage, + clientID: token.ApplicationID, + audience: token.Audience, + scope: token.Scopes, + tokenCreation: token.CreationDate, + tokenExpiration: token.Expiration, + isPAT: token.IsPAT, + actor: token.Actor, } } func accessTokenV2(tokenID, subject string, token *query.OIDCSessionAccessTokenReadModel) *accessToken { return &accessToken{ - tokenID: tokenID, - userID: token.UserID, - resourceOwner: token.ResourceOwner, - subject: subject, - clientID: token.ClientID, - audience: token.Audience, - scope: token.Scope, - authMethods: token.AuthMethods, - authTime: token.AuthTime, - tokenCreation: token.AccessTokenCreation, - tokenExpiration: token.AccessTokenExpiration, - actor: token.Actor, + tokenID: tokenID, + userID: token.UserID, + resourceOwner: token.ResourceOwner, + subject: subject, + preferredLanguage: token.PreferredLanguage, + clientID: token.ClientID, + audience: token.Audience, + scope: token.Scope, + authMethods: token.AuthMethods, + authTime: token.AuthTime, + tokenCreation: token.AccessTokenCreation, + tokenExpiration: token.AccessTokenExpiration, + actor: token.Actor, } } diff --git a/internal/api/oidc/amr.go b/internal/api/oidc/amr.go index 4f773f1759..83856af99b 100644 --- a/internal/api/oidc/amr.go +++ b/internal/api/oidc/amr.go @@ -1,6 +1,10 @@ package oidc -import "github.com/zitadel/zitadel/internal/domain" +import ( + "slices" + + "github.com/zitadel/zitadel/internal/domain" +) const ( // Password states that the users password has been verified @@ -87,5 +91,5 @@ func AMRToAuthMethodTypes(amr []string) []domain.UserAuthMethodType { authMethods = append(authMethods, domain.UserAuthMethodTypeU2F) } } - return authMethods + return slices.Compact(authMethods) // remove duplicate entries } diff --git a/internal/api/oidc/auth_request.go b/internal/api/oidc/auth_request.go index 7cb7ca7af0..130b515251 100644 --- a/internal/api/oidc/auth_request.go +++ b/internal/api/oidc/auth_request.go @@ -3,14 +3,17 @@ package oidc import ( "context" "encoding/base64" + "fmt" + "net/http" + "slices" "strings" "time" "github.com/zitadel/logging" "github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/op" + "golang.org/x/text/language" - "github.com/zitadel/zitadel/internal/activity" "github.com/zitadel/zitadel/internal/api/authz" http_utils "github.com/zitadel/zitadel/internal/api/http" "github.com/zitadel/zitadel/internal/api/http/middleware" @@ -64,18 +67,19 @@ func (o *OPStorage) createAuthRequestLoginClient(ctx context.Context, req *oidc. return nil, err } authRequest := &command.AuthRequest{ - LoginClient: loginClient, - ClientID: req.ClientID, - RedirectURI: req.RedirectURI, - State: req.State, - Nonce: req.Nonce, - Scope: scope, - Audience: audience, - ResponseType: ResponseTypeToBusiness(req.ResponseType), - CodeChallenge: CodeChallengeToBusiness(req.CodeChallenge, req.CodeChallengeMethod), - Prompt: PromptToBusiness(req.Prompt), - UILocales: UILocalesToBusiness(req.UILocales), - MaxAge: MaxAgeToBusiness(req.MaxAge), + LoginClient: loginClient, + ClientID: req.ClientID, + RedirectURI: req.RedirectURI, + State: req.State, + Nonce: req.Nonce, + Scope: scope, + Audience: audience, + NeedRefreshToken: slices.Contains(scope, oidc.ScopeOfflineAccess), + ResponseType: ResponseTypeToBusiness(req.ResponseType), + CodeChallenge: CodeChallengeToBusiness(req.CodeChallenge, req.CodeChallengeMethod), + Prompt: PromptToBusiness(req.Prompt), + UILocales: UILocalesToBusiness(req.UILocales), + MaxAge: MaxAgeToBusiness(req.MaxAge), } if req.LoginHint != "" { authRequest.LoginHint = &req.LoginHint @@ -149,28 +153,7 @@ func (o *OPStorage) AuthRequestByID(ctx context.Context, id string) (_ op.AuthRe } func (o *OPStorage) AuthRequestByCode(ctx context.Context, code string) (_ op.AuthRequest, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { - err = oidcError(err) - span.EndWithError(err) - }() - - plainCode, err := o.decryptGrant(code) - if err != nil { - return nil, zerrors.ThrowInvalidArgument(err, "OIDC-ahLi2", "Errors.User.Code.Invalid") - } - if strings.HasPrefix(plainCode, command.IDPrefixV2) { - authReq, err := o.command.ExchangeAuthCode(ctx, plainCode) - if err != nil { - return nil, err - } - return &AuthRequestV2{authReq}, nil - } - resp, err := o.repo.AuthRequestByCode(ctx, code) - if err != nil { - return nil, err - } - return AuthRequestFromBusiness(resp) + panic(o.panicErr("AuthRequestByCode")) } // decryptGrant decrypts a code or refresh_token @@ -201,136 +184,40 @@ func (o *OPStorage) SaveAuthCode(ctx context.Context, id, code string) (err erro } func (o *OPStorage) DeleteAuthRequest(ctx context.Context, id string) (err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { - err = oidcError(err) - span.EndWithError(err) - }() - - return o.repo.DeleteAuthRequest(ctx, id) + panic(o.panicErr("DeleteAuthRequest")) } -func (o *OPStorage) CreateAccessToken(ctx context.Context, req op.TokenRequest) (_ string, _ time.Time, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { - err = oidcError(err) - span.EndWithError(err) - }() - if authReq, ok := req.(*AuthRequestV2); ok { - activity.Trigger(ctx, "", authReq.CurrentAuthRequest.UserID, activity.OIDCAccessToken, o.eventstore.FilterToQueryReducer) - return o.command.AddOIDCSessionAccessToken(setContextUserSystem(ctx), authReq.GetID()) - } - - userAgentID, applicationID, userOrgID, authTime, amr, reason, actor := getInfoFromRequest(req) - accessTokenLifetime, _, _, _, err := o.getOIDCSettings(ctx) - if err != nil { - return "", time.Time{}, err - } - - resp, err := o.command.AddUserToken(setContextUserSystem(ctx), userOrgID, userAgentID, applicationID, req.GetSubject(), req.GetAudience(), req.GetScopes(), amr, accessTokenLifetime, authTime, reason, actor) - if err != nil { - return "", time.Time{}, err - } - - // trigger activity log for authentication for user - activity.Trigger(ctx, userOrgID, req.GetSubject(), activity.OIDCAccessToken, o.eventstore.FilterToQueryReducer) - return resp.TokenID, resp.Expiration, nil +func (o *OPStorage) CreateAccessToken(ctx context.Context, req op.TokenRequest) (string, time.Time, error) { + panic(o.panicErr("CreateAccessToken")) } -func (o *OPStorage) CreateAccessAndRefreshTokens(ctx context.Context, req op.TokenRequest, refreshToken string) (_, _ string, _ time.Time, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { - err = oidcError(err) - span.EndWithError(err) - }() - - // handle V2 request directly - switch tokenReq := req.(type) { - case *AuthRequestV2: - // trigger activity log for authentication for user - activity.Trigger(ctx, "", tokenReq.GetSubject(), activity.OIDCRefreshToken, o.eventstore.FilterToQueryReducer) - return o.command.AddOIDCSessionRefreshAndAccessToken(setContextUserSystem(ctx), tokenReq.GetID()) - case *RefreshTokenRequestV2: - // trigger activity log for authentication for user - activity.Trigger(ctx, "", tokenReq.GetSubject(), activity.OIDCRefreshToken, o.eventstore.FilterToQueryReducer) - return o.command.ExchangeOIDCSessionRefreshAndAccessToken(setContextUserSystem(ctx), tokenReq.OIDCSessionWriteModel.AggregateID, refreshToken, tokenReq.RequestedScopes) - } - - userAgentID, applicationID, userOrgID, authTime, authMethodsReferences, reason, actor := getInfoFromRequest(req) - scopes, err := o.assertProjectRoleScopes(ctx, applicationID, req.GetScopes()) - if err != nil { - return "", "", time.Time{}, zerrors.ThrowPreconditionFailed(err, "OIDC-Df2fq", "Errors.Internal") - } - if request, ok := req.(op.RefreshTokenRequest); ok { - request.SetCurrentScopes(scopes) - } - - accessTokenLifetime, _, refreshTokenIdleExpiration, refreshTokenExpiration, err := o.getOIDCSettings(ctx) - if err != nil { - return "", "", time.Time{}, err - } - - resp, token, err := o.command.AddAccessAndRefreshToken(setContextUserSystem(ctx), userOrgID, userAgentID, applicationID, req.GetSubject(), - refreshToken, req.GetAudience(), scopes, authMethodsReferences, accessTokenLifetime, - refreshTokenIdleExpiration, refreshTokenExpiration, authTime, reason, actor) //PLANNED: lifetime from client - if err != nil { - if zerrors.IsErrorInvalidArgument(err) { - err = oidc.ErrInvalidGrant().WithParent(err) - } - return "", "", time.Time{}, err - } - - // trigger activity log for authentication for user - activity.Trigger(ctx, userOrgID, req.GetSubject(), activity.OIDCRefreshToken, o.eventstore.FilterToQueryReducer) - return resp.TokenID, token, resp.Expiration, nil +func (o *OPStorage) CreateAccessAndRefreshTokens(context.Context, op.TokenRequest, string) (string, string, time.Time, error) { + panic(o.panicErr("CreateAccessAndRefreshTokens")) } -func getInfoFromRequest(req op.TokenRequest) (agentID string, clientID string, userOrgID string, authTime time.Time, amr []string, reason domain.TokenReason, actor *domain.TokenActor) { +func (*OPStorage) panicErr(method string) error { + return fmt.Errorf("OPStorage.%s should not be called anymore. This is a bug. Please report https://github.com/zitadel/zitadel/issues", method) +} + +func getInfoFromRequest(req op.TokenRequest) (agentID, clientID, userOrgID string, authTime time.Time, amr []string, preferredLanguage *language.Tag, reason domain.TokenReason, actor *domain.TokenActor) { switch r := req.(type) { case *AuthRequest: - return r.AgentID, r.ApplicationID, r.UserOrgID, r.AuthTime, r.GetAMR(), domain.TokenReasonAuthRequest, nil + return r.AgentID, r.ApplicationID, r.UserOrgID, r.AuthTime, r.GetAMR(), r.PreferredLanguage, domain.TokenReasonAuthRequest, nil case *RefreshTokenRequest: - return r.UserAgentID, r.ClientID, "", r.AuthTime, r.AuthMethodsReferences, domain.TokenReasonRefresh, r.Actor + return r.UserAgentID, r.ClientID, "", r.AuthTime, r.AuthMethodsReferences, nil, domain.TokenReasonRefresh, r.Actor case op.IDTokenRequest: - return "", r.GetClientID(), "", r.GetAuthTime(), r.GetAMR(), domain.TokenReasonAuthRequest, nil + return "", r.GetClientID(), "", r.GetAuthTime(), r.GetAMR(), nil, domain.TokenReasonAuthRequest, nil case *oidc.JWTTokenRequest: - return "", "", "", r.GetAuthTime(), nil, domain.TokenReasonJWTProfile, nil + return "", "", "", r.GetAuthTime(), nil, nil, domain.TokenReasonJWTProfile, nil case *clientCredentialsRequest: - return "", "", "", time.Time{}, nil, domain.TokenReasonClientCredentials, nil + return "", "", "", time.Time{}, nil, nil, domain.TokenReasonClientCredentials, nil default: - return "", "", "", time.Time{}, nil, domain.TokenReasonAuthRequest, nil + return "", "", "", time.Time{}, nil, nil, domain.TokenReasonAuthRequest, nil } } func (o *OPStorage) TokenRequestByRefreshToken(ctx context.Context, refreshToken string) (_ op.RefreshTokenRequest, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { - err = oidcError(err) - span.EndWithError(err) - }() - - plainToken, err := o.decryptGrant(refreshToken) - if err != nil { - return nil, op.ErrInvalidRefreshToken - } - if strings.HasPrefix(plainToken, command.IDPrefixV2) { - oidcSession, err := o.command.OIDCSessionByRefreshToken(ctx, plainToken) - if err != nil { - return nil, err - } - // trigger activity log for authentication for user - activity.Trigger(ctx, "", oidcSession.UserID, activity.OIDCRefreshToken, o.eventstore.FilterToQueryReducer) - return &RefreshTokenRequestV2{OIDCSessionWriteModel: oidcSession}, nil - } - - tokenView, err := o.repo.RefreshTokenByToken(ctx, refreshToken) - if err != nil { - return nil, err - } - - // trigger activity log for use of refresh token for user - activity.Trigger(ctx, tokenView.ResourceOwner, tokenView.UserID, activity.OIDCRefreshToken, o.eventstore.FilterToQueryReducer) - return RefreshTokenRequestFromBusiness(tokenView), nil + panic("TokenRequestByRefreshToken should not be called anymore. This is a bug. Please report https://github.com/zitadel/zitadel/issues") } func (o *OPStorage) TerminateSession(ctx context.Context, userID, clientID string) (err error) { @@ -368,18 +255,19 @@ func (o *OPStorage) TerminateSessionFromRequest(ctx context.Context, endSessionR }() // check for the login client header - // and if not provided, terminate the session using the V1 method headers, _ := http_utils.HeadersFromCtx(ctx) - if loginClient := headers.Get(LoginClientHeader); loginClient == "" { - return endSessionRequest.RedirectURI, o.TerminateSession(ctx, endSessionRequest.UserID, endSessionRequest.ClientID) - } - - // in case there are not id_token_hint, redirect to the UI and let it decide which session to terminate - if endSessionRequest.IDTokenHintClaims == nil { + // in case there is no id_token_hint, redirect to the UI and let it decide which session to terminate + if headers.Get(LoginClientHeader) != "" && endSessionRequest.IDTokenHintClaims == nil { return o.defaultLogoutURLV2 + endSessionRequest.RedirectURI, nil } - // terminate the session of the id_token_hint + // If there is no login client header and no id_token_hint or the id_token_hint does not have a session ID, + // do a v1 Terminate session. + if endSessionRequest.IDTokenHintClaims == nil || endSessionRequest.IDTokenHintClaims.SessionID == "" { + return endSessionRequest.RedirectURI, o.TerminateSession(ctx, endSessionRequest.UserID, endSessionRequest.ClientID) + } + + // terminate the v2 session of the id_token_hint _, err = o.command.TerminateSessionWithoutTokenCheck(ctx, endSessionRequest.IDTokenHintClaims.SessionID) if err != nil { return "", err @@ -543,18 +431,6 @@ func setContextUserSystem(ctx context.Context) context.Context { return authz.SetCtxData(ctx, data) } -func (o *OPStorage) getOIDCSettings(ctx context.Context) (accessTokenLifetime, idTokenLifetime, refreshTokenIdleExpiration, refreshTokenExpiration time.Duration, _ error) { - oidcSettings, err := o.query.OIDCSettingsByAggID(ctx, authz.GetInstance(ctx).InstanceID()) - if err != nil && !zerrors.IsNotFound(err) { - return time.Duration(0), time.Duration(0), time.Duration(0), time.Duration(0), err - } - - if oidcSettings != nil { - return oidcSettings.AccessTokenLifetime, oidcSettings.IdTokenLifetime, oidcSettings.RefreshTokenIdleExpiration, oidcSettings.RefreshTokenExpiration, nil - } - return o.defaultAccessTokenLifetime, o.defaultIdTokenLifetime, o.defaultRefreshTokenIdleExpiration, o.defaultRefreshTokenExpiration, nil -} - func CreateErrorCallbackURL(authReq op.AuthRequest, reason, description, uri string, authorizer op.Authorizer) (string, error) { e := struct { Error string `schema:"error"` @@ -593,19 +469,140 @@ func CreateCodeCallbackURL(ctx context.Context, authReq op.AuthRequest, authoriz return callback, err } -func CreateTokenCallbackURL(ctx context.Context, req op.AuthRequest, authorizer op.Authorizer) (string, error) { - client, err := authorizer.Storage().GetClientByClientID(ctx, req.GetClientID()) +func (s *Server) CreateTokenCallbackURL(ctx context.Context, req op.AuthRequest) (string, error) { + provider := s.Provider() + opClient, err := provider.Storage().GetClientByClientID(ctx, req.GetClientID()) if err != nil { return "", err } - createAccessToken := req.GetResponseType() != oidc.ResponseTypeIDTokenOnly - resp, err := op.CreateTokenResponse(ctx, req, client, authorizer, createAccessToken, "", "") + client, ok := opClient.(*Client) + if !ok { + return "", zerrors.ThrowInternal(nil, "OIDC-waeN6", "Error.Internal") + } + + session, state, err := s.command.CreateOIDCSessionFromAuthRequest( + setContextUserSystem(ctx), + req.GetID(), + implicitFlowComplianceChecker(), + slices.Contains(client.GrantTypes(), oidc.GrantTypeRefreshToken), + ) if err != nil { return "", err } - callback, err := op.AuthResponseURL(req.GetRedirectURI(), req.GetResponseType(), req.GetResponseMode(), resp, authorizer.Encoder()) + resp, err := s.accessTokenResponseFromSession(ctx, client, session, state, client.client.ProjectID, client.client.ProjectRoleAssertion) + if err != nil { + return "", err + } + callback, err := op.AuthResponseURL(req.GetRedirectURI(), req.GetResponseType(), req.GetResponseMode(), resp, provider.Encoder()) if err != nil { return "", err } return callback, err } + +func implicitFlowComplianceChecker() command.AuthRequestComplianceChecker { + return func(_ context.Context, authReq *command.AuthRequestWriteModel) error { + if err := authReq.CheckAuthenticated(); err != nil { + return err + } + return nil + } +} + +func (s *Server) authorizeCallbackHandler(w http.ResponseWriter, r *http.Request) { + authorizer := s.Provider() + authReq, err := func() (authReq op.AuthRequest, err error) { + ctx, span := tracing.NewSpan(r.Context()) + r = r.WithContext(ctx) + defer func() { span.EndWithError(err) }() + + id, err := op.ParseAuthorizeCallbackRequest(r) + if err != nil { + return nil, err + } + authReq, err = authorizer.Storage().AuthRequestByID(r.Context(), id) + if err != nil { + return nil, err + } + if !authReq.Done() { + return authReq, oidc.ErrInteractionRequired().WithDescription("Unfortunately, the user may be not logged in and/or additional interaction is required.") + } + return authReq, s.authResponse(authReq, authorizer, w, r) + }() + if err != nil { + op.AuthRequestError(w, r, authReq, err, authorizer) + } +} + +func (s *Server) authResponse(authReq op.AuthRequest, authorizer op.Authorizer, w http.ResponseWriter, r *http.Request) (err error) { + ctx, span := tracing.NewSpan(r.Context()) + r = r.WithContext(ctx) + defer func() { span.EndWithError(err) }() + + client, err := authorizer.Storage().GetClientByClientID(ctx, authReq.GetClientID()) + if err != nil { + op.AuthRequestError(w, r, authReq, err, authorizer) + return err + } + if authReq.GetResponseType() == oidc.ResponseTypeCode { + op.AuthResponseCode(w, r, authReq, authorizer) + return nil + } + return s.authResponseToken(authReq, authorizer, client, w, r) +} + +func (s *Server) authResponseToken(authReq op.AuthRequest, authorizer op.Authorizer, opClient op.Client, w http.ResponseWriter, r *http.Request) (err error) { + ctx, span := tracing.NewSpan(r.Context()) + r = r.WithContext(ctx) + defer func() { span.EndWithError(err) }() + + client, ok := opClient.(*Client) + if !ok { + return zerrors.ThrowInternal(nil, "OIDC-waeN6", "Error.Internal") + } + + userAgentID, _, userOrgID, authTime, authMethodsReferences, preferredLanguage, reason, actor := getInfoFromRequest(authReq) + scope := authReq.GetScopes() + session, err := s.command.CreateOIDCSession(ctx, + authReq.GetSubject(), + userOrgID, + client.client.ClientID, + scope, + authReq.GetAudience(), + AMRToAuthMethodTypes(authMethodsReferences), + authTime, + authReq.GetNonce(), + preferredLanguage, + &domain.UserAgent{ + FingerprintID: &userAgentID, + }, + reason, + actor, + slices.Contains(scope, oidc.ScopeOfflineAccess), + ) + if err != nil { + op.AuthRequestError(w, r, authReq, err, authorizer) + return err + } + resp, err := s.accessTokenResponseFromSession(ctx, client, session, authReq.GetState(), client.client.ProjectID, client.client.ProjectRoleAssertion) + if err != nil { + op.AuthRequestError(w, r, authReq, err, authorizer) + return err + } + + if authReq.GetResponseMode() == oidc.ResponseModeFormPost { + if err = op.AuthResponseFormPost(w, authReq.GetRedirectURI(), resp, authorizer.Encoder()); err != nil { + op.AuthRequestError(w, r, authReq, err, authorizer) + return err + } + return nil + } + + callback, err := op.AuthResponseURL(authReq.GetRedirectURI(), authReq.GetResponseType(), authReq.GetResponseMode(), resp, authorizer.Encoder()) + if err != nil { + op.AuthRequestError(w, r, authReq, err, authorizer) + return err + } + http.Redirect(w, r, callback, http.StatusFound) + return nil +} diff --git a/internal/api/oidc/client.go b/internal/api/oidc/client.go index a80d4ad95e..8dc7c58ad5 100644 --- a/internal/api/oidc/client.go +++ b/internal/api/oidc/client.go @@ -5,6 +5,7 @@ import ( "encoding/base64" "encoding/json" "fmt" + "slices" "strings" "time" @@ -69,7 +70,7 @@ func (o *OPStorage) GetKeyByIDAndIssuer(ctx context.Context, keyID, issuer strin err = oidcError(err) span.EndWithError(err) }() - publicKeyData, err := o.query.GetAuthNKeyPublicKeyByIDAndIdentifier(ctx, keyID, issuer, false) + publicKeyData, err := o.query.GetAuthNKeyPublicKeyByIDAndIdentifier(ctx, keyID, issuer) if err != nil { return nil, err } @@ -1040,3 +1041,26 @@ func (s *Server) verifyClientSecret(ctx context.Context, client *query.OIDCClien s.command.OIDCSecretCheckSucceeded(ctx, client.AppID, client.ProjectID, client.Settings.ResourceOwner, updated) return nil } + +func (s *Server) checkOrgScopes(ctx context.Context, user *query.User, scopes []string) ([]string, error) { + if slices.ContainsFunc(scopes, func(scope string) bool { + return strings.HasPrefix(scope, domain.OrgDomainPrimaryScope) + }) { + org, err := s.query.OrgByID(ctx, false, user.ResourceOwner) + if err != nil { + return nil, err + } + scopes = slices.DeleteFunc(scopes, func(scope string) bool { + if domain, ok := strings.CutPrefix(scope, domain.OrgDomainPrimaryScope); ok { + return domain != org.Domain + } + return false + }) + } + return slices.DeleteFunc(scopes, func(scope string) bool { + if orgID, ok := strings.CutPrefix(scope, domain.OrgIDScope); ok { + return orgID != user.ResourceOwner + } + return false + }), nil +} diff --git a/internal/api/oidc/client_converter.go b/internal/api/oidc/client_converter.go index 74d983c811..f5e53312d0 100644 --- a/internal/api/oidc/client_converter.go +++ b/internal/api/oidc/client_converter.go @@ -104,28 +104,7 @@ func (c *Client) AccessTokenType() op.AccessTokenType { } func (c *Client) IsScopeAllowed(scope string) bool { - if strings.HasPrefix(scope, domain.OrgDomainPrimaryScope) { - return true - } - if strings.HasPrefix(scope, domain.OrgIDScope) { - return true - } - if strings.HasPrefix(scope, domain.ProjectIDScope) { - return true - } - if strings.HasPrefix(scope, domain.SelectIDPScope) { - return true - } - if scope == ScopeUserMetaData { - return true - } - if scope == ScopeResourceOwner { - return true - } - if scope == ScopeProjectsRoles { - return true - } - return slices.Contains(c.allowedScopes, scope) + return isScopeAllowed(scope, c.allowedScopes...) } func (c *Client) ClockSkew() time.Duration { @@ -249,3 +228,28 @@ func clientIDFromCredentials(cc *op.ClientCredentials) (clientID string, asserti } return cc.ClientID, false, nil } + +func isScopeAllowed(scope string, allowedScopes ...string) bool { + if strings.HasPrefix(scope, domain.OrgDomainPrimaryScope) { + return true + } + if strings.HasPrefix(scope, domain.OrgIDScope) { + return true + } + if strings.HasPrefix(scope, domain.ProjectIDScope) { + return true + } + if strings.HasPrefix(scope, domain.SelectIDPScope) { + return true + } + if scope == ScopeUserMetaData { + return true + } + if scope == ScopeResourceOwner { + return true + } + if scope == ScopeProjectsRoles { + return true + } + return slices.Contains(allowedScopes, scope) +} diff --git a/internal/api/oidc/client_credentials.go b/internal/api/oidc/client_credentials.go index a62fa54a2b..b2821bcb70 100644 --- a/internal/api/oidc/client_credentials.go +++ b/internal/api/oidc/client_credentials.go @@ -2,6 +2,7 @@ package oidc import ( "context" + "strings" "time" "github.com/zitadel/oidc/v3/pkg/oidc" @@ -136,9 +137,8 @@ func (c *clientCredentialsClient) RestrictAdditionalAccessTokenScopes() func(sco } } -// IsScopeAllowed returns null false as the check is executed during the auth request validation func (c *clientCredentialsClient) IsScopeAllowed(scope string) bool { - return false + return isScopeAllowed(scope) || strings.HasPrefix(scope, ScopeProjectRolePrefix) } // IDTokenUserinfoClaimsAssertion returns null false as no id_token is issued diff --git a/internal/api/oidc/client_integration_test.go b/internal/api/oidc/client_integration_test.go index 2ad88cf096..58fdebef07 100644 --- a/internal/api/oidc/client_integration_test.go +++ b/internal/api/oidc/client_integration_test.go @@ -7,7 +7,6 @@ import ( "testing" "time" - "github.com/brianvoe/gofakeit/v6" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/zitadel/oidc/v3/pkg/client" @@ -22,7 +21,6 @@ import ( "github.com/zitadel/zitadel/pkg/grpc/authn" "github.com/zitadel/zitadel/pkg/grpc/management" oidc_pb "github.com/zitadel/zitadel/pkg/grpc/oidc/v2beta" - "github.com/zitadel/zitadel/pkg/grpc/user" ) func TestServer_Introspect(t *testing.T) { @@ -346,73 +344,3 @@ func createInvalidKeyData(t testing.TB, client *management.AddOIDCAppResponse) [ require.NoError(t, err) return data } - -func TestServer_CreateAccessToken_ClientCredentials(t *testing.T) { - _, clientID, clientSecret, err := Tester.CreateOIDCCredentialsClient(CTX) - require.NoError(t, err) - - type clientDetails struct { - clientID string - clientSecret string - keyData []byte - } - tests := []struct { - name string - clientID string - clientSecret string - wantErr bool - }{ - { - name: "missing client ID error", - clientID: "", - clientSecret: clientSecret, - wantErr: true, - }, - { - name: "client not found error", - clientID: "foo", - clientSecret: clientSecret, - wantErr: true, - }, - { - name: "machine user without secret error", - clientID: func() string { - name := gofakeit.Username() - _, err := Tester.Client.Mgmt.AddMachineUser(CTX, &management.AddMachineUserRequest{ - Name: name, - UserName: name, - AccessTokenType: user.AccessTokenType_ACCESS_TOKEN_TYPE_JWT, - }) - require.NoError(t, err) - return name - }(), - clientSecret: clientSecret, - wantErr: true, - }, - { - name: "wrong secret error", - clientID: clientID, - clientSecret: "bar", - wantErr: true, - }, - { - name: "success", - clientID: clientID, - clientSecret: clientSecret, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - provider, err := rp.NewRelyingPartyOIDC(CTX, Tester.OIDCIssuer(), tt.clientID, tt.clientSecret, redirectURI, []string{oidc.ScopeOpenID}) - require.NoError(t, err) - tokens, err := rp.ClientCredentials(CTX, provider, nil) - if tt.wantErr { - require.Error(t, err) - return - } - require.NoError(t, err) - assert.NotNil(t, tokens) - assert.NotEmpty(t, tokens.AccessToken) - }) - } -} diff --git a/internal/api/oidc/device_auth.go b/internal/api/oidc/device_auth.go index 45f6453556..0fe5a7d8c7 100644 --- a/internal/api/oidc/device_auth.go +++ b/internal/api/oidc/device_auth.go @@ -2,14 +2,14 @@ package oidc import ( "context" + "slices" "time" "github.com/zitadel/logging" + "github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/op" "github.com/zitadel/zitadel/internal/api/ui/login" - "github.com/zitadel/zitadel/internal/domain" - "github.com/zitadel/zitadel/internal/query" "github.com/zitadel/zitadel/internal/telemetry/tracing" ) @@ -80,7 +80,7 @@ func (o *OPStorage) StoreDeviceAuthorization(ctx context.Context, clientID, devi if err != nil { return err } - details, err := o.command.AddDeviceAuth(ctx, clientID, deviceCode, userCode, expires, scope, audience) + details, err := o.command.AddDeviceAuth(ctx, clientID, deviceCode, userCode, expires, scope, audience, slices.Contains(scope, oidc.ScopeOfflineAccess)) if err == nil { logger.SetFields("details", details).Debug(logMsg) } @@ -88,50 +88,6 @@ func (o *OPStorage) StoreDeviceAuthorization(ctx context.Context, clientID, devi return err } -func newDeviceAuthorizationState(d *query.DeviceAuth) *op.DeviceAuthorizationState { - return &op.DeviceAuthorizationState{ - ClientID: d.ClientID, - Scopes: d.Scopes, - Audience: d.Audience, - Expires: d.Expires, - Done: d.State.Done(), - Denied: d.State.Denied(), - Subject: d.Subject, - AMR: AuthMethodTypesToAMR(d.UserAuthMethods), - AuthTime: d.AuthTime, - } -} - -// GetDeviceAuthorizatonState retrieves the current state of the Device Authorization process. -// It implements the [op.DeviceAuthorizationStorage] interface and is used by devices that -// are polling until they successfully receive a token or we indicate a denied or expired state. -// As generated user codes are of low entropy, this implementation also takes care or -// device authorization request cleanup, when it has been Approved, Denied or Expired. -func (o *OPStorage) GetDeviceAuthorizatonState(ctx context.Context, clientID, deviceCode string) (state *op.DeviceAuthorizationState, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { - err = oidcError(err) - span.EndWithError(err) - }() - - deviceAuth, err := o.query.DeviceAuthByDeviceCode(ctx, deviceCode) - if err != nil { - return nil, err - } - logging.WithFields( - "device_code", deviceCode, - "expires", deviceAuth.Expires, "scopes", deviceAuth.Scopes, - "subject", deviceAuth.Subject, "state", deviceAuth.State, - ).Debug("device authorization state") - - // Cancel the request if it is expired, only if it wasn't Done meanwhile - if !deviceAuth.State.Done() && deviceAuth.Expires.Before(time.Now()) { - _, err = o.command.CancelDeviceAuth(ctx, deviceAuth.DeviceCode, domain.DeviceAuthCanceledExpired) - if err != nil { - return nil, err - } - deviceAuth.State = domain.DeviceAuthStateExpired - } - - return newDeviceAuthorizationState(deviceAuth), nil +func (o *OPStorage) GetDeviceAuthorizatonState(ctx context.Context, _, deviceCode string) (state *op.DeviceAuthorizationState, err error) { + return nil, nil } diff --git a/internal/api/oidc/op.go b/internal/api/oidc/op.go index 3daa7e61ff..24e201e620 100644 --- a/internal/api/oidc/op.go +++ b/internal/api/oidc/op.go @@ -140,10 +140,13 @@ func NewServer( fallbackLogger: fallbackLogger, hasher: hasher, signingKeyAlgorithm: config.SigningKeyAlgorithm, + encAlg: encryptionAlg, + opCrypto: op.NewAESCrypto(opConfig.CryptoKey), assetAPIPrefix: assets.AssetAPI(externalSecure), } metricTypes := []metrics.MetricType{metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode, metrics.MetricTypeTotalCount} server.Handler = op.RegisterLegacyServer(server, + server.authorizeCallbackHandler, op.WithFallbackLogger(fallbackLogger), op.WithHTTPMiddleware( middleware.MetricsHandler(metricTypes), diff --git a/internal/api/oidc/server.go b/internal/api/oidc/server.go index e164740539..f461996ef2 100644 --- a/internal/api/oidc/server.go +++ b/internal/api/oidc/server.go @@ -37,7 +37,10 @@ type Server struct { fallbackLogger *slog.Logger hasher *crypto.Hasher signingKeyAlgorithm string - assetAPIPrefix func(ctx context.Context) string + encAlg crypto.EncryptionAlgorithm + opCrypto op.Crypto + + assetAPIPrefix func(ctx context.Context) string } func endpoints(endpointConfig *EndpointConfig) op.Endpoints { @@ -153,41 +156,6 @@ func (s *Server) DeviceAuthorization(ctx context.Context, r *op.ClientRequest[oi return s.LegacyServer.DeviceAuthorization(ctx, r) } -func (s *Server) CodeExchange(ctx context.Context, r *op.ClientRequest[oidc.AccessTokenRequest]) (_ *op.Response, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { span.EndWithError(err) }() - - return s.LegacyServer.CodeExchange(ctx, r) -} - -func (s *Server) RefreshToken(ctx context.Context, r *op.ClientRequest[oidc.RefreshTokenRequest]) (_ *op.Response, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { span.EndWithError(err) }() - - return s.LegacyServer.RefreshToken(ctx, r) -} - -func (s *Server) JWTProfile(ctx context.Context, r *op.Request[oidc.JWTProfileGrantRequest]) (_ *op.Response, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { span.EndWithError(err) }() - - return s.LegacyServer.JWTProfile(ctx, r) -} - -func (s *Server) ClientCredentialsExchange(ctx context.Context, r *op.ClientRequest[oidc.ClientCredentialsRequest]) (_ *op.Response, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { span.EndWithError(err) }() - - return s.LegacyServer.ClientCredentialsExchange(ctx, r) -} - -func (s *Server) DeviceToken(ctx context.Context, r *op.ClientRequest[oidc.DeviceAccessTokenRequest]) (_ *op.Response, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { span.EndWithError(err) }() - - return s.LegacyServer.DeviceToken(ctx, r) -} - func (s *Server) Revocation(ctx context.Context, r *op.ClientRequest[oidc.RevocationRequest]) (_ *op.Response, err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() @@ -232,3 +200,10 @@ func (s *Server) createDiscoveryConfig(ctx context.Context, supportedUILocales o RequestParameterSupported: s.Provider().RequestObjectSupported(), } } + +func response(resp any, err error) (*op.Response, error) { + if err != nil { + return nil, err + } + return op.NewResponse(resp), nil +} diff --git a/internal/api/oidc/token.go b/internal/api/oidc/token.go new file mode 100644 index 0000000000..c45eb98acb --- /dev/null +++ b/internal/api/oidc/token.go @@ -0,0 +1,198 @@ +package oidc + +import ( + "context" + "encoding/base64" + "slices" + "sync" + "time" + + "github.com/go-jose/go-jose/v4" + "github.com/zitadel/oidc/v3/pkg/crypto" + "github.com/zitadel/oidc/v3/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/op" + + "github.com/zitadel/zitadel/internal/command" + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/telemetry/tracing" +) + +/* +For each grant-type, tokens creation follows the same rough logical steps: + +1. Information gathering: who is requesting the token, what do we put in the claims? +2. Decision making: is the request authorized? (valid exchange code, auth request completed, valid token etc...) +3. Build an OIDC session in storage: inform the eventstore we are creating tokens. +4. Use the OIDC session to encrypt and / or sign the requested tokens + +In some cases step 1 till 3 are completely implemented in the command package, +for example the v2 code exchange and refresh token. +*/ + +func (s *Server) accessTokenResponseFromSession(ctx context.Context, client op.Client, session *command.OIDCSession, state, projectID string, projectRoleAssertion bool) (_ *oidc.AccessTokenResponse, err error) { + getUserInfo := s.getUserInfoOnce(session.UserID, projectID, projectRoleAssertion, session.Scope) + getSigner := s.getSignerOnce() + + resp := &oidc.AccessTokenResponse{ + TokenType: oidc.BearerToken, + RefreshToken: session.RefreshToken, + ExpiresIn: timeToOIDCExpiresIn(session.Expiration), + State: state, + } + + // If the session does not have a token ID, it is an implicit ID-Token only response. + if session.TokenID != "" { + if client.AccessTokenType() == op.AccessTokenTypeJWT { + resp.AccessToken, err = s.createJWT(ctx, client, session, getUserInfo, getSigner) + } else { + resp.AccessToken, err = op.CreateBearerToken(session.TokenID, session.UserID, s.opCrypto) + } + if err != nil { + return nil, err + } + } + + if slices.Contains(session.Scope, oidc.ScopeOpenID) { + resp.IDToken, _, err = s.createIDToken(ctx, client, getUserInfo, getSigner, session.SessionID, resp.AccessToken, session.Audience, session.AuthMethods, session.AuthTime, session.Nonce, session.Actor) + } + return resp, err +} + +// signerFunc is a getter function that allows add-hoc retrieval of the instance's signer. +type signerFunc func(ctx context.Context) (jose.Signer, jose.SignatureAlgorithm, error) + +// getSignerOnce returns a function which retrieves the instance's signer from the database once. +// Repeated calls of the returned function return the same results. +func (s *Server) getSignerOnce() signerFunc { + var ( + once sync.Once + signer jose.Signer + signAlg jose.SignatureAlgorithm + err error + ) + return func(ctx context.Context) (jose.Signer, jose.SignatureAlgorithm, error) { + once.Do(func() { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + var signingKey op.SigningKey + signingKey, err = s.Provider().Storage().SigningKey(ctx) + if err != nil { + return + } + signAlg = signingKey.SignatureAlgorithm() + + signer, err = op.SignerFromKey(signingKey) + if err != nil { + return + } + }) + return signer, signAlg, err + } +} + +// userInfoFunc is a getter function that allows add-hoc retrieval of a user. +type userInfoFunc func(ctx context.Context) (*oidc.UserInfo, error) + +// getUserInfoOnce returns a function which retrieves userinfo from the database once. +// Repeated calls of the returned function return the same results. +func (s *Server) getUserInfoOnce(userID, projectID string, projectRoleAssertion bool, scope []string) userInfoFunc { + var ( + once sync.Once + userInfo *oidc.UserInfo + err error + ) + return func(ctx context.Context) (*oidc.UserInfo, error) { + once.Do(func() { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + userInfo, err = s.userInfo(ctx, userID, scope, projectID, projectRoleAssertion, false) + }) + return userInfo, err + } +} + +func (*Server) createIDToken(ctx context.Context, client op.Client, getUserInfo userInfoFunc, getSigningKey signerFunc, sessionID, accessToken string, audience []string, authMethods []domain.UserAuthMethodType, authTime time.Time, nonce string, actor *domain.TokenActor) (idToken string, exp uint64, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + userInfo, err := getUserInfo(ctx) + if err != nil { + return "", 0, err + } + + signer, signAlg, err := getSigningKey(ctx) + if err != nil { + return "", 0, err + } + + expTime := time.Now().Add(client.IDTokenLifetime()).Add(client.ClockSkew()) + claims := oidc.NewIDTokenClaims( + op.IssuerFromContext(ctx), + "", + audience, + expTime, + authTime, + nonce, + "", + AuthMethodTypesToAMR(authMethods), + client.GetID(), + client.ClockSkew(), + ) + claims.SessionID = sessionID + claims.Actor = actorDomainToClaims(actor) + claims.SetUserInfo(userInfo) + if accessToken != "" { + claims.AccessTokenHash, err = oidc.ClaimHash(accessToken, signAlg) + if err != nil { + return "", 0, err + } + } + idToken, err = crypto.Sign(claims, signer) + return idToken, timeToOIDCExpiresIn(expTime), err +} + +func timeToOIDCExpiresIn(exp time.Time) uint64 { + return uint64(time.Until(exp) / time.Second) +} + +func (*Server) createJWT(ctx context.Context, client op.Client, session *command.OIDCSession, getUserInfo userInfoFunc, getSigner signerFunc) (_ string, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + userInfo, err := getUserInfo(ctx) + if err != nil { + return "", err + } + signer, _, err := getSigner(ctx) + if err != nil { + return "", err + } + + expTime := session.Expiration.Add(client.ClockSkew()) + claims := oidc.NewAccessTokenClaims( + op.IssuerFromContext(ctx), + userInfo.Subject, + session.Audience, + expTime, + session.TokenID, + client.GetID(), + client.ClockSkew(), + ) + claims.Actor = actorDomainToClaims(session.Actor) + claims.Claims = userInfo.Claims + + return crypto.Sign(claims, signer) +} + +// decryptCode decrypts a code or refresh_token +func (s *Server) decryptCode(ctx context.Context, code string) (_ string, err error) { + _, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + decoded, err := base64.RawURLEncoding.DecodeString(code) + if err != nil { + return "", err + } + return s.encAlg.DecryptString(decoded, s.encAlg.EncryptionKeyID()) +} diff --git a/internal/api/oidc/token_client_credentials.go b/internal/api/oidc/token_client_credentials.go new file mode 100644 index 0000000000..3765d58adb --- /dev/null +++ b/internal/api/oidc/token_client_credentials.go @@ -0,0 +1,51 @@ +package oidc + +import ( + "context" + "time" + + "github.com/zitadel/oidc/v3/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/op" + + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/telemetry/tracing" + "github.com/zitadel/zitadel/internal/zerrors" +) + +func (s *Server) ClientCredentialsExchange(ctx context.Context, r *op.ClientRequest[oidc.ClientCredentialsRequest]) (_ *op.Response, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { + span.EndWithError(err) + err = oidcError(err) + }() + client, ok := r.Client.(*clientCredentialsClient) + if !ok { + return nil, zerrors.ThrowInternal(nil, "OIDC-ga0EP", "Error.Internal") + } + scope, err := op.ValidateAuthReqScopes(client, r.Data.Scope) + if err != nil { + return nil, err + } + scope, err = s.checkOrgScopes(ctx, client.user, scope) + if err != nil { + return nil, err + } + + session, err := s.command.CreateOIDCSession(ctx, + client.user.ID, + client.user.ResourceOwner, + r.Data.ClientID, + scope, + domain.AddAudScopeToAudience(ctx, nil, r.Data.Scope), + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + time.Now(), + "", + nil, + nil, + domain.TokenReasonClientCredentials, + nil, + false, + ) + + return response(s.accessTokenResponseFromSession(ctx, client, session, "", "", false)) +} diff --git a/internal/api/oidc/token_client_credentials_integration_test.go b/internal/api/oidc/token_client_credentials_integration_test.go new file mode 100644 index 0000000000..3517438596 --- /dev/null +++ b/internal/api/oidc/token_client_credentials_integration_test.go @@ -0,0 +1,143 @@ +//go:build integration + +package oidc_test + +import ( + "testing" + + "github.com/brianvoe/gofakeit/v6" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "github.com/zitadel/oidc/v3/pkg/client/rp" + "github.com/zitadel/oidc/v3/pkg/oidc" + + oidc_api "github.com/zitadel/zitadel/internal/api/oidc" + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/pkg/grpc/management" + "github.com/zitadel/zitadel/pkg/grpc/user" +) + +func TestServer_ClientCredentialsExchange(t *testing.T) { + userID, clientID, clientSecret, err := Tester.CreateOIDCCredentialsClient(CTX) + require.NoError(t, err) + + type claims struct { + resourceOwnerID any + resourceOwnerName any + resourceOwnerPrimaryDomain any + orgDomain any + } + tests := []struct { + name string + clientID string + clientSecret string + scope []string + wantClaims claims + wantErr bool + }{ + { + name: "missing client ID error", + clientID: "", + clientSecret: clientSecret, + scope: []string{oidc.ScopeOpenID}, + wantErr: true, + }, + { + name: "client not found error", + clientID: "foo", + clientSecret: clientSecret, + scope: []string{oidc.ScopeOpenID}, + wantErr: true, + }, + { + name: "machine user without secret error", + clientID: func() string { + name := gofakeit.Username() + _, err := Tester.Client.Mgmt.AddMachineUser(CTX, &management.AddMachineUserRequest{ + Name: name, + UserName: name, + AccessTokenType: user.AccessTokenType_ACCESS_TOKEN_TYPE_JWT, + }) + require.NoError(t, err) + return name + }(), + clientSecret: clientSecret, + scope: []string{oidc.ScopeOpenID}, + wantErr: true, + }, + { + name: "wrong secret error", + clientID: clientID, + clientSecret: "bar", + scope: []string{oidc.ScopeOpenID}, + wantErr: true, + }, + { + name: "success", + clientID: clientID, + clientSecret: clientSecret, + scope: []string{oidc.ScopeOpenID}, + }, + { + name: "org id and domain scope", + clientID: clientID, + clientSecret: clientSecret, + scope: []string{ + oidc.ScopeOpenID, + domain.OrgIDScope + Tester.Organisation.ID, + domain.OrgDomainPrimaryScope + Tester.Organisation.Domain, + }, + wantClaims: claims{ + resourceOwnerID: Tester.Organisation.ID, + resourceOwnerName: Tester.Organisation.Name, + resourceOwnerPrimaryDomain: Tester.Organisation.Domain, + orgDomain: Tester.Organisation.Domain, + }, + }, + { + name: "invalid org domain filtered", + clientID: clientID, + clientSecret: clientSecret, + scope: []string{ + oidc.ScopeOpenID, + domain.OrgDomainPrimaryScope + Tester.Organisation.Domain, + domain.OrgDomainPrimaryScope + "foo"}, + wantClaims: claims{ + orgDomain: Tester.Organisation.Domain, + }, + }, + { + name: "invalid org id filtered", + clientID: clientID, + clientSecret: clientSecret, + scope: []string{oidc.ScopeOpenID, + domain.OrgIDScope + Tester.Organisation.ID, + domain.OrgIDScope + "foo", + }, + wantClaims: claims{ + resourceOwnerID: Tester.Organisation.ID, + resourceOwnerName: Tester.Organisation.Name, + resourceOwnerPrimaryDomain: Tester.Organisation.Domain, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + provider, err := rp.NewRelyingPartyOIDC(CTX, Tester.OIDCIssuer(), tt.clientID, tt.clientSecret, redirectURI, tt.scope) + require.NoError(t, err) + tokens, err := rp.ClientCredentials(CTX, provider, nil) + if tt.wantErr { + require.Error(t, err) + return + } + require.NoError(t, err) + require.NotNil(t, tokens) + userinfo, err := rp.Userinfo[*oidc.UserInfo](CTX, tokens.AccessToken, oidc.BearerToken, userID, provider) + require.NoError(t, err) + assert.Equal(t, tt.wantClaims.resourceOwnerID, userinfo.Claims[oidc_api.ClaimResourceOwnerID]) + assert.Equal(t, tt.wantClaims.resourceOwnerName, userinfo.Claims[oidc_api.ClaimResourceOwnerName]) + assert.Equal(t, tt.wantClaims.resourceOwnerPrimaryDomain, userinfo.Claims[oidc_api.ClaimResourceOwnerPrimaryDomain]) + assert.Equal(t, tt.wantClaims.orgDomain, userinfo.Claims[domain.OrgDomainPrimaryClaim]) + }) + } +} diff --git a/internal/api/oidc/token_code.go b/internal/api/oidc/token_code.go new file mode 100644 index 0000000000..add1fc1c25 --- /dev/null +++ b/internal/api/oidc/token_code.go @@ -0,0 +1,125 @@ +package oidc + +import ( + "context" + "slices" + "strings" + + "github.com/zitadel/oidc/v3/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/op" + + "github.com/zitadel/zitadel/internal/command" + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/telemetry/tracing" + "github.com/zitadel/zitadel/internal/zerrors" +) + +func (s *Server) CodeExchange(ctx context.Context, r *op.ClientRequest[oidc.AccessTokenRequest]) (_ *op.Response, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { + span.EndWithError(err) + err = oidcError(err) + }() + + client, ok := r.Client.(*Client) + if !ok { + return nil, zerrors.ThrowInternal(nil, "OIDC-Ae2ph", "Error.Internal") + } + + plainCode, err := s.decryptCode(ctx, r.Data.Code) + if err != nil { + return nil, zerrors.ThrowInvalidArgument(err, "OIDC-ahLi2", "Errors.User.Code.Invalid") + } + + var ( + session *command.OIDCSession + state string + ) + if strings.HasPrefix(plainCode, command.IDPrefixV2) { + session, state, err = s.command.CreateOIDCSessionFromAuthRequest( + setContextUserSystem(ctx), + plainCode, + codeExchangeComplianceChecker(client, r.Data), + slices.Contains(client.GrantTypes(), oidc.GrantTypeRefreshToken), + ) + } else { + session, state, err = s.codeExchangeV1(ctx, client, r.Data, r.Data.Code) + } + if err != nil { + return nil, err + } + return response(s.accessTokenResponseFromSession(ctx, client, session, state, client.client.ProjectID, client.client.ProjectRoleAssertion)) +} + +// codeExchangeV1 creates a v2 token from a v1 auth request. +func (s *Server) codeExchangeV1(ctx context.Context, client *Client, req *oidc.AccessTokenRequest, code string) (session *command.OIDCSession, state string, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + authReq, err := s.getAuthRequestV1ByCode(ctx, code) + if err != nil { + return nil, "", err + } + + if challenge := authReq.GetCodeChallenge(); challenge != nil || client.AuthMethod() == oidc.AuthMethodNone { + if err = op.AuthorizeCodeChallenge(req.CodeVerifier, challenge); err != nil { + return nil, "", err + } + } + if req.RedirectURI != authReq.GetRedirectURI() { + return nil, "", oidc.ErrInvalidGrant().WithDescription("redirect_uri does not correspond") + } + userAgentID, _, userOrgID, authTime, authMethodsReferences, preferredLanguage, reason, actor := getInfoFromRequest(authReq) + + scope := authReq.GetScopes() + session, err = s.command.CreateOIDCSession(ctx, + authReq.GetSubject(), + userOrgID, + client.client.ClientID, + scope, + authReq.GetAudience(), + AMRToAuthMethodTypes(authMethodsReferences), + authTime, + authReq.GetNonce(), + preferredLanguage, + &domain.UserAgent{ + FingerprintID: &userAgentID, + }, + reason, + actor, + slices.Contains(scope, oidc.ScopeOfflineAccess), + ) + if err != nil { + return nil, "", err + } + return session, authReq.GetState(), s.repo.DeleteAuthRequest(ctx, authReq.GetID()) +} + +// getAuthRequestV1ByCode finds the v1 auth request by code. +// code needs to be the encrypted version of the ID, +// this is required by the underlying repo. +func (s *Server) getAuthRequestV1ByCode(ctx context.Context, code string) (op.AuthRequest, error) { + authReq, err := s.repo.AuthRequestByCode(ctx, code) + if err != nil { + return nil, err + } + return AuthRequestFromBusiness(authReq) +} + +func codeExchangeComplianceChecker(client *Client, req *oidc.AccessTokenRequest) command.AuthRequestComplianceChecker { + return func(ctx context.Context, authReq *command.AuthRequestWriteModel) error { + if authReq.CodeChallenge != nil || client.AuthMethod() == oidc.AuthMethodNone { + err := op.AuthorizeCodeChallenge(req.CodeVerifier, CodeChallengeToOIDC(authReq.CodeChallenge)) + if err != nil { + return err + } + } + if req.RedirectURI != authReq.RedirectURI { + return oidc.ErrInvalidGrant().WithDescription("redirect_uri does not correspond") + } + if err := authReq.CheckAuthenticated(); err != nil { + return err + } + return nil + } +} diff --git a/internal/api/oidc/token_device.go b/internal/api/oidc/token_device.go new file mode 100644 index 0000000000..c70fa9c1e9 --- /dev/null +++ b/internal/api/oidc/token_device.go @@ -0,0 +1,46 @@ +package oidc + +import ( + "context" + "errors" + + "github.com/zitadel/oidc/v3/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/op" + + "github.com/zitadel/zitadel/internal/command" + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/telemetry/tracing" + "github.com/zitadel/zitadel/internal/zerrors" +) + +func (s *Server) DeviceToken(ctx context.Context, r *op.ClientRequest[oidc.DeviceAccessTokenRequest]) (_ *op.Response, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { + span.EndWithError(err) + err = oidcError(err) + }() + + client, ok := r.Client.(*Client) + if !ok { + return nil, zerrors.ThrowInternal(nil, "OIDC-Ae2ph", "Error.Internal") + } + session, err := s.command.CreateOIDCSessionFromDeviceAuth(ctx, r.Data.DeviceCode) + if err == nil { + return response(s.accessTokenResponseFromSession(ctx, client, session, "", client.client.ProjectID, client.client.ProjectRoleAssertion)) + } + if errors.Is(err, context.DeadlineExceeded) { + return nil, oidc.ErrSlowDown().WithParent(err) + } + + var target command.DeviceAuthStateError + if errors.As(err, &target) { + state := domain.DeviceAuthState(target) + if state == domain.DeviceAuthStateInitiated { + return nil, oidc.ErrAuthorizationPending() + } + if state == domain.DeviceAuthStateExpired { + return nil, oidc.ErrExpiredDeviceCode() + } + } + return nil, oidc.ErrAccessDenied().WithParent(err) +} diff --git a/internal/api/oidc/token_exchange.go b/internal/api/oidc/token_exchange.go index e9c6ed27d4..31b1a37db3 100644 --- a/internal/api/oidc/token_exchange.go +++ b/internal/api/oidc/token_exchange.go @@ -5,9 +5,9 @@ import ( "slices" "time" - "github.com/zitadel/oidc/v3/pkg/crypto" "github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/op" + "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/domain" @@ -134,13 +134,16 @@ func (s *Server) verifyExchangeToken(ctx context.Context, client *Client, token return idTokenClaimsToExchangeToken(claims, resourceOwner), nil case oidc.JWTTokenType: - resourceOwner := new(string) - verifier := op.NewJWTProfileVerifierKeySet(keySetMap(client.client.PublicKeys), op.IssuerFromContext(ctx), time.Hour, client.client.ClockSkew, s.jwtProfileUserCheck(ctx, resourceOwner)) + var ( + resourceOwner string + preferredLanguage *language.Tag + ) + verifier := op.NewJWTProfileVerifierKeySet(keySetMap(client.client.PublicKeys), op.IssuerFromContext(ctx), time.Hour, client.client.ClockSkew, s.jwtProfileUserCheck(ctx, &resourceOwner, &preferredLanguage)) jwt, err := op.VerifyJWTAssertion(ctx, token, verifier) if err != nil { return nil, zerrors.ThrowPermissionDenied(err, "OIDC-eiS6o", "Errors.TokenExchange.Token.Invalid") } - return jwtToExchangeToken(jwt, *resourceOwner), nil + return jwtToExchangeToken(jwt, resourceOwner, preferredLanguage), nil case UserIDTokenType: user, err := s.query.GetUserByID(ctx, false, token) @@ -156,13 +159,18 @@ func (s *Server) verifyExchangeToken(ctx context.Context, client *Client, token } } -func (s *Server) jwtProfileUserCheck(ctx context.Context, resourceOwner *string) op.JWTProfileVerifierOption { +// jwtProfileUserCheck finds the user by subject (user ID) and sets the resourceOwner through the pointer. +// preferred Language is set only if it was defined for a Human user, else the pointed pointer remains nil. +func (s *Server) jwtProfileUserCheck(ctx context.Context, resourceOwner *string, preferredLanguage **language.Tag) op.JWTProfileVerifierOption { return op.SubjectCheck(func(request *oidc.JWTTokenRequest) error { user, err := s.query.GetUserByID(ctx, false, request.Subject) if err != nil { return zerrors.ThrowPermissionDenied(err, "OIDC-Nee6r", "Errors.TokenExchange.Token.Invalid") } *resourceOwner = user.ResourceOwner + if user.Human != nil && !user.Human.PreferredLanguage.IsRoot() { + *preferredLanguage = &user.Human.PreferredLanguage + } return nil }) } @@ -210,21 +218,8 @@ func validateTokenExchangeAudience(requestedAudience, subjectAudience, actorAudi // Both tokens may point to the same object (subjectToken) in case of a regular Token Exchange. // When the subject and actor Tokens point to different objects, the new tokens will be for impersonation / delegation. func (s *Server) createExchangeTokens(ctx context.Context, tokenType oidc.TokenType, client *Client, subjectToken, actorToken *exchangeToken, audience, scopes []string) (_ *oidc.TokenExchangeResponse, err error) { - var ( - userInfo *oidc.UserInfo - signingKey op.SigningKey - ) - if slices.Contains(scopes, oidc.ScopeOpenID) || tokenType == oidc.JWTTokenType || tokenType == oidc.IDTokenType { - projectID := client.client.ProjectID - userInfo, err = s.userInfo(ctx, subjectToken.userID, scopes, projectID, client.client.ProjectRoleAssertion, false) - if err != nil { - return nil, err - } - signingKey, err = s.Provider().Storage().SigningKey(ctx) - if err != nil { - return nil, err - } - } + getUserInfo := s.getUserInfoOnce(subjectToken.userID, client.client.ProjectID, client.client.ProjectRoleAssertion, scopes) + getSigner := s.getSignerOnce() resp := &oidc.TokenExchangeResponse{ Scopes: scopes, @@ -237,21 +232,23 @@ func (s *Server) createExchangeTokens(ctx context.Context, tokenType oidc.TokenT actor = actorToken.nestedActor() } + var sessionID string switch tokenType { case oidc.AccessTokenType, "": - resp.AccessToken, resp.RefreshToken, resp.ExpiresIn, err = s.createExchangeAccessToken(ctx, client, subjectToken.resourceOwner, subjectToken.userID, audience, scopes, actorToken.authMethods, actorToken.authTime, reason, actor) + resp.AccessToken, resp.RefreshToken, sessionID, resp.ExpiresIn, err = s.createExchangeAccessToken(ctx, client, subjectToken.userID, subjectToken.resourceOwner, audience, scopes, actorToken.authMethods, actorToken.authTime, subjectToken.preferredLanguage, reason, actor) resp.TokenType = oidc.BearerToken resp.IssuedTokenType = oidc.AccessTokenType case oidc.JWTTokenType: - resp.AccessToken, resp.RefreshToken, resp.ExpiresIn, err = s.createExchangeJWT(ctx, signingKey, client, subjectToken.resourceOwner, subjectToken.userID, audience, scopes, actorToken.authMethods, actorToken.authTime, reason, actor, userInfo.Claims) + resp.AccessToken, resp.RefreshToken, resp.ExpiresIn, err = s.createExchangeJWT(ctx, client, getUserInfo, getSigner, subjectToken.userID, subjectToken.resourceOwner, audience, scopes, actorToken.authMethods, actorToken.authTime, subjectToken.preferredLanguage, reason, actor) resp.TokenType = oidc.BearerToken resp.IssuedTokenType = oidc.JWTTokenType case oidc.IDTokenType: - resp.AccessToken, resp.ExpiresIn, err = s.createExchangeIDToken(ctx, signingKey, client, subjectToken.userID, "", audience, userInfo, actorToken.authMethods, actorToken.authTime, reason, actor) + resp.AccessToken, resp.ExpiresIn, err = s.createIDToken(ctx, client, getUserInfo, getSigner, "", resp.AccessToken, audience, actorToken.authMethods, actorToken.authTime, "", actor) resp.TokenType = TokenTypeNA resp.IssuedTokenType = oidc.IDTokenType + case oidc.RefreshTokenType, UserIDTokenType: fallthrough default: @@ -262,7 +259,7 @@ func (s *Server) createExchangeTokens(ctx context.Context, tokenType oidc.TokenT } if slices.Contains(scopes, oidc.ScopeOpenID) && tokenType != oidc.IDTokenType { - resp.IDToken, _, err = s.createExchangeIDToken(ctx, signingKey, client, subjectToken.userID, resp.AccessToken, audience, userInfo, actorToken.authMethods, actorToken.authTime, reason, actor) + resp.IDToken, _, err = s.createIDToken(ctx, client, getUserInfo, getSigner, sessionID, resp.AccessToken, audience, actorToken.authMethods, actorToken.authTime, "", actor) if err != nil { return nil, err } @@ -271,77 +268,83 @@ func (s *Server) createExchangeTokens(ctx context.Context, tokenType oidc.TokenT return resp, nil } -func (s *Server) createExchangeAccessToken(ctx context.Context, client *Client, resourceOwner, userID string, audience, scopes []string, authMethods []domain.UserAuthMethodType, authTime time.Time, reason domain.TokenReason, actor *domain.TokenActor) (accessToken string, refreshToken string, exp uint64, err error) { - tokenInfo, refreshToken, err := s.createAccessTokenCommands(ctx, client, resourceOwner, userID, audience, scopes, authMethods, authTime, reason, actor) - if err != nil { - return "", "", 0, err - } - accessToken, err = op.CreateBearerToken(tokenInfo.TokenID, userID, s.Provider().Crypto()) - if err != nil { - return "", "", 0, err - } - return accessToken, refreshToken, timeToOIDCExpiresIn(tokenInfo.Expiration), nil -} +func (s *Server) createExchangeAccessToken( + ctx context.Context, + client *Client, + userID, + resourceOwner string, + audience, + scope []string, + authMethods []domain.UserAuthMethodType, + authTime time.Time, + preferredLanguage *language.Tag, + reason domain.TokenReason, + actor *domain.TokenActor, +) (accessToken, refreshToken, sessionID string, exp uint64, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() -func (s *Server) createExchangeJWT(ctx context.Context, signingKey op.SigningKey, client *Client, resourceOwner, userID string, audience, scopes []string, authMethods []domain.UserAuthMethodType, authTime time.Time, reason domain.TokenReason, actor *domain.TokenActor, privateClaims map[string]any) (accessToken string, refreshToken string, exp uint64, err error) { - tokenInfo, refreshToken, err := s.createAccessTokenCommands(ctx, client, resourceOwner, userID, audience, scopes, authMethods, authTime, reason, actor) - if err != nil { - return "", "", 0, err - } - - expTime := tokenInfo.Expiration.Add(client.ClockSkew()) - claims := oidc.NewAccessTokenClaims(op.IssuerFromContext(ctx), userID, tokenInfo.Audience, expTime, tokenInfo.TokenID, client.GetID(), client.ClockSkew()) - claims.Actor = actorDomainToClaims(tokenInfo.Actor) - claims.Claims = privateClaims - - signer, err := op.SignerFromKey(signingKey) - if err != nil { - return "", "", 0, err - } - - accessToken, err = crypto.Sign(claims, signer) - if err != nil { - return "", "", 0, nil - } - return accessToken, refreshToken, timeToOIDCExpiresIn(expTime), nil -} - -func (s *Server) createExchangeIDToken(ctx context.Context, signingKey op.SigningKey, client *Client, userID, accessToken string, audience []string, userInfo *oidc.UserInfo, authMethods []domain.UserAuthMethodType, authTime time.Time, reason domain.TokenReason, actor *domain.TokenActor) (idToken string, exp uint64, err error) { - expTime := time.Now().Add(client.IDTokenLifetime()).Add(client.ClockSkew()) - claims := oidc.NewIDTokenClaims(op.IssuerFromContext(ctx), userID, audience, expTime, authTime, "", "", AuthMethodTypesToAMR(authMethods), client.GetID(), client.ClockSkew()) - claims.Actor = actorDomainToClaims(actor) - claims.SetUserInfo(userInfo) - if accessToken != "" { - claims.AccessTokenHash, err = oidc.ClaimHash(accessToken, signingKey.SignatureAlgorithm()) - if err != nil { - return "", 0, err - } - } - signer, err := op.SignerFromKey(signingKey) - if err != nil { - return "", 0, err - } - idToken, err = crypto.Sign(claims, signer) - return idToken, timeToOIDCExpiresIn(expTime), err -} - -func timeToOIDCExpiresIn(exp time.Time) uint64 { - return uint64(time.Until(exp) / time.Second) -} - -func (s *Server) createAccessTokenCommands(ctx context.Context, client *Client, resourceOwner, userID string, audience, scopes []string, authMethods []domain.UserAuthMethodType, authTime time.Time, reason domain.TokenReason, actor *domain.TokenActor) (tokenInfo *domain.Token, refreshToken string, err error) { - settings := client.client.Settings - if slices.Contains(scopes, oidc.ScopeOfflineAccess) { - return s.command.AddAccessAndRefreshToken( - ctx, resourceOwner, "", client.GetID(), userID, "", audience, scopes, AuthMethodTypesToAMR(authMethods), - settings.AccessTokenLifetime, settings.RefreshTokenIdleExpiration, settings.RefreshTokenExpiration, - authTime, reason, actor, - ) - } - tokenInfo, err = s.command.AddUserToken( - ctx, resourceOwner, "", client.GetID(), userID, audience, scopes, AuthMethodTypesToAMR(authMethods), - settings.AccessTokenLifetime, - authTime, reason, actor, + session, err := s.command.CreateOIDCSession(ctx, + userID, + resourceOwner, + client.client.ClientID, + scope, + audience, + authMethods, + authTime, + "", + preferredLanguage, + nil, + reason, + actor, + slices.Contains(scope, oidc.ScopeOfflineAccess), ) - return tokenInfo, "", err + if err != nil { + return "", "", "", 0, err + } + accessToken, err = op.CreateBearerToken(session.TokenID, userID, s.opCrypto) + if err != nil { + return "", "", "", 0, err + } + return accessToken, session.RefreshToken, session.SessionID, timeToOIDCExpiresIn(session.Expiration), nil +} + +func (s *Server) createExchangeJWT( + ctx context.Context, + client *Client, + getUserInfo userInfoFunc, + getSigner signerFunc, + userID, + resourceOwner string, + audience, + scope []string, + authMethods []domain.UserAuthMethodType, + authTime time.Time, + preferredLanguage *language.Tag, + reason domain.TokenReason, + actor *domain.TokenActor, +) (accessToken string, refreshToken string, exp uint64, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + session, err := s.command.CreateOIDCSession(ctx, + userID, + resourceOwner, + client.client.ClientID, + scope, + audience, + authMethods, + authTime, + "", + preferredLanguage, + nil, + reason, + actor, + slices.Contains(scope, oidc.ScopeOfflineAccess), + ) + accessToken, err = s.createJWT(ctx, client, session, getUserInfo, getSigner) + if err != nil { + return "", "", 0, err + } + return accessToken, session.RefreshToken, timeToOIDCExpiresIn(session.Expiration), nil } diff --git a/internal/api/oidc/token_exchange_converter.go b/internal/api/oidc/token_exchange_converter.go index 98bddc1bbd..4c37bc93a4 100644 --- a/internal/api/oidc/token_exchange_converter.go +++ b/internal/api/oidc/token_exchange_converter.go @@ -4,21 +4,23 @@ import ( "time" "github.com/zitadel/oidc/v3/pkg/oidc" + "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/query" ) type exchangeToken struct { - tokenType oidc.TokenType - userID string - issuer string - resourceOwner string - authTime time.Time - authMethods []domain.UserAuthMethodType - actor *domain.TokenActor - audience []string - scopes []string + tokenType oidc.TokenType + userID string + issuer string + resourceOwner string + authTime time.Time + authMethods []domain.UserAuthMethodType + actor *domain.TokenActor + audience []string + scopes []string + preferredLanguage *language.Tag } func (et *exchangeToken) nestedActor() *domain.TokenActor { @@ -31,27 +33,33 @@ func (et *exchangeToken) nestedActor() *domain.TokenActor { func accessToExchangeToken(token *accessToken, issuer string) *exchangeToken { return &exchangeToken{ - tokenType: oidc.AccessTokenType, - userID: token.userID, - issuer: issuer, - resourceOwner: token.resourceOwner, - authMethods: token.authMethods, - actor: token.actor, - audience: token.audience, - scopes: token.scope, + tokenType: oidc.AccessTokenType, + userID: token.userID, + issuer: issuer, + resourceOwner: token.resourceOwner, + authMethods: token.authMethods, + actor: token.actor, + audience: token.audience, + scopes: token.scope, + preferredLanguage: token.preferredLanguage, } } func idTokenClaimsToExchangeToken(claims *oidc.IDTokenClaims, resourceOwner string) *exchangeToken { + var preferredLanguage *language.Tag + if tag := claims.Locale.Tag(); !tag.IsRoot() { + preferredLanguage = &tag + } return &exchangeToken{ - tokenType: oidc.IDTokenType, - userID: claims.Subject, - issuer: claims.Issuer, - resourceOwner: resourceOwner, - authTime: claims.GetAuthTime(), - authMethods: AMRToAuthMethodTypes(claims.AuthenticationMethodsReferences), - actor: actorClaimsToDomain(claims.Actor), - audience: claims.Audience, + tokenType: oidc.IDTokenType, + userID: claims.Subject, + issuer: claims.Issuer, + resourceOwner: resourceOwner, + authTime: claims.GetAuthTime(), + authMethods: AMRToAuthMethodTypes(claims.AuthenticationMethodsReferences), + actor: actorClaimsToDomain(claims.Actor), + audience: claims.Audience, + preferredLanguage: preferredLanguage, } } @@ -77,7 +85,7 @@ func actorDomainToClaims(actor *domain.TokenActor) *oidc.ActorClaims { } } -func jwtToExchangeToken(jwt *oidc.JWTTokenRequest, resourceOwner string) *exchangeToken { +func jwtToExchangeToken(jwt *oidc.JWTTokenRequest, resourceOwner string, preferredLanguage *language.Tag) *exchangeToken { return &exchangeToken{ tokenType: oidc.JWTTokenType, userID: jwt.Subject, @@ -86,6 +94,7 @@ func jwtToExchangeToken(jwt *oidc.JWTTokenRequest, resourceOwner string) *exchan scopes: jwt.Scopes, authTime: jwt.IssuedAt.AsTime(), // audience omitted as we don't thrust audiences not signed by us + preferredLanguage: preferredLanguage, } } diff --git a/internal/api/oidc/token_exchange_integration_test.go b/internal/api/oidc/token_exchange_integration_test.go index e1fb8fad07..2636b85d86 100644 --- a/internal/api/oidc/token_exchange_integration_test.go +++ b/internal/api/oidc/token_exchange_integration_test.go @@ -587,5 +587,5 @@ func TestImpersonation_API_Call(t *testing.T) { _, err = Tester.Client.Admin.GetAllowedLanguages(impersonatedCTX, &admin.GetAllowedLanguagesRequest{}) status := status.Convert(err) assert.Equal(t, codes.PermissionDenied, status.Code()) - assert.Equal(t, "Errors.TokenExchange.Token.NotForAPI (APP-wai8O)", status.Message()) + assert.Equal(t, "Errors.TokenExchange.Token.NotForAPI (APP-Shi0J)", status.Message()) } diff --git a/internal/api/oidc/token_jwt_profile.go b/internal/api/oidc/token_jwt_profile.go new file mode 100644 index 0000000000..b53a63ca10 --- /dev/null +++ b/internal/api/oidc/token_jwt_profile.go @@ -0,0 +1,99 @@ +package oidc + +import ( + "context" + "time" + + "github.com/go-jose/go-jose/v4" + "github.com/zitadel/oidc/v3/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/op" + + "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/query" + "github.com/zitadel/zitadel/internal/telemetry/tracing" +) + +func (s *Server) JWTProfile(ctx context.Context, r *op.Request[oidc.JWTProfileGrantRequest]) (_ *op.Response, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { + span.EndWithError(err) + err = oidcError(err) + }() + + user, jwtReq, err := s.verifyJWTProfile(ctx, r.Data) + if err != nil { + return nil, err + } + + client := &clientCredentialsClient{ + id: jwtReq.Subject, + user: user, + } + scope, err := op.ValidateAuthReqScopes(client, r.Data.Scope) + if err != nil { + return nil, err + } + scope, err = s.checkOrgScopes(ctx, client.user, scope) + if err != nil { + return nil, err + } + + session, err := s.command.CreateOIDCSession(ctx, + user.ID, + user.ResourceOwner, + jwtReq.Subject, + scope, + domain.AddAudScopeToAudience(ctx, nil, r.Data.Scope), + nil, + time.Now(), + "", + nil, + nil, + domain.TokenReasonClientCredentials, + nil, + false, + ) + return response(s.accessTokenResponseFromSession(ctx, client, session, "", "", false)) +} + +func (s *Server) verifyJWTProfile(ctx context.Context, req *oidc.JWTProfileGrantRequest) (user *query.User, tokenRequest *oidc.JWTTokenRequest, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + checkSubject := func(jwt *oidc.JWTTokenRequest) (err error) { + user, err = s.query.GetUserByID(ctx, true, jwt.Subject) + return err + } + verifier := op.NewJWTProfileVerifier( + &jwtProfileKeyStorage{query: s.query}, + op.IssuerFromContext(ctx), + time.Hour, time.Second, + op.SubjectCheck(checkSubject), + ) + tokenRequest, err = op.VerifyJWTAssertion(ctx, req.Assertion, verifier) + if err != nil { + return nil, nil, err + } + return user, tokenRequest, nil +} + +type jwtProfileKeyStorage struct { + query *query.Queries +} + +func (s *jwtProfileKeyStorage) GetKeyByIDAndClientID(ctx context.Context, keyID, userID string) (*jose.JSONWebKey, error) { + publicKeyData, err := s.query.GetAuthNKeyPublicKeyByIDAndIdentifier(ctx, keyID, userID) + if err != nil { + return nil, err + } + publicKey, err := crypto.BytesToPublicKey(publicKeyData) + if err != nil { + return nil, err + } + return &jose.JSONWebKey{ + KeyID: keyID, + Use: "sig", + Key: publicKey, + }, nil +} diff --git a/internal/api/oidc/token_jwt_profile_integration_test.go b/internal/api/oidc/token_jwt_profile_integration_test.go new file mode 100644 index 0000000000..b80ea09bcd --- /dev/null +++ b/internal/api/oidc/token_jwt_profile_integration_test.go @@ -0,0 +1,103 @@ +//go:build integration + +package oidc_test + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "github.com/zitadel/oidc/v3/pkg/client/profile" + "github.com/zitadel/oidc/v3/pkg/client/rp" + "github.com/zitadel/oidc/v3/pkg/oidc" + + oidc_api "github.com/zitadel/zitadel/internal/api/oidc" + "github.com/zitadel/zitadel/internal/domain" +) + +func TestServer_JWTProfile(t *testing.T) { + userID, keyData, err := Tester.CreateOIDCJWTProfileClient(CTX) + require.NoError(t, err) + + type claims struct { + resourceOwnerID any + resourceOwnerName any + resourceOwnerPrimaryDomain any + orgDomain any + } + tests := []struct { + name string + keyData []byte + scope []string + wantClaims claims + wantErr bool + }{ + { + name: "success", + keyData: keyData, + scope: []string{oidc.ScopeOpenID}, + }, + { + name: "org id and domain scope", + keyData: keyData, + scope: []string{ + oidc.ScopeOpenID, + domain.OrgIDScope + Tester.Organisation.ID, + domain.OrgDomainPrimaryScope + Tester.Organisation.Domain, + }, + wantClaims: claims{ + resourceOwnerID: Tester.Organisation.ID, + resourceOwnerName: Tester.Organisation.Name, + resourceOwnerPrimaryDomain: Tester.Organisation.Domain, + orgDomain: Tester.Organisation.Domain, + }, + }, + { + name: "invalid org domain filtered", + keyData: keyData, + scope: []string{ + oidc.ScopeOpenID, + domain.OrgDomainPrimaryScope + Tester.Organisation.Domain, + domain.OrgDomainPrimaryScope + "foo"}, + wantClaims: claims{ + orgDomain: Tester.Organisation.Domain, + }, + }, + { + name: "invalid org id filtered", + keyData: keyData, + scope: []string{oidc.ScopeOpenID, + domain.OrgIDScope + Tester.Organisation.ID, + domain.OrgIDScope + "foo", + }, + wantClaims: claims{ + resourceOwnerID: Tester.Organisation.ID, + resourceOwnerName: Tester.Organisation.Name, + resourceOwnerPrimaryDomain: Tester.Organisation.Domain, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + tokenSource, err := profile.NewJWTProfileTokenSourceFromKeyFileData(CTX, Tester.OIDCIssuer(), tt.keyData, tt.scope) + require.NoError(t, err) + + tokens, err := tokenSource.TokenCtx(CTX) + if tt.wantErr { + require.Error(t, err) + return + } + require.NoError(t, err) + require.NotNil(t, tokens) + + provider, err := rp.NewRelyingPartyOIDC(CTX, Tester.OIDCIssuer(), "", "", redirectURI, tt.scope) + require.NoError(t, err) + userinfo, err := rp.Userinfo[*oidc.UserInfo](CTX, tokens.AccessToken, oidc.BearerToken, userID, provider) + require.NoError(t, err) + assert.Equal(t, tt.wantClaims.resourceOwnerID, userinfo.Claims[oidc_api.ClaimResourceOwnerID]) + assert.Equal(t, tt.wantClaims.resourceOwnerName, userinfo.Claims[oidc_api.ClaimResourceOwnerName]) + assert.Equal(t, tt.wantClaims.resourceOwnerPrimaryDomain, userinfo.Claims[oidc_api.ClaimResourceOwnerPrimaryDomain]) + assert.Equal(t, tt.wantClaims.orgDomain, userinfo.Claims[domain.OrgDomainPrimaryClaim]) + }) + } +} diff --git a/internal/api/oidc/token_refresh.go b/internal/api/oidc/token_refresh.go new file mode 100644 index 0000000000..66a8b8a263 --- /dev/null +++ b/internal/api/oidc/token_refresh.go @@ -0,0 +1,101 @@ +package oidc + +import ( + "context" + "errors" + "slices" + + "github.com/zitadel/oidc/v3/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/op" + + "github.com/zitadel/zitadel/internal/command" + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/telemetry/tracing" + "github.com/zitadel/zitadel/internal/zerrors" +) + +func (s *Server) RefreshToken(ctx context.Context, r *op.ClientRequest[oidc.RefreshTokenRequest]) (_ *op.Response, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { + span.EndWithError(err) + err = oidcError(err) + }() + + client, ok := r.Client.(*Client) + if !ok { + return nil, zerrors.ThrowInternal(nil, "OIDC-ga0EP", "Error.Internal") + } + + session, err := s.command.ExchangeOIDCSessionRefreshAndAccessToken(ctx, r.Data.RefreshToken, r.Data.Scopes, refreshTokenComplianceChecker()) + if err == nil { + return response(s.accessTokenResponseFromSession(ctx, client, session, "", client.client.ProjectID, client.client.ProjectRoleAssertion)) + } else if errors.Is(err, zerrors.ThrowPreconditionFailed(nil, "OIDCS-JOI23", "Errors.OIDCSession.RefreshTokenInvalid")) { + // We try again for v1 tokens when we encountered specific parsing error + return s.refreshTokenV1(ctx, client, r) + } + return nil, err +} + +// refreshTokenV1 verifies a v1 refresh token. +// When valid a v2 OIDC session is created and v2 tokens are returned. +// This "upgrades" existing v1 sessions to v2 session without requiring users to re-login. +// +// This function can be removed when we retire the v1 token repo. +func (s *Server) refreshTokenV1(ctx context.Context, client *Client, r *op.ClientRequest[oidc.RefreshTokenRequest]) (_ *op.Response, err error) { + refreshToken, err := s.repo.RefreshTokenByToken(ctx, r.Data.RefreshToken) + if err != nil { + return nil, err + } + scope, err := validateRefreshTokenScopes(refreshToken.Scopes, r.Data.Scopes) + if err != nil { + return nil, err + } + session, err := s.command.CreateOIDCSession(ctx, + refreshToken.UserID, + refreshToken.ResourceOwner, + refreshToken.ClientID, + scope, + refreshToken.Audience, + AMRToAuthMethodTypes(refreshToken.AuthMethodsReferences), + refreshToken.AuthTime, + "", + nil, // Preferred language not in refresh token view + &domain.UserAgent{ + FingerprintID: &refreshToken.UserAgentID, + Description: &refreshToken.UserAgentID, + }, + domain.TokenReasonRefresh, + refreshToken.Actor, + true, + ) + if err != nil { + return nil, err + } + + // make sure the v1 refresh token can't be reused. + _, err = s.command.RevokeRefreshToken(ctx, refreshToken.UserID, refreshToken.ResourceOwner, refreshToken.ID) + if err != nil { + return nil, err + } + + return response(s.accessTokenResponseFromSession(ctx, client, session, "", client.client.ProjectID, client.client.ProjectRoleAssertion)) +} + +// refreshTokenComplianceChecker validates that the requested scope is a subset of the original auth request scope. +func refreshTokenComplianceChecker() command.RefreshTokenComplianceChecker { + return func(_ context.Context, model *command.OIDCSessionWriteModel, requestedScope []string) ([]string, error) { + return validateRefreshTokenScopes(model.Scope, requestedScope) + } +} + +func validateRefreshTokenScopes(currentScope, requestedScope []string) ([]string, error) { + if len(requestedScope) == 0 { + return currentScope, nil + } + for _, s := range requestedScope { + if !slices.Contains(currentScope, s) { + return nil, oidc.ErrInvalidScope() + } + } + return requestedScope, nil +} diff --git a/internal/api/oidc/userinfo.go b/internal/api/oidc/userinfo.go index 6d01e6bf9c..c21b746c49 100644 --- a/internal/api/oidc/userinfo.go +++ b/internal/api/oidc/userinfo.go @@ -20,6 +20,7 @@ import ( "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/query" "github.com/zitadel/zitadel/internal/telemetry/tracing" + "github.com/zitadel/zitadel/internal/zerrors" ) func (s *Server) UserInfo(ctx context.Context, r *op.Request[oidc.UserInfoRequest]) (_ *op.Response, err error) { @@ -48,7 +49,8 @@ func (s *Server) UserInfo(ctx context.Context, r *op.Request[oidc.UserInfoReques ) if token.clientID != "" { projectID, assertion, err = s.query.GetOIDCUserinfoClientByID(ctx, token.clientID) - if err != nil { + // token.clientID might contain a username (e.g. client credentials) -> ignore the not found + if err != nil && !zerrors.IsNotFound(err) { return nil, err } } diff --git a/internal/api/ui/login/device_auth.go b/internal/api/ui/login/device_auth.go index b05cc1a5fd..659f2ac144 100644 --- a/internal/api/ui/login/device_auth.go +++ b/internal/api/ui/login/device_auth.go @@ -112,6 +112,7 @@ func (l *Login) handleDeviceAuthUserCode(w http.ResponseWriter, r *http.Request) } authRequest, err := l.authRepo.CreateAuthRequest(ctx, &domain.AuthRequest{ CreationDate: time.Now(), + BrowserInfo: domain.BrowserInfoFromRequest(r), AgentID: userAgentID, ApplicationID: deviceAuthReq.ClientID, InstanceID: authz.GetInstance(ctx).InstanceID(), @@ -163,7 +164,7 @@ func (l *Login) handleDeviceAuthAction(w http.ResponseWriter, r *http.Request) { action := mux.Vars(r)["action"] switch action { case deviceAuthAllowed: - _, err = l.command.ApproveDeviceAuth(r.Context(), authDev.DeviceCode, authReq.UserID, authReq.UserAuthMethodTypes(), authReq.AuthTime) + _, err = l.command.ApproveDeviceAuth(r.Context(), authDev.DeviceCode, authReq.UserID, authReq.UserOrgID, authReq.UserAuthMethodTypes(), authReq.AuthTime, authReq.PreferredLanguage, authReq.BrowserInfo.ToUserAgent()) case deviceAuthDenied: _, err = l.command.CancelDeviceAuth(r.Context(), authDev.DeviceCode, domain.DeviceAuthCanceledDenied) default: diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request.go b/internal/auth/repository/eventsourcing/eventstore/auth_request.go index 782a2a83b0..4a846745e9 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request.go @@ -5,7 +5,9 @@ import ( "strings" "time" + "github.com/muhlemmer/gu" "github.com/zitadel/logging" + "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/auth/repository/eventsourcing/view" @@ -1016,6 +1018,9 @@ func (repo *AuthRequestRepo) nextSteps(ctx context.Context, request *domain.Auth } request.DisplayName = userSession.DisplayName request.AvatarKey = userSession.AvatarKey + if user.HumanView != nil && user.HumanView.PreferredLanguage != "" { + request.PreferredLanguage = gu.Ptr(language.Make(user.HumanView.PreferredLanguage)) + } isInternalLogin := request.SelectedIDPConfigID == "" && userSession.SelectedIDPConfigID == "" idps, err := checkExternalIDPsOfUser(ctx, repo.IDPUserLinksProvider, user.ID) diff --git a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go index 097a922653..d3a8201474 100644 --- a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go +++ b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go @@ -8,6 +8,7 @@ import ( "time" "github.com/go-jose/go-jose/v4" + "github.com/muhlemmer/gu" "github.com/zitadel/logging" "github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/op" @@ -96,8 +97,7 @@ func (repo *TokenVerifierRepo) VerifyAccessToken(ctx context.Context, tokenStrin return "", "", "", "", "", zerrors.ThrowUnauthenticated(nil, "APP-Reb32", "invalid token") } if strings.HasPrefix(tokenID, command.IDPrefixV2) { - userID, clientID, resourceOwner, err = repo.verifyAccessTokenV2(ctx, tokenID, verifierClientID, projectID) - return + return repo.verifyAccessTokenV2(ctx, tokenID, verifierClientID, projectID) } if sessionID, ok := strings.CutPrefix(tokenID, authz.SessionTokenPrefix); ok { userID, clientID, resourceOwner, err = repo.verifySessionToken(ctx, sessionID, tokenString) @@ -106,7 +106,7 @@ func (repo *TokenVerifierRepo) VerifyAccessToken(ctx context.Context, tokenStrin return repo.verifyAccessTokenV1(ctx, tokenID, subject, verifierClientID, projectID) } -func (repo *TokenVerifierRepo) verifyAccessTokenV1(ctx context.Context, tokenID, subject, verifierClientID, projectID string) (userID string, agentID string, clientID, prefLang, resourceOwner string, err error) { +func (repo *TokenVerifierRepo) verifyAccessTokenV1(ctx context.Context, tokenID, subject, verifierClientID, projectID string) (userID, agentID, clientID, prefLang, resourceOwner string, err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() @@ -131,24 +131,27 @@ func (repo *TokenVerifierRepo) verifyAccessTokenV1(ctx context.Context, tokenID, return token.UserID, token.UserAgentID, token.ApplicationID, token.PreferredLanguage, token.ResourceOwner, nil } -func (repo *TokenVerifierRepo) verifyAccessTokenV2(ctx context.Context, token, verifierClientID, projectID string) (userID, clientID, resourceOwner string, err error) { +func (repo *TokenVerifierRepo) verifyAccessTokenV2(ctx context.Context, token, verifierClientID, projectID string) (userID, agentID, clientID, prefLang, resourceOwner string, err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() activeToken, err := repo.Query.ActiveAccessTokenByToken(ctx, token) if err != nil { - return "", "", "", err + return "", "", "", "", "", err } if activeToken.Actor != nil { - return "", "", "", zerrors.ThrowPermissionDenied(nil, "APP-Shi0J", "Errors.TokenExchange.Token.NotForAPI") + return "", "", "", "", "", zerrors.ThrowPermissionDenied(nil, "APP-Shi0J", "Errors.TokenExchange.Token.NotForAPI") } if err = verifyAudience(activeToken.Audience, verifierClientID, projectID); err != nil { - return "", "", "", err + return "", "", "", "", "", err } if err = repo.checkAuthentication(ctx, activeToken.AuthMethods, activeToken.UserID); err != nil { - return "", "", "", err + return "", "", "", "", "", err } - return activeToken.UserID, activeToken.ClientID, activeToken.ResourceOwner, nil + prefLang = gu.Value(activeToken.PreferredLanguage).String() + agentID = gu.Value(gu.Value(activeToken.UserAgent).FingerprintID) + + return activeToken.UserID, agentID, activeToken.ClientID, prefLang, activeToken.ResourceOwner, nil } func (repo *TokenVerifierRepo) verifySessionToken(ctx context.Context, sessionID, token string) (userID, clientID, resourceOwner string, err error) { diff --git a/internal/command/auth_request.go b/internal/command/auth_request.go index 1a24e75b5c..2acf08bf4f 100644 --- a/internal/command/auth_request.go +++ b/internal/command/auth_request.go @@ -12,21 +12,22 @@ import ( ) type AuthRequest struct { - ID string - LoginClient string - ClientID string - RedirectURI string - State string - Nonce string - Scope []string - Audience []string - ResponseType domain.OIDCResponseType - CodeChallenge *domain.OIDCCodeChallenge - Prompt []domain.Prompt - UILocales []string - MaxAge *time.Duration - LoginHint *string - HintUserID *string + ID string + LoginClient string + ClientID string + RedirectURI string + State string + Nonce string + Scope []string + Audience []string + ResponseType domain.OIDCResponseType + CodeChallenge *domain.OIDCCodeChallenge + Prompt []domain.Prompt + UILocales []string + MaxAge *time.Duration + LoginHint *string + HintUserID *string + NeedRefreshToken bool } type CurrentAuthRequest struct { @@ -69,6 +70,7 @@ func (c *Commands) AddAuthRequest(ctx context.Context, authRequest *AuthRequest) authRequest.MaxAge, authRequest.LoginHint, authRequest.HintUserID, + authRequest.NeedRefreshToken, )) if err != nil { return nil, err @@ -148,25 +150,6 @@ func (c *Commands) AddAuthRequestCode(ctx context.Context, authRequestID, code s &authrequest.NewAggregate(writeModel.AggregateID, authz.GetInstance(ctx).InstanceID()).Aggregate)) } -func (c *Commands) ExchangeAuthCode(ctx context.Context, code string) (authRequest *CurrentAuthRequest, err error) { - if code == "" { - return nil, zerrors.ThrowPreconditionFailed(nil, "COMMAND-Sf3g2", "Errors.AuthRequest.InvalidCode") - } - writeModel, err := c.getAuthRequestWriteModel(ctx, code) - if err != nil { - return nil, err - } - if writeModel.AuthRequestState != domain.AuthRequestStateCodeAdded { - return nil, zerrors.ThrowPreconditionFailed(nil, "COMMAND-SFwd2", "Errors.AuthRequest.NoCode") - } - err = c.pushAppendAndReduce(ctx, writeModel, authrequest.NewCodeExchangedEvent(ctx, - &authrequest.NewAggregate(writeModel.AggregateID, authz.GetInstance(ctx).InstanceID()).Aggregate)) - if err != nil { - return nil, err - } - return authRequestWriteModelToCurrentAuthRequest(writeModel), nil -} - func authRequestWriteModelToCurrentAuthRequest(writeModel *AuthRequestWriteModel) (_ *CurrentAuthRequest) { return &CurrentAuthRequest{ AuthRequest: &AuthRequest{ diff --git a/internal/command/auth_request_model.go b/internal/command/auth_request_model.go index 235477f627..6390eb7235 100644 --- a/internal/command/auth_request_model.go +++ b/internal/command/auth_request_model.go @@ -34,6 +34,7 @@ type AuthRequestWriteModel struct { AuthTime time.Time AuthMethods []domain.UserAuthMethodType AuthRequestState domain.AuthRequestState + NeedRefreshToken bool } func NewAuthRequestWriteModel(ctx context.Context, id string) *AuthRequestWriteModel { @@ -64,6 +65,7 @@ func (m *AuthRequestWriteModel) Reduce() error { m.LoginHint = e.LoginHint m.HintUserID = e.HintUserID m.AuthRequestState = domain.AuthRequestStateAdded + m.NeedRefreshToken = e.NeedRefreshToken case *authrequest.SessionLinkedEvent: m.SessionID = e.SessionID m.UserID = e.UserID diff --git a/internal/command/auth_request_test.go b/internal/command/auth_request_test.go index a70a592bb0..92b90e3e24 100644 --- a/internal/command/auth_request_test.go +++ b/internal/command/auth_request_test.go @@ -10,6 +10,7 @@ import ( "github.com/muhlemmer/gu" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/domain" @@ -59,6 +60,7 @@ func TestCommands_AddAuthRequest(t *testing.T) { nil, nil, nil, + false, ), ), ), @@ -96,6 +98,7 @@ func TestCommands_AddAuthRequest(t *testing.T) { gu.Ptr(time.Duration(0)), gu.Ptr("loginHint"), gu.Ptr("hintUserID"), + false, ), ), ), @@ -223,6 +226,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { nil, nil, nil, + true, ), ), eventFromEventPusher( @@ -263,6 +267,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { nil, nil, nil, + true, ), ), ), @@ -301,6 +306,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { nil, nil, nil, + true, ), ), ), @@ -338,6 +344,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { nil, nil, nil, + true, ), ), ), @@ -354,7 +361,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { )), eventFromEventPusher( session.NewUserCheckedEvent(mockCtx, &session.NewAggregate("sessionID", "instance1").Aggregate, - "userID", "org1", testNow.Add(-5*time.Minute)), + "userID", "org1", testNow.Add(-5*time.Minute), &language.Afrikaans), ), eventFromEventPusher( session.NewPasswordCheckedEvent(mockCtx, &session.NewAggregate("sessionID", "instance1").Aggregate, @@ -398,6 +405,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { nil, nil, nil, + true, ), ), ), @@ -447,6 +455,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { nil, nil, nil, + true, ), ), ), @@ -463,7 +472,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { )), eventFromEventPusher( session.NewUserCheckedEvent(mockCtx, &session.NewAggregate("sessionID", "instance1").Aggregate, - "userID", "org1", testNow), + "userID", "org1", testNow, &language.Afrikaans), ), eventFromEventPusher( session.NewPasswordCheckedEvent(mockCtx, &session.NewAggregate("sessionID", "instance1").Aggregate, @@ -532,6 +541,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { nil, nil, nil, + true, ), ), ), @@ -548,7 +558,7 @@ func TestCommands_LinkSessionToAuthRequest(t *testing.T) { )), eventFromEventPusher( session.NewUserCheckedEvent(mockCtx, &session.NewAggregate("sessionID", "instance1").Aggregate, - "userID", "org1", testNow), + "userID", "org1", testNow, &language.Afrikaans), ), eventFromEventPusher( session.NewPasswordCheckedEvent(mockCtx, &session.NewAggregate("sessionID", "instance1").Aggregate, @@ -674,6 +684,7 @@ func TestCommands_FailAuthRequest(t *testing.T) { nil, nil, nil, + true, ), ), ), @@ -771,6 +782,7 @@ func TestCommands_AddAuthRequestCode(t *testing.T) { gu.Ptr(time.Duration(0)), gu.Ptr("loginHint"), gu.Ptr("hintUserID"), + true, ), ), ), @@ -807,6 +819,7 @@ func TestCommands_AddAuthRequestCode(t *testing.T) { gu.Ptr(time.Duration(0)), gu.Ptr("loginHint"), gu.Ptr("hintUserID"), + true, ), ), eventFromEventPusher( @@ -841,166 +854,3 @@ func TestCommands_AddAuthRequestCode(t *testing.T) { }) } } - -func TestCommands_ExchangeAuthCode(t *testing.T) { - mockCtx := authz.NewMockContext("instanceID", "orgID", "loginClient") - type fields struct { - eventstore *eventstore.Eventstore - } - type args struct { - ctx context.Context - code string - } - type res struct { - authRequest *CurrentAuthRequest - err error - } - tests := []struct { - name string - fields fields - args args - res res - }{ - { - "empty code error", - fields{ - eventstore: eventstoreExpect(t), - }, - args{ - ctx: mockCtx, - code: "", - }, - res{ - err: zerrors.ThrowPreconditionFailed(nil, "COMMAND-Sf3g2", "Errors.AuthRequest.InvalidCode"), - }, - }, - { - "no code added error", - fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher( - authrequest.NewAddedEvent(mockCtx, &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, - "loginClient", - "clientID", - "redirectURI", - "state", - "nonce", - []string{"openid"}, - []string{"audience"}, - domain.OIDCResponseTypeCode, - &domain.OIDCCodeChallenge{ - Challenge: "challenge", - Method: domain.CodeChallengeMethodS256, - }, - []domain.Prompt{domain.PromptNone}, - []string{"en", "de"}, - gu.Ptr(time.Duration(0)), - gu.Ptr("loginHint"), - gu.Ptr("hintUserID"), - ), - ), - ), - ), - }, - args{ - ctx: mockCtx, - code: "V2_authRequestID", - }, - res{ - err: zerrors.ThrowPreconditionFailed(nil, "COMMAND-SFwd2", "Errors.AuthRequest.NoCode"), - }, - }, - { - "code exchanged", - fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher( - authrequest.NewAddedEvent(mockCtx, &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, - "loginClient", - "clientID", - "redirectURI", - "state", - "nonce", - []string{"openid"}, - []string{"audience"}, - domain.OIDCResponseTypeCode, - &domain.OIDCCodeChallenge{ - Challenge: "challenge", - Method: domain.CodeChallengeMethodS256, - }, - []domain.Prompt{domain.PromptNone}, - []string{"en", "de"}, - gu.Ptr(time.Duration(0)), - gu.Ptr("loginHint"), - gu.Ptr("hintUserID"), - ), - ), - eventFromEventPusher( - authrequest.NewSessionLinkedEvent(mockCtx, &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, - "sessionID", - "userID", - testNow, - []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - ), - ), - eventFromEventPusher( - authrequest.NewCodeAddedEvent(mockCtx, &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - ), - expectPush( - authrequest.NewCodeExchangedEvent(mockCtx, &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - ), - }, - args{ - ctx: mockCtx, - code: "V2_authRequestID", - }, - res{ - authRequest: &CurrentAuthRequest{ - AuthRequest: &AuthRequest{ - ID: "V2_authRequestID", - LoginClient: "loginClient", - ClientID: "clientID", - RedirectURI: "redirectURI", - State: "state", - Nonce: "nonce", - Scope: []string{"openid"}, - Audience: []string{"audience"}, - ResponseType: domain.OIDCResponseTypeCode, - CodeChallenge: &domain.OIDCCodeChallenge{ - Challenge: "challenge", - Method: domain.CodeChallengeMethodS256, - }, - Prompt: []domain.Prompt{domain.PromptNone}, - UILocales: []string{"en", "de"}, - MaxAge: gu.Ptr(time.Duration(0)), - LoginHint: gu.Ptr("loginHint"), - HintUserID: gu.Ptr("hintUserID"), - }, - SessionID: "sessionID", - UserID: "userID", - AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - }, - }, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - c := &Commands{ - eventstore: tt.fields.eventstore, - } - got, err := c.ExchangeAuthCode(tt.args.ctx, tt.args.code) - assert.ErrorIs(t, tt.res.err, err) - - if err == nil { - // equal on time won't work -> test separately and clear it before comparing the rest - assert.WithinRange(t, got.AuthTime, testNow, testNow) - got.AuthTime = time.Time{} - } - assert.Equal(t, tt.res.authRequest, got) - }) - } -} diff --git a/internal/command/device_auth.go b/internal/command/device_auth.go index fe8b131071..67e42b7637 100644 --- a/internal/command/device_auth.go +++ b/internal/command/device_auth.go @@ -2,16 +2,20 @@ package command import ( "context" + "fmt" "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/deviceauth" + "github.com/zitadel/zitadel/internal/telemetry/tracing" "github.com/zitadel/zitadel/internal/zerrors" ) -func (c *Commands) AddDeviceAuth(ctx context.Context, clientID, deviceCode, userCode string, expires time.Time, scopes, audience []string) (*domain.ObjectDetails, error) { +func (c *Commands) AddDeviceAuth(ctx context.Context, clientID, deviceCode, userCode string, expires time.Time, scopes, audience []string, needRefreshToken bool) (*domain.ObjectDetails, error) { aggr := deviceauth.NewAggregate(deviceCode, authz.GetInstance(ctx).InstanceID()) model := NewDeviceAuthWriteModel(deviceCode, aggr.ResourceOwner) @@ -24,6 +28,7 @@ func (c *Commands) AddDeviceAuth(ctx context.Context, clientID, deviceCode, user expires, scopes, audience, + needRefreshToken, )) if err != nil { return nil, err @@ -36,7 +41,16 @@ func (c *Commands) AddDeviceAuth(ctx context.Context, clientID, deviceCode, user return writeModelToObjectDetails(&model.WriteModel), nil } -func (c *Commands) ApproveDeviceAuth(ctx context.Context, deviceCode, subject string, authMethods []domain.UserAuthMethodType, authTime time.Time) (*domain.ObjectDetails, error) { +func (c *Commands) ApproveDeviceAuth( + ctx context.Context, + deviceCode, + userID, + userOrgID string, + authMethods []domain.UserAuthMethodType, + authTime time.Time, + preferredLanguage *language.Tag, + userAgent *domain.UserAgent, +) (*domain.ObjectDetails, error) { model, err := c.getDeviceAuthWriteModelByDeviceCode(ctx, deviceCode) if err != nil { return nil, err @@ -44,9 +58,7 @@ func (c *Commands) ApproveDeviceAuth(ctx context.Context, deviceCode, subject st if !model.State.Exists() { return nil, zerrors.ThrowNotFound(nil, "COMMAND-Hief9", "Errors.DeviceAuth.NotFound") } - aggr := deviceauth.NewAggregate(model.AggregateID, model.InstanceID) - - pushedEvents, err := c.eventstore.Push(ctx, deviceauth.NewApprovedEvent(ctx, aggr, subject, authMethods, authTime)) + pushedEvents, err := c.eventstore.Push(ctx, deviceauth.NewApprovedEvent(ctx, model.aggregate, userID, userOrgID, authMethods, authTime, preferredLanguage, userAgent)) if err != nil { return nil, err } @@ -66,9 +78,7 @@ func (c *Commands) CancelDeviceAuth(ctx context.Context, id string, reason domai if !model.State.Exists() { return nil, zerrors.ThrowNotFound(nil, "COMMAND-gee5A", "Errors.DeviceAuth.NotFound") } - aggr := deviceauth.NewAggregate(model.AggregateID, model.InstanceID) - - pushedEvents, err := c.eventstore.Push(ctx, deviceauth.NewCanceledEvent(ctx, aggr, reason)) + pushedEvents, err := c.eventstore.Push(ctx, deviceauth.NewCanceledEvent(ctx, model.aggregate, reason)) if err != nil { return nil, err } @@ -81,10 +91,89 @@ func (c *Commands) CancelDeviceAuth(ctx context.Context, id string, reason domai } func (c *Commands) getDeviceAuthWriteModelByDeviceCode(ctx context.Context, deviceCode string) (*DeviceAuthWriteModel, error) { - model := &DeviceAuthWriteModel{WriteModel: eventstore.WriteModel{AggregateID: deviceCode}} + model := &DeviceAuthWriteModel{ + WriteModel: eventstore.WriteModel{AggregateID: deviceCode}, + } err := c.eventstore.FilterToQueryReducer(ctx, model) if err != nil { return nil, err } + model.aggregate = deviceauth.NewAggregate(model.AggregateID, model.InstanceID) return model, nil } + +type DeviceAuthStateError domain.DeviceAuthState + +func (e DeviceAuthStateError) Error() string { + return fmt.Sprintf("device auth state not approved: %s", domain.DeviceAuthState(e).String()) +} + +// CreateOIDCSessionFromDeviceAuth creates a new OIDC session if the device authorization +// flow is completed (user logged in). +// A [DeviceAuthStateError] is returned if the device authorization was not approved, +// containing a [domain.DeviceAuthState] which can be used to inform the client about the state. +// +// As devices can poll at various intervals, an explicit state takes precedence over expiry. +// This is to prevent cases where users might approve or deny the authorization on time, but the next poll +// happens after expiry. +func (c *Commands) CreateOIDCSessionFromDeviceAuth(ctx context.Context, deviceCode string) (_ *OIDCSession, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + deviceAuthModel, err := c.getDeviceAuthWriteModelByDeviceCode(ctx, deviceCode) + if err != nil { + return nil, err + } + + switch deviceAuthModel.State { + case domain.DeviceAuthStateApproved: + break + case domain.DeviceAuthStateUndefined: + return nil, zerrors.ThrowNotFound(nil, "COMMAND-ua1Vo", "Errors.DeviceAuth.NotFound") + + case domain.DeviceAuthStateInitiated: + if deviceAuthModel.Expires.Before(time.Now()) { + c.asyncPush(ctx, deviceauth.NewCanceledEvent(ctx, deviceAuthModel.aggregate, domain.DeviceAuthCanceledExpired)) + return nil, DeviceAuthStateError(domain.DeviceAuthStateExpired) + } + fallthrough + case domain.DeviceAuthStateDenied, domain.DeviceAuthStateExpired, domain.DeviceAuthStateDone: + fallthrough + default: + return nil, DeviceAuthStateError(deviceAuthModel.State) + } + + cmd, err := c.newOIDCSessionAddEvents(ctx, deviceAuthModel.UserOrgID) + if err != nil { + return nil, err + } + + cmd.AddSession(ctx, + deviceAuthModel.UserID, + deviceAuthModel.UserOrgID, + "", + deviceAuthModel.ClientID, + deviceAuthModel.Audience, + deviceAuthModel.Scopes, + deviceAuthModel.UserAuthMethods, + deviceAuthModel.AuthTime, + "", + deviceAuthModel.PreferredLanguage, + deviceAuthModel.UserAgent, + ) + if err = cmd.AddAccessToken(ctx, deviceAuthModel.Scopes, deviceAuthModel.UserID, deviceAuthModel.UserOrgID, domain.TokenReasonAuthRequest, nil); err != nil { + return nil, err + } + + if deviceAuthModel.NeedRefreshToken { + if err = cmd.AddRefreshToken(ctx, deviceAuthModel.UserID); err != nil { + return nil, err + } + } + cmd.DeviceAuthRequestDone(ctx, deviceAuthModel.aggregate) + return cmd.PushEvents(ctx) +} + +func (cmd *OIDCSessionEvents) DeviceAuthRequestDone(ctx context.Context, deviceAuthAggregate *eventstore.Aggregate) { + cmd.events = append(cmd.events, deviceauth.NewDoneEvent(ctx, deviceAuthAggregate)) +} diff --git a/internal/command/device_auth_model.go b/internal/command/device_auth_model.go index 69a457c514..a97b8b8529 100644 --- a/internal/command/device_auth_model.go +++ b/internal/command/device_auth_model.go @@ -3,6 +3,8 @@ package command import ( "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/deviceauth" @@ -10,16 +12,22 @@ import ( type DeviceAuthWriteModel struct { eventstore.WriteModel + aggregate *eventstore.Aggregate - ClientID string - DeviceCode string - UserCode string - Expires time.Time - Scopes []string - State domain.DeviceAuthState - Subject string - UserAuthMethods []domain.UserAuthMethodType - AuthTime time.Time + ClientID string + DeviceCode string + UserCode string + Expires time.Time + Scopes []string + Audience []string + State domain.DeviceAuthState + UserID string + UserOrgID string + UserAuthMethods []domain.UserAuthMethodType + AuthTime time.Time + PreferredLanguage *language.Tag + UserAgent *domain.UserAgent + NeedRefreshToken bool } func NewDeviceAuthWriteModel(deviceCode, resourceOwner string) *DeviceAuthWriteModel { @@ -28,6 +36,7 @@ func NewDeviceAuthWriteModel(deviceCode, resourceOwner string) *DeviceAuthWriteM AggregateID: deviceCode, ResourceOwner: resourceOwner, }, + aggregate: deviceauth.NewAggregate(deviceCode, resourceOwner), } } @@ -40,14 +49,21 @@ func (m *DeviceAuthWriteModel) Reduce() error { m.UserCode = e.UserCode m.Expires = e.Expires m.Scopes = e.Scopes + m.Audience = e.Audience m.State = e.State + m.NeedRefreshToken = e.NeedRefreshToken case *deviceauth.ApprovedEvent: m.State = domain.DeviceAuthStateApproved - m.Subject = e.Subject + m.UserID = e.UserID + m.UserOrgID = e.UserOrgID m.UserAuthMethods = e.UserAuthMethods m.AuthTime = e.AuthTime + m.PreferredLanguage = e.PreferredLanguage + m.UserAgent = e.UserAgent case *deviceauth.CanceledEvent: m.State = e.Reason.State() + case *deviceauth.DoneEvent: + m.State = domain.DeviceAuthStateDone } } diff --git a/internal/command/device_auth_test.go b/internal/command/device_auth_test.go index a6f3ff9389..3191e8dce9 100644 --- a/internal/command/device_auth_test.go +++ b/internal/command/device_auth_test.go @@ -3,16 +3,27 @@ package command import ( "context" "errors" + "io" + "net" + "net/http" "testing" "time" + "github.com/muhlemmer/gu" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "go.uber.org/mock/gomock" + "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/api/authz" + "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" + "github.com/zitadel/zitadel/internal/id" + "github.com/zitadel/zitadel/internal/id/mock" "github.com/zitadel/zitadel/internal/repository/deviceauth" + "github.com/zitadel/zitadel/internal/repository/oidcsession" + "github.com/zitadel/zitadel/internal/repository/user" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -25,16 +36,17 @@ func TestCommands_AddDeviceAuth(t *testing.T) { require.Len(t, unique, 2) type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore } type args struct { - ctx context.Context - clientID string - deviceCode string - userCode string - expires time.Time - scopes []string - audience []string + ctx context.Context + clientID string + deviceCode string + userCode string + expires time.Time + scopes []string + audience []string + needRefreshToken bool } tests := []struct { name string @@ -46,24 +58,25 @@ func TestCommands_AddDeviceAuth(t *testing.T) { { name: "success", fields: fields{ - eventstore: eventstoreExpect(t, expectPush( + eventstore: expectEventstore(expectPush( deviceauth.NewAddedEvent( ctx, deviceauth.NewAggregate("123", "instance1"), "client_id", "123", "456", now, []string{"a", "b", "c"}, - []string{"projectID", "clientID"}, + []string{"projectID", "clientID"}, true, ), )), }, args: args{ - ctx: authz.WithInstanceID(context.Background(), "instance1"), - clientID: "client_id", - deviceCode: "123", - userCode: "456", - expires: now, - scopes: []string{"a", "b", "c"}, - audience: []string{"projectID", "clientID"}, + ctx: authz.WithInstanceID(context.Background(), "instance1"), + clientID: "client_id", + deviceCode: "123", + userCode: "456", + expires: now, + scopes: []string{"a", "b", "c"}, + audience: []string{"projectID", "clientID"}, + needRefreshToken: true, }, wantDetails: &domain.ObjectDetails{ ResourceOwner: "instance1", @@ -72,24 +85,25 @@ func TestCommands_AddDeviceAuth(t *testing.T) { { name: "push error", fields: fields{ - eventstore: eventstoreExpect(t, expectPushFailed(pushErr, + eventstore: expectEventstore(expectPushFailed(pushErr, deviceauth.NewAddedEvent( ctx, deviceauth.NewAggregate("123", "instance1"), "client_id", "123", "456", now, []string{"a", "b", "c"}, - []string{"projectID", "clientID"}, + []string{"projectID", "clientID"}, false, )), ), }, args: args{ - ctx: authz.WithInstanceID(context.Background(), "instance1"), - clientID: "client_id", - deviceCode: "123", - userCode: "456", - expires: now, - scopes: []string{"a", "b", "c"}, - audience: []string{"projectID", "clientID"}, + ctx: authz.WithInstanceID(context.Background(), "instance1"), + clientID: "client_id", + deviceCode: "123", + userCode: "456", + expires: now, + scopes: []string{"a", "b", "c"}, + audience: []string{"projectID", "clientID"}, + needRefreshToken: false, }, wantErr: pushErr, }, @@ -97,9 +111,9 @@ func TestCommands_AddDeviceAuth(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), } - gotDetails, err := c.AddDeviceAuth(tt.args.ctx, tt.args.clientID, tt.args.deviceCode, tt.args.userCode, tt.args.expires, tt.args.scopes, tt.args.audience) + gotDetails, err := c.AddDeviceAuth(tt.args.ctx, tt.args.clientID, tt.args.deviceCode, tt.args.userCode, tt.args.expires, tt.args.scopes, tt.args.audience, tt.args.needRefreshToken) require.ErrorIs(t, err, tt.wantErr) assert.Equal(t, tt.wantDetails, gotDetails) }) @@ -115,11 +129,14 @@ func TestCommands_ApproveDeviceAuth(t *testing.T) { eventstore *eventstore.Eventstore } type args struct { - ctx context.Context - id string - subject string - authMethods []domain.UserAuthMethodType - authTime time.Time + ctx context.Context + id string + userID string + userOrgID string + authMethods []domain.UserAuthMethodType + authTime time.Time + preferredLanguage *language.Tag + userAgent *domain.UserAgent } tests := []struct { name string @@ -136,9 +153,14 @@ func TestCommands_ApproveDeviceAuth(t *testing.T) { ), }, args: args{ - ctx, "123", "subj", + ctx, "123", "subj", "orgID", []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - time.Unix(123, 456), + time.Unix(123, 456), &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, }, wantErr: zerrors.ThrowNotFound(nil, "COMMAND-Hief9", "Errors.DeviceAuth.NotFound"), }, @@ -153,22 +175,32 @@ func TestCommands_ApproveDeviceAuth(t *testing.T) { deviceauth.NewAggregate("123", "instance1"), "client_id", "123", "456", now, []string{"a", "b", "c"}, - []string{"projectID", "clientID"}, + []string{"projectID", "clientID"}, true, ), )), expectPushFailed(pushErr, deviceauth.NewApprovedEvent( - ctx, deviceauth.NewAggregate("123", "instance1"), "subj", + ctx, deviceauth.NewAggregate("123", "instance1"), "subj", "orgID", []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - time.Unix(123, 456), + time.Unix(123, 456), &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, ), ), ), }, args: args{ - ctx, "123", "subj", + ctx, "123", "subj", "orgID", []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - time.Unix(123, 456), + time.Unix(123, 456), &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, }, wantErr: pushErr, }, @@ -183,22 +215,32 @@ func TestCommands_ApproveDeviceAuth(t *testing.T) { deviceauth.NewAggregate("123", "instance1"), "client_id", "123", "456", now, []string{"a", "b", "c"}, - []string{"projectID", "clientID"}, + []string{"projectID", "clientID"}, true, ), )), expectPush( deviceauth.NewApprovedEvent( - ctx, deviceauth.NewAggregate("123", "instance1"), "subj", + ctx, deviceauth.NewAggregate("123", "instance1"), "subj", "orgID", []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - time.Unix(123, 456), + time.Unix(123, 456), &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, ), ), ), }, args: args{ - ctx, "123", "subj", + ctx, "123", "subj", "orgID", []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - time.Unix(123, 456), + time.Unix(123, 456), &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, }, wantDetails: &domain.ObjectDetails{ ResourceOwner: "instance1", @@ -210,7 +252,7 @@ func TestCommands_ApproveDeviceAuth(t *testing.T) { c := &Commands{ eventstore: tt.fields.eventstore, } - gotDetails, err := c.ApproveDeviceAuth(tt.args.ctx, tt.args.id, tt.args.subject, tt.args.authMethods, tt.args.authTime) + gotDetails, err := c.ApproveDeviceAuth(tt.args.ctx, tt.args.id, tt.args.userID, tt.args.userOrgID, tt.args.authMethods, tt.args.authTime, tt.args.preferredLanguage, tt.args.userAgent) require.ErrorIs(t, err, tt.wantErr) assert.Equal(t, gotDetails, tt.wantDetails) }) @@ -258,7 +300,7 @@ func TestCommands_CancelDeviceAuth(t *testing.T) { deviceauth.NewAggregate("123", "instance1"), "client_id", "123", "456", now, []string{"a", "b", "c"}, - []string{"projectID", "clientID"}, + []string{"projectID", "clientID"}, true, ), )), expectPushFailed(pushErr, @@ -283,7 +325,7 @@ func TestCommands_CancelDeviceAuth(t *testing.T) { deviceauth.NewAggregate("123", "instance1"), "client_id", "123", "456", now, []string{"a", "b", "c"}, - []string{"projectID", "clientID"}, + []string{"projectID", "clientID"}, true, ), )), expectPush( @@ -310,7 +352,7 @@ func TestCommands_CancelDeviceAuth(t *testing.T) { deviceauth.NewAggregate("123", "instance1"), "client_id", "123", "456", now, []string{"a", "b", "c"}, - []string{"projectID", "clientID"}, + []string{"projectID", "clientID"}, true, ), )), expectPush( @@ -338,3 +380,392 @@ func TestCommands_CancelDeviceAuth(t *testing.T) { }) } } + +func TestCommands_CreateOIDCSessionFromDeviceAuth(t *testing.T) { + ctx := authz.WithInstanceID(context.Background(), "instance1") + + type fields struct { + eventstore func(*testing.T) *eventstore.Eventstore + idGenerator id.Generator + defaultAccessTokenLifetime time.Duration + defaultRefreshTokenLifetime time.Duration + defaultRefreshTokenIdleLifetime time.Duration + keyAlgorithm crypto.EncryptionAlgorithm + } + type args struct { + ctx context.Context + deviceCode string + } + tests := []struct { + name string + fields fields + args args + want *OIDCSession + wantErr error + }{ + { + name: "device auth filter error", + fields: fields{ + eventstore: expectEventstore( + expectFilterError(io.ErrClosedPipe), + ), + }, + args: args{ + ctx, + "device1", + }, + wantErr: io.ErrClosedPipe, + }, + { + name: "not yet approved", + fields: fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewAddedEvent( + ctx, + deviceauth.NewAggregate("123", "instance1"), + "clientID", "123", "456", time.Now().Add(time.Minute), + []string{"openid", "offline_access"}, + []string{"audience"}, false, + ), + ), + ), + ), + }, + args: args{ + ctx, + "123", + }, + wantErr: DeviceAuthStateError(domain.DeviceAuthStateInitiated), + }, + { + name: "not found", + fields: fields{ + eventstore: expectEventstore( + expectFilter(), + ), + }, + args: args{ + ctx, + "123", + }, + wantErr: zerrors.ThrowNotFound(nil, "COMMAND-ua1Vo", "Errors.DeviceAuth.NotFound"), + }, + { + name: "expired", + fields: fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewAddedEvent( + ctx, + deviceauth.NewAggregate("123", "instance1"), + "clientID", "123", "456", time.Now().Add(-time.Minute), + []string{"openid", "offline_access"}, + []string{"audience"}, false, + ), + ), + ), + expectPushSlow(time.Second, deviceauth.NewCanceledEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + domain.DeviceAuthCanceledExpired, + )), + ), + }, + args: args{ + ctx, + "123", + }, + wantErr: DeviceAuthStateError(domain.DeviceAuthStateExpired), + }, + { + name: "already expired", + fields: fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewAddedEvent( + ctx, + deviceauth.NewAggregate("123", "instance1"), + "clientID", "123", "456", time.Now().Add(-time.Minute), + []string{"openid", "offline_access"}, + []string{"audience"}, false, + ), + ), + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewCanceledEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + domain.DeviceAuthCanceledExpired, + ), + ), + ), + ), + }, + args: args{ + ctx, + "123", + }, + wantErr: DeviceAuthStateError(domain.DeviceAuthStateExpired), + }, + { + name: "denied", + fields: fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewAddedEvent( + ctx, + deviceauth.NewAggregate("123", "instance1"), + "clientID", "123", "456", time.Now().Add(-time.Minute), + []string{"openid", "offline_access"}, + []string{"audience"}, false, + ), + ), + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewCanceledEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + domain.DeviceAuthCanceledDenied, + ), + ), + ), + ), + }, + args: args{ + ctx, + "123", + }, + wantErr: DeviceAuthStateError(domain.DeviceAuthStateDenied), + }, + { + name: "already done", + fields: fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewAddedEvent( + ctx, + deviceauth.NewAggregate("123", "instance1"), + "clientID", "123", "456", time.Now().Add(-time.Minute), + []string{"openid", "offline_access"}, + []string{"audience"}, false, + ), + ), + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewCanceledEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + domain.DeviceAuthCanceledDenied, + ), + ), + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewDoneEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + ), + ), + ), + ), + }, + args: args{ + ctx, + "123", + }, + wantErr: DeviceAuthStateError(domain.DeviceAuthStateDone), + }, + { + name: "approved, success", + fields: fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewAddedEvent( + ctx, + deviceauth.NewAggregate("123", "instance1"), + "clientID", "123", "456", time.Now().Add(-time.Minute), + []string{"openid", "offline_access"}, + []string{"audience"}, false, + ), + ), + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewApprovedEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + "userID", "org1", + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + testNow, &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + ), + ), + expectFilter(), // token lifetime + expectPush( + oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "userID", "org1", "", "clientID", []string{"audience"}, []string{"openid", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "", &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + oidcsession.NewAccessTokenAddedEvent(context.Background(), + &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil, + ), + user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"), + deviceauth.NewDoneEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + ), + ), + ), + idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"), + defaultAccessTokenLifetime: time.Hour, + defaultRefreshTokenLifetime: 7 * 24 * time.Hour, + defaultRefreshTokenIdleLifetime: 24 * time.Hour, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + args: args{ + ctx, + "123", + }, + want: &OIDCSession{ + TokenID: "V2_oidcSessionID-at_accessTokenID", + ClientID: "clientID", + UserID: "userID", + Audience: []string{"audience"}, + Expiration: time.Time{}.Add(time.Hour), + Scope: []string{"openid", "offline_access"}, + AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + AuthTime: testNow, + PreferredLanguage: &language.Afrikaans, + UserAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + Reason: domain.TokenReasonAuthRequest, + }, + }, + { + name: "approved, with refresh token", + fields: fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewAddedEvent( + ctx, + deviceauth.NewAggregate("123", "instance1"), + "clientID", "123", "456", time.Now().Add(-time.Minute), + []string{"openid", "offline_access"}, + []string{"audience"}, true, + ), + ), + eventFromEventPusherWithInstanceID( + "instance1", + deviceauth.NewApprovedEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + "userID", "org1", + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + testNow, &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + ), + ), + expectFilter(), // token lifetime + expectPush( + oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "userID", "org1", "", "clientID", []string{"audience"}, []string{"openid", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "", &language.Afrikaans, &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + oidcsession.NewAccessTokenAddedEvent(context.Background(), + &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil, + ), + user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"), + oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour, + ), + deviceauth.NewDoneEvent(ctx, + deviceauth.NewAggregate("123", "instance1"), + ), + ), + ), + idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID", "refreshTokenID"), + defaultAccessTokenLifetime: time.Hour, + defaultRefreshTokenLifetime: 7 * 24 * time.Hour, + defaultRefreshTokenIdleLifetime: 24 * time.Hour, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + args: args{ + ctx, + "123", + }, + want: &OIDCSession{ + TokenID: "V2_oidcSessionID-at_accessTokenID", + ClientID: "clientID", + UserID: "userID", + Audience: []string{"audience"}, + Expiration: time.Time{}.Add(time.Hour), + Scope: []string{"openid", "offline_access"}, + AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + AuthTime: testNow, + PreferredLanguage: &language.Afrikaans, + UserAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + Reason: domain.TokenReasonAuthRequest, + RefreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID-rt_refreshTokenID:userID + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + c := &Commands{ + eventstore: tt.fields.eventstore(t), + idGenerator: tt.fields.idGenerator, + defaultAccessTokenLifetime: tt.fields.defaultAccessTokenLifetime, + defaultRefreshTokenLifetime: tt.fields.defaultRefreshTokenLifetime, + defaultRefreshTokenIdleLifetime: tt.fields.defaultRefreshTokenIdleLifetime, + keyAlgorithm: tt.fields.keyAlgorithm, + } + got, err := c.CreateOIDCSessionFromDeviceAuth(tt.args.ctx, tt.args.deviceCode) + c.jobs.Wait() + + require.ErrorIs(t, err, tt.wantErr) + + if got != nil { + assert.WithinRange(t, got.AuthTime, tt.want.AuthTime.Add(-time.Second), tt.want.AuthTime.Add(time.Second)) + got.AuthTime = time.Time{} + tt.want.AuthTime = time.Time{} + } + assert.Equal(t, tt.want, got) + }) + } +} diff --git a/internal/command/oidc_session.go b/internal/command/oidc_session.go index 7d04205aa4..fc384d0d30 100644 --- a/internal/command/oidc_session.go +++ b/internal/command/oidc_session.go @@ -8,7 +8,9 @@ import ( "time" "github.com/zitadel/logging" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/activity" "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" @@ -17,6 +19,7 @@ import ( "github.com/zitadel/zitadel/internal/repository/authrequest" "github.com/zitadel/zitadel/internal/repository/oidcsession" "github.com/zitadel/zitadel/internal/repository/user" + "github.com/zitadel/zitadel/internal/telemetry/tracing" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -28,60 +31,175 @@ const ( oidcTokenFormat = "%s" + oidcTokenSubjectDelimiter + "%s" ) -// AddOIDCSessionAccessToken creates a new OIDC Session, creates an access token and returns its id and expiration. -// If the underlying [AuthRequest] is a OIDC Auth Code Flow, it will set the code as exchanged. -func (c *Commands) AddOIDCSessionAccessToken(ctx context.Context, authRequestID string) (string, time.Time, error) { - cmd, err := c.newOIDCSessionAddEvents(ctx, authRequestID) - if err != nil { - return "", time.Time{}, err - } - cmd.AddSession(ctx) - if err = cmd.AddAccessToken(ctx, cmd.authRequestWriteModel.Scope, domain.TokenReasonAuthRequest, nil); err != nil { - return "", time.Time{}, err - } - cmd.SetAuthRequestSuccessful(ctx) - accessTokenID, _, accessTokenExpiration, err := cmd.PushEvents(ctx) - return accessTokenID, accessTokenExpiration, err +type OIDCSession struct { + SessionID string + TokenID string + ClientID string + UserID string + Audience []string + Expiration time.Time + Scope []string + AuthMethods []domain.UserAuthMethodType + AuthTime time.Time + Nonce string + PreferredLanguage *language.Tag + UserAgent *domain.UserAgent + Reason domain.TokenReason + Actor *domain.TokenActor + RefreshToken string } -// AddOIDCSessionRefreshAndAccessToken creates a new OIDC Session, creates an access token and refresh token. +type AuthRequestComplianceChecker func(context.Context, *AuthRequestWriteModel) error + +// CreateOIDCSessionFromAuthRequest creates a new OIDC Session, creates an access token and refresh token. // It returns the access token id, expiration and the refresh token. // If the underlying [AuthRequest] is a OIDC Auth Code Flow, it will set the code as exchanged. -func (c *Commands) AddOIDCSessionRefreshAndAccessToken(ctx context.Context, authRequestID string) (tokenID, refreshToken string, tokenExpiration time.Time, err error) { - cmd, err := c.newOIDCSessionAddEvents(ctx, authRequestID) +func (c *Commands) CreateOIDCSessionFromAuthRequest(ctx context.Context, authReqId string, complianceCheck AuthRequestComplianceChecker, needRefreshToken bool) (session *OIDCSession, state string, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + if authReqId == "" { + return nil, "", zerrors.ThrowPreconditionFailed(nil, "COMMAND-Sf3g2", "Errors.AuthRequest.InvalidCode") + } + + authReqModel, err := c.getAuthRequestWriteModel(ctx, authReqId) if err != nil { - return "", "", time.Time{}, err + return nil, "", err } - cmd.AddSession(ctx) - if err = cmd.AddAccessToken(ctx, cmd.authRequestWriteModel.Scope, domain.TokenReasonAuthRequest, nil); err != nil { - return "", "", time.Time{}, err + + if authReqModel.ResponseType == domain.OIDCResponseTypeCode && authReqModel.AuthRequestState != domain.AuthRequestStateCodeAdded { + return nil, "", zerrors.ThrowPreconditionFailed(nil, "COMMAND-Iung5", "Errors.AuthRequest.NoCode") } - if err = cmd.AddRefreshToken(ctx); err != nil { - return "", "", time.Time{}, err + + sessionModel := NewSessionWriteModel(authReqModel.SessionID, authz.GetInstance(ctx).InstanceID()) + err = c.eventstore.FilterToQueryReducer(ctx, sessionModel) + if err != nil { + return nil, "", err + } + if err = sessionModel.CheckIsActive(); err != nil { + return nil, "", err + } + + cmd, err := c.newOIDCSessionAddEvents(ctx, sessionModel.UserResourceOwner) + if err != nil { + return nil, "", err + } + if authReqModel.ResponseType == domain.OIDCResponseTypeCode { + if err = cmd.SetAuthRequestCodeExchanged(ctx, authReqModel); err != nil { + return nil, "", err + } + } + if err = complianceCheck(ctx, authReqModel); err != nil { + return nil, "", err + } + + cmd.AddSession(ctx, + sessionModel.UserID, + sessionModel.UserResourceOwner, + sessionModel.AggregateID, + authReqModel.ClientID, + authReqModel.Audience, + authReqModel.Scope, + authReqModel.AuthMethods, + authReqModel.AuthTime, + authReqModel.Nonce, + sessionModel.PreferredLanguage, + sessionModel.UserAgent, + ) + + if authReqModel.ResponseType != domain.OIDCResponseTypeIDToken { + if err = cmd.AddAccessToken(ctx, authReqModel.Scope, sessionModel.UserID, sessionModel.UserResourceOwner, domain.TokenReasonAuthRequest, nil); err != nil { + return nil, "", err + } + } + if authReqModel.NeedRefreshToken && needRefreshToken { + if err = cmd.AddRefreshToken(ctx, sessionModel.UserID); err != nil { + return nil, "", err + } + } + cmd.SetAuthRequestSuccessful(ctx, authReqModel.aggregate) + session, err = cmd.PushEvents(ctx) + return session, authReqModel.State, err +} + +func (c *Commands) CreateOIDCSession(ctx context.Context, + userID, + resourceOwner, + clientID string, + scope, + audience []string, + authMethods []domain.UserAuthMethodType, + authTime time.Time, + nonce string, + preferredLanguage *language.Tag, + userAgent *domain.UserAgent, + reason domain.TokenReason, + actor *domain.TokenActor, + needRefreshToken bool, +) (session *OIDCSession, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + cmd, err := c.newOIDCSessionAddEvents(ctx, resourceOwner) + if err != nil { + return nil, err + } + if reason == domain.TokenReasonImpersonation { + if err := c.checkPermission(ctx, "impersonation", resourceOwner, userID); err != nil { + return nil, err + } + cmd.UserImpersonated(ctx, userID, resourceOwner, clientID, actor) + } + + cmd.AddSession(ctx, userID, resourceOwner, "", clientID, audience, scope, authMethods, authTime, nonce, preferredLanguage, userAgent) + if err = cmd.AddAccessToken(ctx, scope, userID, resourceOwner, reason, actor); err != nil { + return nil, err + } + if needRefreshToken { + if err = cmd.AddRefreshToken(ctx, userID); err != nil { + return nil, err + } } - cmd.SetAuthRequestSuccessful(ctx) return cmd.PushEvents(ctx) } +type RefreshTokenComplianceChecker func(ctx context.Context, wm *OIDCSessionWriteModel, requestedScope []string) (scope []string, err error) + // ExchangeOIDCSessionRefreshAndAccessToken updates an existing OIDC Session, creates a new access and refresh token. // It returns the access token id and expiration and the new refresh token. -func (c *Commands) ExchangeOIDCSessionRefreshAndAccessToken(ctx context.Context, oidcSessionID, refreshToken string, scope []string) (tokenID, newRefreshToken string, tokenExpiration time.Time, err error) { - cmd, err := c.newOIDCSessionUpdateEvents(ctx, oidcSessionID, refreshToken) +func (c *Commands) ExchangeOIDCSessionRefreshAndAccessToken(ctx context.Context, refreshToken string, scope []string, complianceCheck RefreshTokenComplianceChecker) (_ *OIDCSession, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + cmd, err := c.newOIDCSessionUpdateEvents(ctx, refreshToken) if err != nil { - return "", "", time.Time{}, err + return nil, err } - if err = cmd.AddAccessToken(ctx, scope, domain.TokenReasonRefresh, nil); err != nil { - return "", "", time.Time{}, err + scope, err = complianceCheck(ctx, cmd.oidcSessionWriteModel, scope) + if err != nil { + return nil, err + } + err = cmd.AddAccessToken(ctx, scope, + cmd.oidcSessionWriteModel.UserID, + cmd.oidcSessionWriteModel.UserResourceOwner, + domain.TokenReasonRefresh, + cmd.oidcSessionWriteModel.AccessTokenActor, + ) + if err != nil { + return nil, err } if err = cmd.RenewRefreshToken(ctx); err != nil { - return "", "", time.Time{}, err + return nil, err } return cmd.PushEvents(ctx) } // OIDCSessionByRefreshToken computes the current state of an existing OIDCSession by a refresh_token (to start a Refresh Token Grant). // If either the session is not active, the token is invalid or expired (incl. idle expiration) an invalid refresh token error will be returned. -func (c *Commands) OIDCSessionByRefreshToken(ctx context.Context, refreshToken string) (*OIDCSessionWriteModel, error) { +func (c *Commands) OIDCSessionByRefreshToken(ctx context.Context, refreshToken string) (_ *OIDCSessionWriteModel, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + oidcSessionID, refreshTokenID, err := parseRefreshToken(refreshToken) if err != nil { return nil, err @@ -146,26 +264,7 @@ func (c *Commands) RevokeOIDCSessionToken(ctx context.Context, token, clientID s return c.pushAppendAndReduce(ctx, writeModel, oidcsession.NewAccessTokenRevokedEvent(ctx, writeModel.aggregate)) } -func (c *Commands) newOIDCSessionAddEvents(ctx context.Context, authRequestID string) (*OIDCSessionEvents, error) { - authRequestWriteModel, err := c.getAuthRequestWriteModel(ctx, authRequestID) - if err != nil { - return nil, err - } - if err = authRequestWriteModel.CheckAuthenticated(); err != nil { - return nil, err - } - sessionWriteModel := NewSessionWriteModel(authRequestWriteModel.SessionID, authz.GetInstance(ctx).InstanceID()) - err = c.eventstore.FilterToQueryReducer(ctx, sessionWriteModel) - if err != nil { - return nil, err - } - if err = sessionWriteModel.CheckIsActive(); err != nil { - return nil, err - } - resourceOwner, err := c.getResourceOwnerOfSessionUser(ctx, sessionWriteModel.UserID, sessionWriteModel.InstanceID) - if err != nil { - return nil, err - } +func (c *Commands) newOIDCSessionAddEvents(ctx context.Context, resourceOwner string, pending ...eventstore.Command) (*OIDCSessionEvents, error) { accessTokenLifetime, refreshTokenLifeTime, refreshTokenIdleLifetime, err := c.tokenTokenLifetimes(ctx) if err != nil { return nil, err @@ -179,42 +278,24 @@ func (c *Commands) newOIDCSessionAddEvents(ctx context.Context, authRequestID st eventstore: c.eventstore, idGenerator: c.idGenerator, encryptionAlg: c.keyAlgorithm, + events: pending, oidcSessionWriteModel: NewOIDCSessionWriteModel(sessionID, resourceOwner), - sessionWriteModel: sessionWriteModel, - authRequestWriteModel: authRequestWriteModel, accessTokenLifetime: accessTokenLifetime, refreshTokenLifeTime: refreshTokenLifeTime, refreshTokenIdleLifetime: refreshTokenIdleLifetime, }, nil } -func (c *Commands) getResourceOwnerOfSessionUser(ctx context.Context, userID, instanceID string) (string, error) { - events, err := c.eventstore.Filter(ctx, eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent). - InstanceID(instanceID). - AllowTimeTravel(). - OrderAsc(). - Limit(1). - AddQuery(). - AggregateTypes(user.AggregateType). - AggregateIDs(userID). - Builder()) - if err != nil || len(events) != 1 { - return "", zerrors.ThrowInternal(err, "OIDCS-sferh", "Errors.Internal") - } - return events[0].Aggregate().ResourceOwner, nil -} - -func (c *Commands) decryptRefreshToken(refreshToken string) (refreshTokenID string, err error) { +func (c *Commands) decryptRefreshToken(refreshToken string) (sessionID, refreshTokenID string, err error) { decoded, err := base64.RawURLEncoding.DecodeString(refreshToken) if err != nil { - return "", zerrors.ThrowInvalidArgument(err, "OIDCS-Cux9a", "Errors.User.RefreshToken.Invalid") + return "", "", zerrors.ThrowInvalidArgument(err, "OIDCS-Cux9a", "Errors.User.RefreshToken.Invalid") } decrypted, err := c.keyAlgorithm.DecryptString(decoded, c.keyAlgorithm.EncryptionKeyID()) if err != nil { - return "", err + return "", "", err } - _, refreshTokenID, err = parseRefreshToken(decrypted) - return refreshTokenID, err + return parseRefreshToken(decrypted) } func parseRefreshToken(refreshToken string) (oidcSessionID, refreshTokenID string, err error) { @@ -227,8 +308,8 @@ func parseRefreshToken(refreshToken string) (oidcSessionID, refreshTokenID strin return split[0], strings.Split(split[1], oidcTokenSubjectDelimiter)[0], nil } -func (c *Commands) newOIDCSessionUpdateEvents(ctx context.Context, oidcSessionID, refreshToken string) (*OIDCSessionEvents, error) { - refreshTokenID, err := c.decryptRefreshToken(refreshToken) +func (c *Commands) newOIDCSessionUpdateEvents(ctx context.Context, refreshToken string) (*OIDCSessionEvents, error) { + oidcSessionID, refreshTokenID, err := c.decryptRefreshToken(refreshToken) if err != nil { return nil, err } @@ -255,13 +336,12 @@ func (c *Commands) newOIDCSessionUpdateEvents(ctx context.Context, oidcSessionID } type OIDCSessionEvents struct { - eventstore *eventstore.Eventstore - idGenerator id.Generator - encryptionAlg crypto.EncryptionAlgorithm - events []eventstore.Command - oidcSessionWriteModel *OIDCSessionWriteModel - sessionWriteModel *SessionWriteModel - authRequestWriteModel *AuthRequestWriteModel + eventstore *eventstore.Eventstore + idGenerator id.Generator + encryptionAlg crypto.EncryptionAlgorithm + events []eventstore.Command + oidcSessionWriteModel *OIDCSessionWriteModel + accessTokenLifetime time.Duration refreshTokenLifeTime time.Duration refreshTokenIdleLifetime time.Duration @@ -270,44 +350,75 @@ type OIDCSessionEvents struct { accessTokenID string // refreshToken is set by the command - refreshToken string + refreshTokenID string + refreshToken string } -func (c *OIDCSessionEvents) AddSession(ctx context.Context) { +func (c *OIDCSessionEvents) AddSession( + ctx context.Context, + userID, + userResourceOwner, + sessionID, + clientID string, + audience, + scope []string, + authMethods []domain.UserAuthMethodType, + authTime time.Time, + nonce string, + preferredLanguage *language.Tag, + userAgent *domain.UserAgent, +) { c.events = append(c.events, oidcsession.NewAddedEvent( ctx, c.oidcSessionWriteModel.aggregate, - c.sessionWriteModel.UserID, - c.sessionWriteModel.AggregateID, - c.authRequestWriteModel.ClientID, - c.authRequestWriteModel.Audience, - c.authRequestWriteModel.Scope, - c.sessionWriteModel.AuthMethodTypes(), - c.sessionWriteModel.AuthenticationTime(), + userID, + userResourceOwner, + sessionID, + clientID, + audience, + scope, + authMethods, + authTime, + nonce, + preferredLanguage, + userAgent, )) } -func (c *OIDCSessionEvents) SetAuthRequestSuccessful(ctx context.Context) { - c.events = append(c.events, authrequest.NewSucceededEvent(ctx, c.authRequestWriteModel.aggregate)) +func (c *OIDCSessionEvents) SetAuthRequestCodeExchanged(ctx context.Context, model *AuthRequestWriteModel) error { + event := authrequest.NewCodeExchangedEvent(ctx, model.aggregate) + model.AppendEvents(event) + c.events = append(c.events, event) + return model.Reduce() } -func (c *OIDCSessionEvents) AddAccessToken(ctx context.Context, scope []string, reason domain.TokenReason, actor *domain.TokenActor) error { +func (c *OIDCSessionEvents) SetAuthRequestSuccessful(ctx context.Context, authRequestAggregate *eventstore.Aggregate) { + c.events = append(c.events, authrequest.NewSucceededEvent(ctx, authRequestAggregate)) +} + +func (c *OIDCSessionEvents) SetAuthRequestFailed(ctx context.Context, authRequestAggregate *eventstore.Aggregate, err error) { + c.events = append(c.events, authrequest.NewFailedEvent(ctx, authRequestAggregate, domain.OIDCErrorReasonFromError(err))) +} + +func (c *OIDCSessionEvents) AddAccessToken(ctx context.Context, scope []string, userID, resourceOwner string, reason domain.TokenReason, actor *domain.TokenActor) error { accessTokenID, err := c.idGenerator.Next() if err != nil { return err } c.accessTokenID = AccessTokenPrefix + accessTokenID - c.events = append(c.events, oidcsession.NewAccessTokenAddedEvent(ctx, c.oidcSessionWriteModel.aggregate, c.accessTokenID, scope, c.accessTokenLifetime, reason, actor)) + c.events = append(c.events, + oidcsession.NewAccessTokenAddedEvent(ctx, c.oidcSessionWriteModel.aggregate, c.accessTokenID, scope, c.accessTokenLifetime, reason, actor), + user.NewUserTokenV2AddedEvent(ctx, &user.NewAggregate(userID, resourceOwner).Aggregate, c.accessTokenID), // for user audit log + ) return nil } -func (c *OIDCSessionEvents) AddRefreshToken(ctx context.Context) (err error) { - var refreshTokenID string - refreshTokenID, c.refreshToken, err = c.generateRefreshToken(c.sessionWriteModel.UserID) +func (c *OIDCSessionEvents) AddRefreshToken(ctx context.Context, userID string) (err error) { + c.refreshTokenID, c.refreshToken, err = c.generateRefreshToken(userID) if err != nil { return err } - c.events = append(c.events, oidcsession.NewRefreshTokenAddedEvent(ctx, c.oidcSessionWriteModel.aggregate, refreshTokenID, c.refreshTokenLifeTime, c.refreshTokenIdleLifetime)) + c.events = append(c.events, oidcsession.NewRefreshTokenAddedEvent(ctx, c.oidcSessionWriteModel.aggregate, c.refreshTokenID, c.refreshTokenLifeTime, c.refreshTokenIdleLifetime)) return nil } @@ -321,6 +432,10 @@ func (c *OIDCSessionEvents) RenewRefreshToken(ctx context.Context) (err error) { return nil } +func (c *OIDCSessionEvents) UserImpersonated(ctx context.Context, userID, resourceOwner, clientID string, actor *domain.TokenActor) { + c.events = append(c.events, user.NewUserImpersonatedEvent(ctx, &user.NewAggregate(userID, resourceOwner).Aggregate, clientID, actor)) +} + func (c *OIDCSessionEvents) generateRefreshToken(userID string) (refreshTokenID, refreshToken string, err error) { refreshTokenID, err = c.idGenerator.Next() if err != nil { @@ -334,18 +449,38 @@ func (c *OIDCSessionEvents) generateRefreshToken(userID string) (refreshTokenID, return refreshTokenID, base64.RawURLEncoding.EncodeToString(token), nil } -func (c *OIDCSessionEvents) PushEvents(ctx context.Context) (accessTokenID string, refreshToken string, accessTokenExpiration time.Time, err error) { +func (c *OIDCSessionEvents) PushEvents(ctx context.Context) (*OIDCSession, error) { pushedEvents, err := c.eventstore.Push(ctx, c.events...) if err != nil { - return "", "", time.Time{}, err + return nil, err } err = AppendAndReduce(c.oidcSessionWriteModel, pushedEvents...) if err != nil { - return "", "", time.Time{}, err + return nil, err } - // prefix the returned id with the oidcSessionID so that we can retrieve it later on - // we need to use `-` as a delimiter because the OIDC library uses `:` and will check for a length of 2 parts - return c.oidcSessionWriteModel.AggregateID + TokenDelimiter + c.accessTokenID, c.refreshToken, c.oidcSessionWriteModel.AccessTokenExpiration, nil + session := &OIDCSession{ + SessionID: c.oidcSessionWriteModel.SessionID, + ClientID: c.oidcSessionWriteModel.ClientID, + UserID: c.oidcSessionWriteModel.UserID, + Audience: c.oidcSessionWriteModel.Audience, + Expiration: c.oidcSessionWriteModel.AccessTokenExpiration, + Scope: c.oidcSessionWriteModel.Scope, + AuthMethods: c.oidcSessionWriteModel.AuthMethods, + AuthTime: c.oidcSessionWriteModel.AuthTime, + Nonce: c.oidcSessionWriteModel.Nonce, + PreferredLanguage: c.oidcSessionWriteModel.PreferredLanguage, + UserAgent: c.oidcSessionWriteModel.UserAgent, + Reason: c.oidcSessionWriteModel.AccessTokenReason, + Actor: c.oidcSessionWriteModel.AccessTokenActor, + RefreshToken: c.refreshToken, + } + if c.accessTokenID != "" { + // prefix the returned id with the oidcSessionID so that we can retrieve it later on + // we need to use `-` as a delimiter because the OIDC library uses `:` and will check for a length of 2 parts + session.TokenID = c.oidcSessionWriteModel.AggregateID + TokenDelimiter + c.accessTokenID + } + activity.Trigger(ctx, c.oidcSessionWriteModel.UserResourceOwner, c.oidcSessionWriteModel.UserID, tokenReasonToActivityMethodType(c.oidcSessionWriteModel.AccessTokenReason), c.eventstore.FilterToQueryReducer) + return session, nil } func (c *Commands) tokenTokenLifetimes(ctx context.Context) (accessTokenLifetime time.Duration, refreshTokenLifetime time.Duration, refreshTokenIdleLifetime time.Duration, err error) { @@ -368,3 +503,14 @@ func (c *Commands) tokenTokenLifetimes(ctx context.Context) (accessTokenLifetime } return accessTokenLifetime, refreshTokenLifetime, refreshTokenIdleLifetime, nil } + +func tokenReasonToActivityMethodType(r domain.TokenReason) activity.TriggerMethod { + if r == domain.TokenReasonUnspecified { + return activity.Unspecified + } + if r == domain.TokenReasonRefresh { + return activity.OIDCRefreshToken + } + // all other reasons result in an access token + return activity.OIDCAccessToken +} diff --git a/internal/command/oidc_session_model.go b/internal/command/oidc_session_model.go index a561fc4165..9468f95c48 100644 --- a/internal/command/oidc_session_model.go +++ b/internal/command/oidc_session_model.go @@ -3,6 +3,8 @@ package command import ( "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/oidcsession" @@ -13,12 +15,16 @@ type OIDCSessionWriteModel struct { eventstore.WriteModel UserID string + UserResourceOwner string + PreferredLanguage *language.Tag SessionID string ClientID string Audience []string Scope []string AuthMethods []domain.UserAuthMethodType AuthTime time.Time + Nonce string + UserAgent *domain.UserAgent State domain.OIDCSessionState AccessTokenID string AccessTokenCreation time.Time @@ -85,12 +91,16 @@ func (wm *OIDCSessionWriteModel) Query() *eventstore.SearchQueryBuilder { func (wm *OIDCSessionWriteModel) reduceAdded(e *oidcsession.AddedEvent) { wm.UserID = e.UserID + wm.UserResourceOwner = e.UserResourceOwner wm.SessionID = e.SessionID wm.ClientID = e.ClientID wm.Audience = e.Audience wm.Scope = e.Scope wm.AuthMethods = e.AuthMethods wm.AuthTime = e.AuthTime + wm.Nonce = e.Nonce + wm.PreferredLanguage = e.PreferredLanguage + wm.UserAgent = e.UserAgent wm.State = domain.OIDCSessionStateActive // the write model might be initialized without resource owner, // so update the aggregate diff --git a/internal/command/oidc_session_test.go b/internal/command/oidc_session_test.go index 6dcd96c623..bbaff1df6b 100644 --- a/internal/command/oidc_session_test.go +++ b/internal/command/oidc_session_test.go @@ -2,6 +2,7 @@ package command import ( "context" + "io" "net" "net/http" "testing" @@ -27,213 +28,18 @@ import ( ) var ( - testNow = time.Now() - tokenCreationNow = time.Time{} + testNow = time.Now() ) -func TestCommands_AddOIDCSessionAccessToken(t *testing.T) { - type fields struct { - eventstore *eventstore.Eventstore - idGenerator id.Generator - defaultAccessTokenLifetime time.Duration - defaultRefreshTokenLifetime time.Duration - defaultRefreshTokenIdleLifetime time.Duration - keyAlgorithm crypto.EncryptionAlgorithm - } - type args struct { - ctx context.Context - authRequestID string - } - type res struct { - id string - expiration time.Time - err error - } - tests := []struct { - name string - fields fields - args args - res res - }{ - { - "unauthenticated error", - fields{ - eventstore: eventstoreExpect(t, - expectFilter(), - ), - }, - args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - authRequestID: "V2_authRequestID", - }, - res{ - err: zerrors.ThrowPreconditionFailed(nil, "AUTHR-SF2r2", "Errors.AuthRequest.NotAuthenticated"), - }, - }, - { - "inactive session error", - fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher( - authrequest.NewAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, - "loginClient", - "clientID", - "redirectURI", - "state", - "nonce", - []string{"openid"}, - []string{"audience"}, - domain.OIDCResponseTypeCode, - &domain.OIDCCodeChallenge{ - Challenge: "challenge", - Method: domain.CodeChallengeMethodS256, - }, - []domain.Prompt{domain.PromptNone}, - []string{"en", "de"}, - gu.Ptr(time.Duration(0)), - gu.Ptr("loginHint"), - gu.Ptr("hintUserID"), - ), - ), - eventFromEventPusher( - authrequest.NewSessionLinkedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, - "sessionID", - "userID", - testNow, - []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - ), - ), - eventFromEventPusher( - authrequest.NewCodeAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - eventFromEventPusher( - authrequest.NewCodeExchangedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - ), - expectFilter(), // inactive session - ), - }, - args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - authRequestID: "V2_authRequestID", - }, - res{ - err: zerrors.ThrowPreconditionFailed(nil, "COMMAND-Flk38", "Errors.Session.NotExisting"), - }, - }, - { - "add successful", - fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher( - authrequest.NewAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, - "loginClient", - "clientID", - "redirectURI", - "state", - "nonce", - []string{"openid"}, - []string{"audience"}, - domain.OIDCResponseTypeCode, - &domain.OIDCCodeChallenge{ - Challenge: "challenge", - Method: domain.CodeChallengeMethodS256, - }, - []domain.Prompt{domain.PromptNone}, - []string{"en", "de"}, - gu.Ptr(time.Duration(0)), - gu.Ptr("loginHint"), - gu.Ptr("hintUserID"), - ), - ), - eventFromEventPusher( - authrequest.NewSessionLinkedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, - "sessionID", - "userID", - testNow, - []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, - ), - ), - eventFromEventPusher( - authrequest.NewCodeAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - eventFromEventPusher( - authrequest.NewCodeExchangedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - ), - expectFilter( - eventFromEventPusher( - session.NewAddedEvent(context.Background(), - &session.NewAggregate("sessionID", "instance1").Aggregate, - &domain.UserAgent{ - FingerprintID: gu.Ptr("fp1"), - IP: net.ParseIP("1.2.3.4"), - Description: gu.Ptr("firefox"), - Header: http.Header{"foo": []string{"bar"}}, - }, - ), - ), - eventFromEventPusher( - session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instanceID").Aggregate, - "userID", "org1", testNow), - ), - eventFromEventPusher( - session.NewPasswordCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instanceID").Aggregate, - testNow), - ), - ), - expectFilter( - eventFromEventPusher( - user.NewHumanAddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, - "username", "firstName", "lastName", "", "", language.English, domain.GenderUnspecified, "", false, - ), - ), - ), - expectFilter(), // token lifetime - expectPush( - oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"audience"}, []string{"openid"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), - oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "at_accessTokenID", []string{"openid"}, time.Hour, domain.TokenReasonAuthRequest, nil), - authrequest.NewSucceededEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - ), - idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"), - defaultAccessTokenLifetime: time.Hour, - }, - args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - authRequestID: "V2_authRequestID", - }, - res{ - id: "V2_oidcSessionID-at_accessTokenID", - expiration: tokenCreationNow.Add(time.Hour), - }, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - c := &Commands{ - eventstore: tt.fields.eventstore, - idGenerator: tt.fields.idGenerator, - defaultAccessTokenLifetime: tt.fields.defaultAccessTokenLifetime, - defaultRefreshTokenLifetime: tt.fields.defaultRefreshTokenLifetime, - defaultRefreshTokenIdleLifetime: tt.fields.defaultRefreshTokenIdleLifetime, - keyAlgorithm: tt.fields.keyAlgorithm, - } - gotID, gotExpiration, err := c.AddOIDCSessionAccessToken(tt.args.ctx, tt.args.authRequestID) - assert.Equal(t, tt.res.id, gotID) - assert.Equal(t, tt.res.expiration, gotExpiration) - assert.ErrorIs(t, err, tt.res.err) - }) +func mockAuthRequestComplianceChecker(returnErr error) AuthRequestComplianceChecker { + return func(context.Context, *AuthRequestWriteModel) error { + return returnErr } } -func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { +func TestCommands_CreateOIDCSessionFromAuthRequest(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator defaultAccessTokenLifetime time.Duration defaultRefreshTokenLifetime time.Duration @@ -241,14 +47,15 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { keyAlgorithm crypto.EncryptionAlgorithm } type args struct { - ctx context.Context - authRequestID string + ctx context.Context + authRequestID string + complianceCheck AuthRequestComplianceChecker + needRefreshToken bool } type res struct { - id string - refreshToken string - expiration time.Time - err error + session *OIDCSession + state string + err error } tests := []struct { name string @@ -257,24 +64,55 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { res res }{ { - "unauthenticated error", + "missing code", fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore(), + }, + args{ + ctx: context.Background(), + authRequestID: "", + complianceCheck: mockAuthRequestComplianceChecker(nil), + }, + res{ + err: zerrors.ThrowPreconditionFailed(nil, "COMMAND-Sf3g2", "Errors.AuthRequest.InvalidCode"), + }, + }, + { + "filter error", + fields{ + eventstore: expectEventstore( + expectFilterError(io.ErrClosedPipe), + ), + }, + args{ + ctx: context.Background(), + authRequestID: "V2_authRequestID", + complianceCheck: mockAuthRequestComplianceChecker(nil), + }, + res{ + err: io.ErrClosedPipe, + }, + }, + { + "code not found", + fields{ + eventstore: expectEventstore( expectFilter(), ), }, args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - authRequestID: "V2_authRequestID", + ctx: context.Background(), + authRequestID: "V2_authRequestID", + complianceCheck: mockAuthRequestComplianceChecker(nil), }, res{ - err: zerrors.ThrowPreconditionFailed(nil, "AUTHR-SF2r2", "Errors.AuthRequest.NotAuthenticated"), + err: zerrors.ThrowPreconditionFailed(nil, "COMMAND-Iung5", "Errors.AuthRequest.NoCode"), }, }, { - "inactive session error", + "session filter error", fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( authrequest.NewAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, @@ -295,8 +133,55 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { gu.Ptr(time.Duration(0)), gu.Ptr("loginHint"), gu.Ptr("hintUserID"), + true, ), ), + eventFromEventPusher( + authrequest.NewCodeAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), + ), + ), + expectFilterError(io.ErrClosedPipe), + ), + }, + args{ + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + authRequestID: "V2_authRequestID", + complianceCheck: mockAuthRequestComplianceChecker(nil), + }, + res{ + err: io.ErrClosedPipe, + }, + }, + { + "inactive session error", + fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + authrequest.NewAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, + "loginClient", + "clientID", + "redirectURI", + "state", + "nonce", + []string{"openid", "offline_access"}, + []string{"audience"}, + domain.OIDCResponseTypeCode, + &domain.OIDCCodeChallenge{ + Challenge: "challenge", + Method: domain.CodeChallengeMethodS256, + }, + []domain.Prompt{domain.PromptNone}, + []string{"en", "de"}, + gu.Ptr(time.Duration(0)), + gu.Ptr("loginHint"), + gu.Ptr("hintUserID"), + true, + ), + ), + eventFromEventPusher( + authrequest.NewCodeAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), + ), eventFromEventPusher( authrequest.NewSessionLinkedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, "sessionID", @@ -305,19 +190,14 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, ), ), - eventFromEventPusher( - authrequest.NewCodeAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - eventFromEventPusher( - authrequest.NewCodeExchangedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), ), expectFilter(), // inactive session ), }, args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - authRequestID: "V2_authRequestID", + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + authRequestID: "V2_authRequestID", + complianceCheck: mockAuthRequestComplianceChecker(nil), }, res{ err: zerrors.ThrowPreconditionFailed(nil, "COMMAND-Flk38", "Errors.Session.NotExisting"), @@ -326,7 +206,7 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { { "add successful", fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( authrequest.NewAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, @@ -347,8 +227,12 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { gu.Ptr(time.Duration(0)), gu.Ptr("loginHint"), gu.Ptr("hintUserID"), + true, ), ), + eventFromEventPusher( + authrequest.NewCodeAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), + ), eventFromEventPusher( authrequest.NewSessionLinkedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, "sessionID", @@ -357,12 +241,6 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, ), ), - eventFromEventPusher( - authrequest.NewCodeAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), - eventFromEventPusher( - authrequest.NewCodeExchangedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), - ), ), expectFilter( eventFromEventPusher( @@ -378,26 +256,29 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { ), eventFromEventPusher( session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instanceID").Aggregate, - "userID", "org1", testNow), + "userID", "org1", testNow, &language.Afrikaans), ), eventFromEventPusher( session.NewPasswordCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instanceID").Aggregate, testNow), ), ), - expectFilter( - eventFromEventPusher( - user.NewHumanAddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, - "username", "firstName", "lastName", "", "", language.English, domain.GenderUnspecified, "", false, - ), - ), - ), expectFilter(), // token lifetime expectPush( + authrequest.NewCodeExchangedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"audience"}, []string{"openid", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, "at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, nil), + user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"), oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, "rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour), authrequest.NewSucceededEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), @@ -410,35 +291,574 @@ func TestCommands_AddOIDCSessionRefreshAndAccessToken(t *testing.T) { keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), }, args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - authRequestID: "V2_authRequestID", + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + authRequestID: "V2_authRequestID", + complianceCheck: mockAuthRequestComplianceChecker(nil), + needRefreshToken: true, }, res{ - id: "V2_oidcSessionID-at_accessTokenID", - refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID-rt_refreshTokenID:userID - expiration: tokenCreationNow.Add(time.Hour), + session: &OIDCSession{ + SessionID: "sessionID", + TokenID: "V2_oidcSessionID-at_accessTokenID", + ClientID: "clientID", + UserID: "userID", + Audience: []string{"audience"}, + Expiration: time.Time{}.Add(time.Hour), + Scope: []string{"openid", "offline_access"}, + AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + AuthTime: testNow, + Nonce: "nonce", + PreferredLanguage: &language.Afrikaans, + UserAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + Reason: domain.TokenReasonAuthRequest, + RefreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID-rt_refreshTokenID:userID + }, + state: "state", + }, + }, + { + "without ID token only (implicit)", + fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + authrequest.NewAddedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, + "loginClient", + "clientID", + "redirectURI", + "state", + "nonce", + []string{"openid"}, + []string{"audience"}, + domain.OIDCResponseTypeIDToken, + &domain.OIDCCodeChallenge{ + Challenge: "challenge", + Method: domain.CodeChallengeMethodS256, + }, + []domain.Prompt{domain.PromptNone}, + []string{"en", "de"}, + gu.Ptr(time.Duration(0)), + gu.Ptr("loginHint"), + gu.Ptr("hintUserID"), + false, + ), + ), + eventFromEventPusher( + authrequest.NewSessionLinkedEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate, + "sessionID", + "userID", + testNow, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + ), + ), + ), + expectFilter( + eventFromEventPusher( + session.NewAddedEvent(context.Background(), + &session.NewAggregate("sessionID", "instance1").Aggregate, + &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + ), + eventFromEventPusher( + session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instanceID").Aggregate, + "userID", "org1", testNow, &language.Afrikaans), + ), + eventFromEventPusher( + session.NewPasswordCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instanceID").Aggregate, + testNow), + ), + ), + expectFilter(), // token lifetime + expectPush( + oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + authrequest.NewSucceededEvent(context.Background(), &authrequest.NewAggregate("V2_authRequestID", "instanceID").Aggregate), + ), + ), + idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID"), + defaultAccessTokenLifetime: time.Hour, + defaultRefreshTokenLifetime: 7 * 24 * time.Hour, + defaultRefreshTokenIdleLifetime: 24 * time.Hour, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + args{ + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + authRequestID: "V2_authRequestID", + complianceCheck: mockAuthRequestComplianceChecker(nil), + }, + res{ + session: &OIDCSession{ + SessionID: "sessionID", + ClientID: "clientID", + UserID: "userID", + Audience: []string{"audience"}, + Scope: []string{"openid"}, + AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + AuthTime: testNow, + Nonce: "nonce", + PreferredLanguage: &language.Afrikaans, + UserAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + }, + state: "state", }, }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, defaultAccessTokenLifetime: tt.fields.defaultAccessTokenLifetime, defaultRefreshTokenLifetime: tt.fields.defaultRefreshTokenLifetime, defaultRefreshTokenIdleLifetime: tt.fields.defaultRefreshTokenIdleLifetime, keyAlgorithm: tt.fields.keyAlgorithm, } - gotID, gotRefreshToken, gotExpiration, err := c.AddOIDCSessionRefreshAndAccessToken(tt.args.ctx, tt.args.authRequestID) - assert.Equal(t, tt.res.id, gotID) - assert.Equal(t, tt.res.refreshToken, gotRefreshToken) - assert.Equal(t, tt.res.expiration, gotExpiration) - assert.ErrorIs(t, err, tt.res.err) + gotSession, gotState, err := c.CreateOIDCSessionFromAuthRequest(tt.args.ctx, tt.args.authRequestID, tt.args.complianceCheck, tt.args.needRefreshToken) + require.ErrorIs(t, err, tt.res.err) + + if gotSession != nil { + assert.WithinRange(t, gotSession.AuthTime, tt.res.session.AuthTime.Add(-time.Second), tt.res.session.AuthTime.Add(time.Second)) + gotSession.AuthTime = time.Time{} + tt.res.session.AuthTime = time.Time{} + } + assert.Equal(t, tt.res.session, gotSession) + assert.Equal(t, tt.res.state, gotState) }) } } +func TestCommands_CreateOIDCSession(t *testing.T) { + type fields struct { + eventstore func(*testing.T) *eventstore.Eventstore + idGenerator id.Generator + defaultAccessTokenLifetime time.Duration + defaultRefreshTokenLifetime time.Duration + defaultRefreshTokenIdleLifetime time.Duration + keyAlgorithm crypto.EncryptionAlgorithm + checkPermission domain.PermissionCheck + } + type args struct { + ctx context.Context + userID string + resourceOwner string + clientID string + audience []string + scope []string + authMethods []domain.UserAuthMethodType + authTime time.Time + nonce string + preferredLanguage *language.Tag + userAgent *domain.UserAgent + reason domain.TokenReason + actor *domain.TokenActor + needRefreshToken bool + } + tests := []struct { + name string + fields fields + args args + want *OIDCSession + wantErr error + }{ + { + name: "filter error", + fields: fields{ + eventstore: expectEventstore( + expectFilterError(io.ErrClosedPipe), + ), + }, + args: args{ + ctx: context.Background(), + userID: "userID", + resourceOwner: "orgID", + clientID: "clientID", + audience: []string{"audience"}, + scope: []string{"openid", "offline_access"}, + authMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + authTime: testNow, + nonce: "nonce", + preferredLanguage: &language.Afrikaans, + userAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + reason: domain.TokenReasonAuthRequest, + actor: &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + needRefreshToken: false, + }, + wantErr: io.ErrClosedPipe, + }, + { + name: "without refresh token", + fields: fields{ + eventstore: expectEventstore( + expectFilter(), // token lifetime + expectPush( + oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "userID", "org1", "", "clientID", []string{"audience"}, []string{"openid", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + oidcsession.NewAccessTokenAddedEvent(context.Background(), + &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, + &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + ), + user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"), + ), + ), + idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"), + defaultAccessTokenLifetime: time.Hour, + defaultRefreshTokenLifetime: 7 * 24 * time.Hour, + defaultRefreshTokenIdleLifetime: 24 * time.Hour, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + args: args{ + ctx: context.Background(), + userID: "userID", + resourceOwner: "org1", + clientID: "clientID", + audience: []string{"audience"}, + scope: []string{"openid", "offline_access"}, + authMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + authTime: testNow, + nonce: "nonce", + preferredLanguage: &language.Afrikaans, + userAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + reason: domain.TokenReasonAuthRequest, + actor: &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + needRefreshToken: false, + }, + want: &OIDCSession{ + TokenID: "V2_oidcSessionID-at_accessTokenID", + ClientID: "clientID", + UserID: "userID", + Audience: []string{"audience"}, + Expiration: time.Time{}.Add(time.Hour), + Scope: []string{"openid", "offline_access"}, + AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + AuthTime: testNow, + Nonce: "nonce", + PreferredLanguage: &language.Afrikaans, + UserAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + Reason: domain.TokenReasonAuthRequest, + Actor: &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + }, + }, + { + name: "with refresh token", + fields: fields{ + eventstore: expectEventstore( + expectFilter(), // token lifetime + expectPush( + oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "userID", "org1", "", "clientID", []string{"audience"}, []string{"openid", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + oidcsession.NewAccessTokenAddedEvent(context.Background(), + &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonAuthRequest, + &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }), + user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"), + oidcsession.NewRefreshTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "rt_refreshTokenID", 7*24*time.Hour, 24*time.Hour), + ), + ), + idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID", "refreshTokenID"), + defaultAccessTokenLifetime: time.Hour, + defaultRefreshTokenLifetime: 7 * 24 * time.Hour, + defaultRefreshTokenIdleLifetime: 24 * time.Hour, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + args: args{ + ctx: context.Background(), + userID: "userID", + resourceOwner: "org1", + clientID: "clientID", + audience: []string{"audience"}, + scope: []string{"openid", "offline_access"}, + authMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + authTime: testNow, + nonce: "nonce", + preferredLanguage: &language.Afrikaans, + userAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + reason: domain.TokenReasonAuthRequest, + actor: &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + needRefreshToken: true, + }, + want: &OIDCSession{ + TokenID: "V2_oidcSessionID-at_accessTokenID", + ClientID: "clientID", + UserID: "userID", + Audience: []string{"audience"}, + Expiration: time.Time{}.Add(time.Hour), + Scope: []string{"openid", "offline_access"}, + AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + AuthTime: testNow, + Nonce: "nonce", + PreferredLanguage: &language.Afrikaans, + UserAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + Reason: domain.TokenReasonAuthRequest, + Actor: &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + RefreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID-rt_refreshTokenID:userID + }, + }, + { + name: "impersonation not allowed", + fields: fields{ + eventstore: expectEventstore( + expectFilter(), // token lifetime + ), + idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID"), + defaultAccessTokenLifetime: time.Hour, + defaultRefreshTokenLifetime: 7 * 24 * time.Hour, + defaultRefreshTokenIdleLifetime: 24 * time.Hour, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + checkPermission: domain.PermissionCheck(func(_ context.Context, _, _, _ string) (err error) { + return zerrors.ThrowPermissionDenied(nil, "test", "test") + }), + }, + args: args{ + ctx: context.Background(), + userID: "userID", + resourceOwner: "org1", + clientID: "clientID", + audience: []string{"audience"}, + scope: []string{"openid", "offline_access"}, + authMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + authTime: testNow, + nonce: "nonce", + preferredLanguage: &language.Afrikaans, + userAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + reason: domain.TokenReasonImpersonation, + actor: &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + needRefreshToken: false, + }, + wantErr: zerrors.ThrowPermissionDenied(nil, "test", "test"), + }, + { + name: "impersonation allowed", + fields: fields{ + eventstore: expectEventstore( + expectFilter(), // token lifetime + expectPush( + user.NewUserImpersonatedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "clientID", &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }), + oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "userID", "org1", "", "clientID", []string{"audience"}, []string{"openid", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + ), + oidcsession.NewAccessTokenAddedEvent(context.Background(), + &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, + "at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonImpersonation, + &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + ), + user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"), + ), + ), + idGenerator: mock.NewIDGeneratorExpectIDs(t, "oidcSessionID", "accessTokenID"), + defaultAccessTokenLifetime: time.Hour, + defaultRefreshTokenLifetime: 7 * 24 * time.Hour, + defaultRefreshTokenIdleLifetime: 24 * time.Hour, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + checkPermission: domain.PermissionCheck(func(_ context.Context, _, _, _ string) (err error) { + return nil + }), + }, + args: args{ + ctx: context.Background(), + userID: "userID", + resourceOwner: "org1", + clientID: "clientID", + audience: []string{"audience"}, + scope: []string{"openid", "offline_access"}, + authMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + authTime: testNow, + nonce: "nonce", + preferredLanguage: &language.Afrikaans, + userAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + reason: domain.TokenReasonImpersonation, + actor: &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + needRefreshToken: false, + }, + want: &OIDCSession{ + TokenID: "V2_oidcSessionID-at_accessTokenID", + ClientID: "clientID", + UserID: "userID", + Audience: []string{"audience"}, + Expiration: time.Time{}.Add(time.Hour), + Scope: []string{"openid", "offline_access"}, + AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + AuthTime: testNow, + Nonce: "nonce", + PreferredLanguage: &language.Afrikaans, + UserAgent: &domain.UserAgent{ + FingerprintID: gu.Ptr("fp1"), + IP: net.ParseIP("1.2.3.4"), + Description: gu.Ptr("firefox"), + Header: http.Header{"foo": []string{"bar"}}, + }, + Reason: domain.TokenReasonImpersonation, + Actor: &domain.TokenActor{ + UserID: "user2", + Issuer: "foo.com", + }, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + c := &Commands{ + eventstore: tt.fields.eventstore(t), + idGenerator: tt.fields.idGenerator, + defaultAccessTokenLifetime: tt.fields.defaultAccessTokenLifetime, + defaultRefreshTokenLifetime: tt.fields.defaultRefreshTokenLifetime, + defaultRefreshTokenIdleLifetime: tt.fields.defaultRefreshTokenIdleLifetime, + keyAlgorithm: tt.fields.keyAlgorithm, + checkPermission: tt.fields.checkPermission, + } + got, err := c.CreateOIDCSession(tt.args.ctx, + tt.args.userID, + tt.args.resourceOwner, + tt.args.clientID, + tt.args.scope, + tt.args.audience, + tt.args.authMethods, + tt.args.authTime, + tt.args.nonce, + tt.args.preferredLanguage, + tt.args.userAgent, + tt.args.reason, + tt.args.actor, + tt.args.needRefreshToken, + ) + require.ErrorIs(t, err, tt.wantErr) + if got != nil { + assert.WithinRange(t, got.AuthTime, tt.want.AuthTime.Add(-time.Second), tt.want.AuthTime.Add(time.Second)) + got.AuthTime = time.Time{} + tt.want.AuthTime = time.Time{} + } + assert.Equal(t, tt.want, got) + }) + } +} + +func mockRefreshTokenComplianceChecker(returnErr error) RefreshTokenComplianceChecker { + return func(_ context.Context, wm *OIDCSessionWriteModel, scope []string) ([]string, error) { + if returnErr != nil { + return nil, returnErr + } + if len(scope) > 0 { + return scope, nil + } + return wm.Scope, nil + } +} + func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { type fields struct { eventstore func(*testing.T) *eventstore.Eventstore @@ -449,16 +869,14 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { keyAlgorithm crypto.EncryptionAlgorithm } type args struct { - ctx context.Context - oidcSessionID string - refreshToken string - scope []string + ctx context.Context + refreshToken string + scope []string + complianceCheck RefreshTokenComplianceChecker } type res struct { - id string - refreshToken string - expiration time.Time - err error + session *OIDCSession + err error } tests := []struct { name string @@ -473,9 +891,9 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), }, args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - oidcSessionID: "V2_oidcSessionID", - refreshToken: "aW52YWxpZA", // invalid + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + refreshToken: "aW52YWxpZA", // invalid + complianceCheck: mockRefreshTokenComplianceChecker(nil), }, res{ err: zerrors.ThrowPreconditionFailed(nil, "OIDCS-JOI23", "Errors.OIDCSession.RefreshTokenInvalid"), @@ -490,9 +908,9 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), }, args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - oidcSessionID: "V2_oidcSessionID", - refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID:rt_refreshTokenID:userID + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID:rt_refreshTokenID:userID + complianceCheck: mockRefreshTokenComplianceChecker(nil), }, res{ err: zerrors.ThrowPreconditionFailed(nil, "OIDCS-s3hjk", "Errors.OIDCSession.RefreshTokenInvalid"), @@ -505,7 +923,10 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), eventFromEventPusher( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, @@ -516,9 +937,9 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), }, args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - oidcSessionID: "V2_oidcSessionID", - refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID:rt_refreshTokenID:userID + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID:rt_refreshTokenID:userID + complianceCheck: mockRefreshTokenComplianceChecker(nil), }, res{ err: zerrors.ThrowPreconditionFailed(nil, "OIDCS-28ubl", "Errors.OIDCSession.RefreshTokenInvalid"), @@ -531,7 +952,10 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), eventFromEventPusher( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, @@ -546,9 +970,9 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), }, args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - oidcSessionID: "V2_oidcSessionID", - refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID:rt_refreshTokenID:userID + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID:rt_refreshTokenID:userID + complianceCheck: mockRefreshTokenComplianceChecker(nil), }, res{ err: zerrors.ThrowPreconditionFailed(nil, "OIDCS-3jt2w", "Errors.OIDCSession.RefreshTokenInvalid"), @@ -561,7 +985,10 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { expectFilter( eventFromEventPusherWithCreationDateNow( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), eventFromEventPusherWithCreationDateNow( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, @@ -576,6 +1003,7 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { expectPush( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, "at_accessTokenID", []string{"openid", "offline_access"}, time.Hour, domain.TokenReasonRefresh, nil), + user.NewUserTokenV2AddedEvent(context.Background(), &user.NewAggregate("userID", "org1").Aggregate, "at_accessTokenID"), oidcsession.NewRefreshTokenRenewedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, "rt_refreshTokenID2", 24*time.Hour), ), @@ -587,15 +1015,28 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), }, args{ - ctx: authz.WithInstanceID(context.Background(), "instanceID"), - oidcSessionID: "V2_oidcSessionID", - refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID:rt_refreshTokenID:userID - scope: []string{"openid", "offline_access"}, + ctx: authz.WithInstanceID(context.Background(), "instanceID"), + refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDp1c2VySUQ", //V2_oidcSessionID:rt_refreshTokenID:userID + scope: []string{"openid", "offline_access"}, + complianceCheck: mockRefreshTokenComplianceChecker(nil), }, res{ - id: "V2_oidcSessionID-at_accessTokenID", - refreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDI6dXNlcklE", // V2_oidcSessionID-rt_refreshTokenID2:userID% - expiration: time.Time{}.Add(time.Hour), + session: &OIDCSession{ + SessionID: "sessionID", + TokenID: "V2_oidcSessionID-at_accessTokenID", + ClientID: "clientID", + UserID: "userID", + Audience: []string{"audience"}, + RefreshToken: "VjJfb2lkY1Nlc3Npb25JRC1ydF9yZWZyZXNoVG9rZW5JRDI6dXNlcklE", // V2_oidcSessionID-rt_refreshTokenID2:userID% + Expiration: time.Time{}.Add(time.Hour), + Scope: []string{"openid", "profile", "offline_access"}, + AuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, + AuthTime: testNow, + Nonce: "nonce", + PreferredLanguage: &language.Afrikaans, + UserAgent: &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + Reason: domain.TokenReasonRefresh, + }, }, }, } @@ -609,11 +1050,14 @@ func TestCommands_ExchangeOIDCSessionRefreshAndAccessToken(t *testing.T) { defaultRefreshTokenIdleLifetime: tt.fields.defaultRefreshTokenIdleLifetime, keyAlgorithm: tt.fields.keyAlgorithm, } - gotID, gotRefreshToken, gotExpiration, err := c.ExchangeOIDCSessionRefreshAndAccessToken(tt.args.ctx, tt.args.oidcSessionID, tt.args.refreshToken, tt.args.scope) - assert.Equal(t, tt.res.id, gotID) - assert.Equal(t, tt.res.refreshToken, gotRefreshToken) - assert.Equal(t, tt.res.expiration, gotExpiration) - assert.ErrorIs(t, err, tt.res.err) + got, err := c.ExchangeOIDCSessionRefreshAndAccessToken(tt.args.ctx, tt.args.refreshToken, tt.args.scope, tt.args.complianceCheck) + require.ErrorIs(t, err, tt.res.err) + if got != nil { + assert.WithinRange(t, got.AuthTime, tt.res.session.AuthTime.Add(-time.Second), tt.res.session.AuthTime.Add(time.Second)) + got.AuthTime = time.Time{} + tt.res.session.AuthTime = time.Time{} + } + assert.Equal(t, tt.res.session, got) }) } } @@ -678,7 +1122,10 @@ func TestCommands_OIDCSessionByRefreshToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), eventFromEventPusher( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, @@ -703,7 +1150,10 @@ func TestCommands_OIDCSessionByRefreshToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), eventFromEventPusher( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, @@ -732,7 +1182,10 @@ func TestCommands_OIDCSessionByRefreshToken(t *testing.T) { expectFilter( eventFromEventPusherWithCreationDateNow( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"audience"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), eventFromEventPusherWithCreationDateNow( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, @@ -844,7 +1297,10 @@ func TestCommands_RevokeOIDCSessionToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"clientID"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"clientID"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), ), ), @@ -866,7 +1322,10 @@ func TestCommands_RevokeOIDCSessionToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "otherClientID", []string{"otherClientID"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "otherClientID", []string{"otherClientID"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), ), ), @@ -888,7 +1347,10 @@ func TestCommands_RevokeOIDCSessionToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"clientID"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"clientID"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), eventFromEventPusherWithCreationDateNow( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, @@ -921,7 +1383,10 @@ func TestCommands_RevokeOIDCSessionToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"clientID"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"clientID"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), ), ), @@ -943,7 +1408,10 @@ func TestCommands_RevokeOIDCSessionToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "otherClientID", []string{"otherClientID"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "otherClientID", []string{"otherClientID"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), ), ), @@ -965,7 +1433,10 @@ func TestCommands_RevokeOIDCSessionToken(t *testing.T) { expectFilter( eventFromEventPusher( oidcsession.NewAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, - "userID", "sessionID", "clientID", []string{"clientID"}, []string{"openid", "profile", "offline_access"}, []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow), + "userID", "org1", "sessionID", "clientID", []string{"clientID"}, []string{"openid", "profile", "offline_access"}, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, testNow, "nonce", &language.Afrikaans, + &domain.UserAgent{FingerprintID: gu.Ptr("browserFP")}, + ), ), eventFromEventPusherWithCreationDateNow( oidcsession.NewAccessTokenAddedEvent(context.Background(), &oidcsession.NewAggregate("V2_oidcSessionID", "org1").Aggregate, diff --git a/internal/command/session.go b/internal/command/session.go index f7e0f889cd..843d2be391 100644 --- a/internal/command/session.go +++ b/internal/command/session.go @@ -7,6 +7,8 @@ import ( "fmt" "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/activity" "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/crypto" @@ -56,12 +58,12 @@ func (c *Commands) NewSessionCommands(cmds []SessionCommand, session *SessionWri } // CheckUser defines a user check to be executed for a session update -func CheckUser(id string, resourceOwner string) SessionCommand { +func CheckUser(id string, resourceOwner string, preferredLanguage *language.Tag) SessionCommand { return func(ctx context.Context, cmd *SessionCommands) error { if cmd.sessionWriteModel.UserID != "" && id != "" && cmd.sessionWriteModel.UserID != id { return zerrors.ThrowInvalidArgument(nil, "", "user change not possible") } - return cmd.UserChecked(ctx, id, resourceOwner, cmd.now()) + return cmd.UserChecked(ctx, id, resourceOwner, cmd.now(), preferredLanguage) } } @@ -171,8 +173,8 @@ func (s *SessionCommands) Start(ctx context.Context, userAgent *domain.UserAgent s.eventCommands = append(s.eventCommands, session.NewAddedEvent(ctx, s.sessionWriteModel.aggregate, userAgent)) } -func (s *SessionCommands) UserChecked(ctx context.Context, userID, resourceOwner string, checkedAt time.Time) error { - s.eventCommands = append(s.eventCommands, session.NewUserCheckedEvent(ctx, s.sessionWriteModel.aggregate, userID, resourceOwner, checkedAt)) +func (s *SessionCommands) UserChecked(ctx context.Context, userID, resourceOwner string, checkedAt time.Time, preferredLanguage *language.Tag) error { + s.eventCommands = append(s.eventCommands, session.NewUserCheckedEvent(ctx, s.sessionWriteModel.aggregate, userID, resourceOwner, checkedAt, preferredLanguage)) // set the userID so other checks can use it s.sessionWriteModel.UserID = userID s.sessionWriteModel.UserResourceOwner = resourceOwner diff --git a/internal/command/session_model.go b/internal/command/session_model.go index 6076461f5a..e418a3adb3 100644 --- a/internal/command/session_model.go +++ b/internal/command/session_model.go @@ -3,6 +3,8 @@ package command import ( "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" @@ -40,6 +42,7 @@ type SessionWriteModel struct { TokenID string UserID string UserResourceOwner string + PreferredLanguage *language.Tag UserCheckedAt time.Time PasswordCheckedAt time.Time IntentCheckedAt time.Time @@ -50,6 +53,7 @@ type SessionWriteModel struct { WebAuthNUserVerified bool Metadata map[string][]byte State domain.SessionState + UserAgent *domain.UserAgent Expiration time.Time WebAuthNChallenge *WebAuthNChallengeModel @@ -137,12 +141,14 @@ func (wm *SessionWriteModel) Query() *eventstore.SearchQueryBuilder { func (wm *SessionWriteModel) reduceAdded(e *session.AddedEvent) { wm.State = domain.SessionStateActive + wm.UserAgent = e.UserAgent } func (wm *SessionWriteModel) reduceUserChecked(e *session.UserCheckedEvent) { wm.UserID = e.UserID wm.UserResourceOwner = e.UserResourceOwner wm.UserCheckedAt = e.CheckedAt + wm.PreferredLanguage = e.PreferredLanguage } func (wm *SessionWriteModel) reducePasswordChecked(e *session.PasswordCheckedEvent) { diff --git a/internal/command/session_test.go b/internal/command/session_test.go index 09d5a8a4e5..998463efea 100644 --- a/internal/command/session_test.go +++ b/internal/command/session_test.go @@ -566,7 +566,7 @@ func TestCommands_updateSession(t *testing.T) { eventstore: eventstoreExpect(t, expectPush( session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, - "userID", "org1", testNow, + "userID", "org1", testNow, &language.Afrikaans, ), session.NewPasswordCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, testNow, @@ -585,7 +585,7 @@ func TestCommands_updateSession(t *testing.T) { checks: &SessionCommands{ sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"), sessionCommands: []SessionCommand{ - CheckUser("userID", "org1"), + CheckUser("userID", "org1", &language.Afrikaans), CheckPassword("password"), }, eventstore: eventstoreExpect(t, @@ -634,7 +634,7 @@ func TestCommands_updateSession(t *testing.T) { checks: &SessionCommands{ sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"), sessionCommands: []SessionCommand{ - CheckUser("userID", "org1"), + CheckUser("userID", "org1", &language.Afrikaans), CheckIntent("intent", "aW50ZW50"), }, eventstore: eventstoreExpect(t, @@ -673,7 +673,7 @@ func TestCommands_updateSession(t *testing.T) { checks: &SessionCommands{ sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"), sessionCommands: []SessionCommand{ - CheckUser("userID", "org1"), + CheckUser("userID", "org1", &language.Afrikaans), CheckIntent("intent", "aW50ZW50"), }, eventstore: eventstoreExpect(t, @@ -723,7 +723,7 @@ func TestCommands_updateSession(t *testing.T) { checks: &SessionCommands{ sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"), sessionCommands: []SessionCommand{ - CheckUser("userID", "org1"), + CheckUser("userID", "org1", &language.Afrikaans), CheckIntent("intent2", "aW50ZW50"), }, eventstore: eventstoreExpect(t), @@ -751,7 +751,7 @@ func TestCommands_updateSession(t *testing.T) { eventstore: eventstoreExpect(t, expectPush( session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, - "userID", "org1", testNow), + "userID", "org1", testNow, &language.Afrikaans), session.NewIntentCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, testNow), session.NewMetadataSetEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, @@ -766,7 +766,7 @@ func TestCommands_updateSession(t *testing.T) { checks: &SessionCommands{ sessionWriteModel: NewSessionWriteModel("sessionID", "instance1"), sessionCommands: []SessionCommand{ - CheckUser("userID", "org1"), + CheckUser("userID", "org1", &language.Afrikaans), CheckIntent("intent", "aW50ZW50"), }, eventstore: eventstoreExpect(t, @@ -1188,7 +1188,7 @@ func TestCommands_TerminateSession(t *testing.T) { ), eventFromEventPusher( session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, - "user1", "org1", testNow), + "user1", "org1", testNow, &language.Afrikaans), ), eventFromEventPusher( session.NewTokenSetEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, @@ -1229,7 +1229,7 @@ func TestCommands_TerminateSession(t *testing.T) { ), eventFromEventPusher( session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, - "userID", "org1", testNow), + "userID", "org1", testNow, &language.Afrikaans), ), eventFromEventPusher( session.NewTokenSetEvent(context.Background(), &session.NewAggregate("sessionID", "instance1").Aggregate, @@ -1271,7 +1271,7 @@ func TestCommands_TerminateSession(t *testing.T) { ), eventFromEventPusher( session.NewUserCheckedEvent(context.Background(), &session.NewAggregate("sessionID", "org2").Aggregate, - "userID", "", testNow), + "userID", "", testNow, &language.Afrikaans), ), eventFromEventPusher( session.NewTokenSetEvent(context.Background(), &session.NewAggregate("sessionID", "org2").Aggregate, diff --git a/internal/command/user.go b/internal/command/user.go index 9253da5719..17b0913c5e 100644 --- a/internal/command/user.go +++ b/internal/command/user.go @@ -4,7 +4,6 @@ import ( "context" "fmt" "strings" - "time" "github.com/zitadel/logging" @@ -13,7 +12,6 @@ import ( "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" - "github.com/zitadel/zitadel/internal/eventstore/v1/models" "github.com/zitadel/zitadel/internal/repository/user" "github.com/zitadel/zitadel/internal/telemetry/tracing" "github.com/zitadel/zitadel/internal/zerrors" @@ -232,35 +230,6 @@ func (c *Commands) RemoveUser(ctx context.Context, userID, resourceOwner string, return writeModelToObjectDetails(&existingUser.WriteModel), nil } -func (c *Commands) AddUserToken( - ctx context.Context, - orgID, - agentID, - clientID, - userID string, - audience, - scopes, - authMethodsReferences []string, - lifetime time.Duration, - authTime time.Time, - reason domain.TokenReason, - actor *domain.TokenActor, -) (*domain.Token, error) { - if userID == "" { //do not check for empty orgID (JWT Profile requests won't provide it, so service user requests fail) - return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-Dbge4", "Errors.IDMissing") - } - userWriteModel := NewUserWriteModel(userID, orgID) - cmds, accessToken, err := c.addUserToken(ctx, userWriteModel, agentID, clientID, "", audience, scopes, authMethodsReferences, lifetime, authTime, reason, actor) - if err != nil { - return nil, err - } - _, err = c.eventstore.Push(ctx, cmds...) - if err != nil { - return nil, err - } - return accessToken, nil -} - func (c *Commands) RevokeAccessToken(ctx context.Context, userID, orgID, tokenID string) (*domain.ObjectDetails, error) { removeEvent, accessTokenWriteModel, err := c.removeAccessToken(ctx, userID, orgID, tokenID) if err != nil { @@ -277,61 +246,6 @@ func (c *Commands) RevokeAccessToken(ctx context.Context, userID, orgID, tokenID return writeModelToObjectDetails(&accessTokenWriteModel.WriteModel), nil } -func (c *Commands) addUserToken(ctx context.Context, userWriteModel *UserWriteModel, agentID, clientID, refreshTokenID string, audience, scopes, authMethodsReferences []string, lifetime time.Duration, authTime time.Time, reason domain.TokenReason, actor *domain.TokenActor) ([]eventstore.Command, *domain.Token, error) { - err := c.eventstore.FilterToQueryReducer(ctx, userWriteModel) - if err != nil { - return nil, nil, err - } - if userWriteModel.UserState != domain.UserStateActive { - return nil, nil, zerrors.ThrowNotFound(nil, "COMMAND-1d6Gg", "Errors.User.NotFound") - } - - //nolint:contextcheck - userAgg := UserAggregateFromWriteModel(&userWriteModel.WriteModel) - - var cmds []eventstore.Command - if reason == domain.TokenReasonImpersonation { - if err := c.checkPermission(ctx, "impersonation", userWriteModel.ResourceOwner, userWriteModel.AggregateID); err != nil { - return nil, nil, err - } - cmds = append(cmds, user.NewUserImpersonatedEvent(ctx, userAgg, clientID, actor)) - } - - preferredLanguage := "" - existingHuman, err := c.getHumanWriteModelByID(ctx, userWriteModel.AggregateID, userWriteModel.ResourceOwner) - if err != nil { - return nil, nil, err - } - if existingHuman != nil { - preferredLanguage = existingHuman.PreferredLanguage.String() - } - expiration := time.Now().UTC().Add(lifetime) - tokenID, err := c.idGenerator.Next() - if err != nil { - return nil, nil, err - } - - cmds = append(cmds, - user.NewUserTokenAddedEvent(ctx, userAgg, tokenID, clientID, agentID, preferredLanguage, refreshTokenID, audience, scopes, authMethodsReferences, authTime, expiration, reason, actor), - ) - - return cmds, &domain.Token{ - ObjectRoot: models.ObjectRoot{ - AggregateID: userWriteModel.AggregateID, - }, - TokenID: tokenID, - UserAgentID: agentID, - ApplicationID: clientID, - RefreshTokenID: refreshTokenID, - Audience: audience, - Scopes: scopes, - Expiration: expiration, - PreferredLanguage: preferredLanguage, - Reason: reason, - Actor: actor, - }, nil -} - func (c *Commands) removeAccessToken(ctx context.Context, userID, orgID, tokenID string) (*user.UserTokenRemovedEvent, *UserAccessTokenWriteModel, error) { if userID == "" || orgID == "" || tokenID == "" { return nil, nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-Dng42", "Errors.IDMissing") diff --git a/internal/command/user_converter.go b/internal/command/user_converter.go index 076b0bfd52..484cdc35f4 100644 --- a/internal/command/user_converter.go +++ b/internal/command/user_converter.go @@ -1,9 +1,6 @@ package command import ( - "encoding/base64" - - "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/repository/user" ) @@ -81,16 +78,6 @@ func writeModelToAddress(wm *HumanAddressWriteModel) *domain.Address { } } -func writeModelToMachine(wm *MachineWriteModel) *domain.Machine { - return &domain.Machine{ - ObjectRoot: writeModelToObjectRoot(wm.WriteModel), - Username: wm.UserName, - Name: wm.Name, - Description: wm.Description, - State: wm.UserState, - } -} - func keyWriteModelToMachineKey(wm *MachineKeyWriteModel) *domain.MachineKey { return &domain.MachineKey{ ObjectRoot: writeModelToObjectRoot(wm.WriteModel), @@ -100,18 +87,6 @@ func keyWriteModelToMachineKey(wm *MachineKeyWriteModel) *domain.MachineKey { } } -func personalTokenWriteModelToToken(wm *PersonalAccessTokenWriteModel, algorithm crypto.EncryptionAlgorithm) (*domain.Token, string, error) { - encrypted, err := algorithm.Encrypt([]byte(wm.TokenID + ":" + wm.AggregateID)) - if err != nil { - return nil, "", err - } - return &domain.Token{ - ObjectRoot: writeModelToObjectRoot(wm.WriteModel), - TokenID: wm.TokenID, - Expiration: wm.ExpirationDate, - }, base64.RawURLEncoding.EncodeToString(encrypted), nil -} - func readModelToWebAuthNTokens(readModel HumanWebAuthNTokensReadModel) []*domain.WebAuthNToken { tokens := make([]*domain.WebAuthNToken, len(readModel.GetWebAuthNTokens())) for i, token := range readModel.GetWebAuthNTokens() { diff --git a/internal/command/user_human_refresh_token.go b/internal/command/user_human_refresh_token.go index 76f5847168..2a5fb9ec05 100644 --- a/internal/command/user_human_refresh_token.go +++ b/internal/command/user_human_refresh_token.go @@ -2,7 +2,6 @@ package command import ( "context" - "time" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" @@ -10,98 +9,6 @@ import ( "github.com/zitadel/zitadel/internal/zerrors" ) -func (c *Commands) AddAccessAndRefreshToken( - ctx context.Context, - orgID, - agentID, - clientID, - userID, - refreshToken string, - audience, - scopes, - authMethodsReferences []string, - accessLifetime, - refreshIdleExpiration, - refreshExpiration time.Duration, - authTime time.Time, - reason domain.TokenReason, - actor *domain.TokenActor, -) (accessToken *domain.Token, newRefreshToken string, err error) { - if refreshToken == "" { - return c.AddNewRefreshTokenAndAccessToken(ctx, userID, orgID, agentID, clientID, audience, scopes, authMethodsReferences, refreshExpiration, accessLifetime, refreshIdleExpiration, authTime, reason, actor) - } - return c.RenewRefreshTokenAndAccessToken(ctx, userID, orgID, refreshToken, agentID, clientID, audience, scopes, refreshIdleExpiration, accessLifetime, actor) -} - -func (c *Commands) AddNewRefreshTokenAndAccessToken( - ctx context.Context, - userID, - orgID, - agentID, - clientID string, - audience, - scopes, - authMethodsReferences []string, - refreshExpiration, - accessLifetime, - refreshIdleExpiration time.Duration, - authTime time.Time, - reason domain.TokenReason, - actor *domain.TokenActor, -) (accessToken *domain.Token, newRefreshToken string, err error) { - if userID == "" || clientID == "" { - return nil, "", zerrors.ThrowInvalidArgument(nil, "COMMAND-adg4r", "Errors.IDMissing") - } - userWriteModel := NewUserWriteModel(userID, orgID) - refreshTokenID, err := c.idGenerator.Next() - if err != nil { - return nil, "", err - } - cmds, accessToken, err := c.addUserToken(ctx, userWriteModel, agentID, clientID, refreshTokenID, audience, scopes, authMethodsReferences, accessLifetime, authTime, reason, actor) - if err != nil { - return nil, "", err - } - refreshTokenEvent, newRefreshToken, err := c.addRefreshToken(ctx, accessToken, authMethodsReferences, authTime, refreshIdleExpiration, refreshExpiration, actor) - if err != nil { - return nil, "", err - } - cmds = append(cmds, refreshTokenEvent) - _, err = c.eventstore.Push(ctx, cmds...) - if err != nil { - return nil, "", err - } - return accessToken, newRefreshToken, nil -} - -func (c *Commands) RenewRefreshTokenAndAccessToken( - ctx context.Context, - userID, - orgID, - refreshToken, - agentID, - clientID string, - audience, - scopes []string, - idleExpiration, - accessLifetime time.Duration, - actor *domain.TokenActor, -) (accessToken *domain.Token, newRefreshToken string, err error) { - renewed, err := c.renewRefreshToken(ctx, userID, orgID, refreshToken, idleExpiration) - if err != nil { - return nil, "", err - } - userWriteModel := NewUserWriteModel(userID, orgID) - cmds, accessToken, err := c.addUserToken(ctx, userWriteModel, agentID, clientID, renewed.tokenID, audience, scopes, renewed.authMethodsReferences, accessLifetime, renewed.authTime, domain.TokenReasonRefresh, actor) - if err != nil { - return nil, "", err - } - _, err = c.eventstore.Push(ctx, append(cmds, renewed.event)...) - if err != nil { - return nil, "", err - } - return accessToken, renewed.token, nil -} - func (c *Commands) RevokeRefreshToken(ctx context.Context, userID, orgID, tokenID string) (*domain.ObjectDetails, error) { removeEvent, refreshTokenWriteModel, err := c.removeRefreshToken(ctx, userID, orgID, tokenID) if err != nil { @@ -134,70 +41,6 @@ func (c *Commands) RevokeRefreshTokens(ctx context.Context, userID, orgID string return err } -func (c *Commands) addRefreshToken(ctx context.Context, accessToken *domain.Token, authMethodsReferences []string, authTime time.Time, idleExpiration, expiration time.Duration, actor *domain.TokenActor) (*user.HumanRefreshTokenAddedEvent, string, error) { - refreshToken, err := domain.NewRefreshToken(accessToken.AggregateID, accessToken.RefreshTokenID, c.keyAlgorithm) - if err != nil { - return nil, "", err - } - refreshTokenWriteModel := NewHumanRefreshTokenWriteModel(accessToken.AggregateID, accessToken.ResourceOwner, accessToken.RefreshTokenID) - userAgg := UserAggregateFromWriteModel(&refreshTokenWriteModel.WriteModel) - return user.NewHumanRefreshTokenAddedEvent(ctx, userAgg, accessToken.RefreshTokenID, accessToken.ApplicationID, accessToken.UserAgentID, - accessToken.PreferredLanguage, accessToken.Audience, accessToken.Scopes, authMethodsReferences, authTime, idleExpiration, expiration, actor), - refreshToken, nil -} - -type renewedRefreshToken struct { - event *user.HumanRefreshTokenRenewedEvent - authTime time.Time - authMethodsReferences []string - tokenID string - token string -} - -func (c *Commands) renewRefreshToken(ctx context.Context, userID, orgID, refreshToken string, idleExpiration time.Duration) (*renewedRefreshToken, error) { - if refreshToken == "" { - return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-DHrr3", "Errors.IDMissing") - } - - tokenUserID, tokenID, token, err := domain.FromRefreshToken(refreshToken, c.keyAlgorithm) - if err != nil { - return nil, err - } - if tokenUserID != userID { - return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-Ht2g2", "Errors.User.RefreshToken.Invalid") - } - refreshTokenWriteModel := NewHumanRefreshTokenWriteModel(userID, orgID, tokenID) - err = c.eventstore.FilterToQueryReducer(ctx, refreshTokenWriteModel) - if err != nil { - return nil, err - } - if refreshTokenWriteModel.UserState != domain.UserStateActive { - return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-BHnhs", "Errors.User.RefreshToken.Invalid") - } - if refreshTokenWriteModel.RefreshToken != token || - refreshTokenWriteModel.IdleExpiration.Before(time.Now()) || - refreshTokenWriteModel.Expiration.Before(time.Now()) { - return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-Vr43e", "Errors.User.RefreshToken.Invalid") - } - - newToken, err := c.idGenerator.Next() - if err != nil { - return nil, err - } - newRefreshToken, err := domain.RefreshToken(userID, tokenID, newToken, c.keyAlgorithm) - if err != nil { - return nil, err - } - userAgg := UserAggregateFromWriteModel(&refreshTokenWriteModel.WriteModel) - return &renewedRefreshToken{ - event: user.NewHumanRefreshTokenRenewedEvent(ctx, userAgg, tokenID, newToken, idleExpiration), - authTime: refreshTokenWriteModel.AuthTime, - authMethodsReferences: refreshTokenWriteModel.AuthMethodsReferences, - tokenID: tokenID, - token: newRefreshToken, - }, nil -} - func (c *Commands) removeRefreshToken(ctx context.Context, userID, orgID, tokenID string) (*user.HumanRefreshTokenRemovedEvent, *HumanRefreshTokenWriteModel, error) { if userID == "" || orgID == "" || tokenID == "" { return nil, nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-GVDgf", "Errors.IDMissing") diff --git a/internal/command/user_human_refresh_token_test.go b/internal/command/user_human_refresh_token_test.go index ca9279ac1a..c3b992535e 100644 --- a/internal/command/user_human_refresh_token_test.go +++ b/internal/command/user_human_refresh_token_test.go @@ -2,316 +2,18 @@ package command import ( "context" - "encoding/base64" "testing" "time" "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" "github.com/zitadel/oidc/v3/pkg/oidc" - "go.uber.org/mock/gomock" - "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" - "github.com/zitadel/zitadel/internal/eventstore/v1/models" - "github.com/zitadel/zitadel/internal/id" - id_mock "github.com/zitadel/zitadel/internal/id/mock" "github.com/zitadel/zitadel/internal/repository/user" "github.com/zitadel/zitadel/internal/zerrors" ) -func TestCommands_AddAccessAndRefreshToken(t *testing.T) { - type fields struct { - eventstore *eventstore.Eventstore - idGenerator id.Generator - keyAlgorithm crypto.EncryptionAlgorithm - } - type args struct { - ctx context.Context - orgID string - agentID string - clientID string - userID string - refreshToken string - audience []string - scopes []string - authMethodsReferences []string - lifetime time.Duration - authTime time.Time - refreshIdleExpiration time.Duration - refreshExpiration time.Duration - reason domain.TokenReason - actor *domain.TokenActor - } - type res struct { - token *domain.Token - refreshToken string - err func(error) bool - } - tests := []struct { - name string - fields fields - args args - res res - }{ - { - name: "missing ID, error", - fields: fields{ - eventstore: eventstoreExpect(t), - }, - args: args{}, - res: res{ - err: zerrors.IsErrorInvalidArgument, - }, - }, - { - name: "add refresh token, user deactivated, error", - fields: fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher( - user.NewUserDeactivatedEvent(context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - ), - ), - ), - ), - idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "refreshTokenID1"), - }, - args: args{ - ctx: context.Background(), - orgID: "orgID", - agentID: "agentID", - userID: "userID", - clientID: "clientID", - }, - res: res{ - err: zerrors.IsNotFound, - }, - }, - { - name: "renew refresh token, invalid token, error", - fields: fields{ - eventstore: eventstoreExpect(t), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - refreshToken: "invalid", - }, - res: res{ - err: zerrors.IsErrorInvalidArgument, - }, - }, - { - name: "renew refresh token, invalid token (invalid userID), error", - fields: fields{ - eventstore: eventstoreExpect(t), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID2:tokenID:token")), - }, - res: res{ - err: zerrors.IsErrorInvalidArgument, - }, - }, - { - name: "renew refresh token, token inactive, error", - fields: fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher(user.NewHumanRefreshTokenAddedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - "applicationID", - "userAgentID", - "de", - []string{"clientID1"}, - []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - []string{"password"}, - time.Now(), - 1*time.Hour, - 24*time.Hour, - nil, - )), - eventFromEventPusher(user.NewHumanRefreshTokenRemovedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - )), - ), - ), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:token")), - }, - res: res{ - err: zerrors.IsErrorInvalidArgument, - }, - }, - { - name: "renew refresh token, token expired, error", - fields: fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher(user.NewHumanRefreshTokenAddedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - "applicationID", - "userAgentID", - "de", - []string{"clientID1"}, - []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - []string{"password"}, - time.Now(), - -1*time.Hour, - 24*time.Hour, - nil, - )), - ), - ), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:tokenID")), - }, - res: res{ - err: zerrors.IsErrorInvalidArgument, - }, - }, - //fails because of timestamp equality - //{ - // name: "push failed, error", - // fields: fields{ - // eventstore: eventstoreExpect(t, - // expectFilter( - // eventFromEventPusher(user.NewHumanAddedEvent( - // context.Background(), - // &user.NewAggregate("userID", "orgID").Aggregate, - // "username", - // "firstname", - // "lastname", - // "nickname", - // "displayname", - // language.German, - // domain.GenderUnspecified, - // "email", - // true, - // )), - // ), - // expectFilter( - // eventFromEventPusherWithCreationDateNow(user.NewHumanAddedEvent( - // context.Background(), - // &user.NewAggregate("userID", "orgID").Aggregate, - // "username", - // "firstname", - // "lastname", - // "nickname", - // "displayname", - // language.German, - // domain.GenderUnspecified, - // "email", - // true, - // )), - // ), - // expectFilter( - // eventFromEventPusherWithCreationDateNow(user.NewHumanRefreshTokenAddedEvent( - // context.Background(), - // &user.NewAggregate("userID", "orgID").Aggregate, - // "tokenID", - // "applicationID", - // "userAgentID", - // "de", - // []string{"clientID1"}, - // []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - // []string{"password"}, - // time.Now(), - // 1*time.Hour, - // 24*time.Hour, - // )), - // ), - // expectPushFailed( - // zerrors.ThrowInternal(nil, "ERROR", "internal"), - // []*repository.Event{ - // eventFromEventPusher(user.NewUserTokenAddedEvent( - // context.Background(), - // &user.NewAggregate("userID", "orgID").Aggregate, - // "accessTokenID1", - // "clientID", - // "agentID", - // "de", - // []string{"clientID1"}, - // []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - // time.Now().Add(5*time.Minute), - // )), - // eventFromEventPusher(user.NewHumanRefreshTokenRenewedEvent( - // context.Background(), - // &user.NewAggregate("userID", "orgID").Aggregate, - // "tokenID", - // "refreshToken1", - // 1*time.Hour, - // )), - // }, - // ), - // ), - // idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "accessTokenID1", "refreshToken1"), - // keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - // }, - // args: args{ - // ctx: context.Background(), - // orgID: "orgID", - // agentID: "agentID", - // clientID: "clientID", - // userID: "userID", - // refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:tokenID")), - // audience: []string{"clientID1"}, - // scopes: []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - // authMethodsReferences: []string{"password"}, - // lifetime: 5 * time.Minute, - // authTime: time.Now(), - // }, - // res: res{ - // err: zerrors.IsInternal, - // }, - //}, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - c := &Commands{ - eventstore: tt.fields.eventstore, - idGenerator: tt.fields.idGenerator, - keyAlgorithm: tt.fields.keyAlgorithm, - } - got, gotRefresh, err := c.AddAccessAndRefreshToken(tt.args.ctx, tt.args.orgID, tt.args.agentID, tt.args.clientID, tt.args.userID, tt.args.refreshToken, - tt.args.audience, tt.args.scopes, tt.args.authMethodsReferences, tt.args.lifetime, tt.args.refreshIdleExpiration, tt.args.refreshExpiration, tt.args.authTime, tt.args.reason, tt.args.actor) - if tt.res.err == nil { - assert.NoError(t, err) - } - if tt.res.err != nil && !tt.res.err(err) { - t.Errorf("got wrong err: %v ", err) - } - if tt.res.err == nil { - assert.Equal(t, tt.res.token, got) - assert.Equal(t, tt.res.refreshToken, gotRefresh) - } - }) - } -} - func TestCommands_RevokeRefreshToken(t *testing.T) { type fields struct { eventstore *eventstore.Eventstore @@ -669,395 +371,3 @@ func TestCommands_RevokeRefreshTokens(t *testing.T) { }) } } - -func refreshTokenEncryptionAlgorithm(ctrl *gomock.Controller) crypto.EncryptionAlgorithm { - mCrypto := crypto.NewMockEncryptionAlgorithm(ctrl) - mCrypto.EXPECT().Algorithm().AnyTimes().Return("enc") - mCrypto.EXPECT().EncryptionKeyID().AnyTimes().Return("id") - mCrypto.EXPECT().Encrypt(gomock.Any()).AnyTimes().DoAndReturn( - func(refrehToken []byte) ([]byte, error) { - return refrehToken, nil - }, - ) - mCrypto.EXPECT().Decrypt(gomock.Any(), gomock.Any()).AnyTimes().DoAndReturn( - func(refrehToken []byte, keyID string) ([]byte, error) { - if keyID != "id" { - return nil, zerrors.ThrowInternal(nil, "id", "invalid key id") - } - return refrehToken, nil - }, - ) - return mCrypto -} - -func TestCommands_addRefreshToken(t *testing.T) { - authTime := time.Now().Add(-1 * time.Hour) - type fields struct { - eventstore *eventstore.Eventstore - keyAlgorithm crypto.EncryptionAlgorithm - } - type args struct { - ctx context.Context - accessToken *domain.Token - authMethodsReferences []string - authTime time.Time - idleExpiration time.Duration - expiration time.Duration - actor *domain.TokenActor - } - type res struct { - event *user.HumanRefreshTokenAddedEvent - refreshToken string - err func(error) bool - } - tests := []struct { - name string - fields fields - args args - res res - }{ - - { - name: "add refresh Token", - fields: fields{ - eventstore: eventstoreExpect(t), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - accessToken: &domain.Token{ - ObjectRoot: models.ObjectRoot{ - AggregateID: "userID", - ResourceOwner: "org1", - }, - TokenID: "accessTokenID1", - ApplicationID: "clientID", - UserAgentID: "agentID", - RefreshTokenID: "refreshTokenID", - Audience: []string{"clientID1"}, - Expiration: time.Now().Add(5 * time.Minute), - Scopes: []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - PreferredLanguage: "de", - }, - authMethodsReferences: []string{"password"}, - authTime: authTime, - idleExpiration: 1 * time.Hour, - expiration: 10 * time.Hour, - }, - res: res{ - event: user.NewHumanRefreshTokenAddedEvent( - context.Background(), - &user.NewAggregate("userID", "org1").Aggregate, - "refreshTokenID", - "clientID", - "agentID", - "de", - []string{"clientID1"}, - []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - []string{"password"}, - authTime, - 1*time.Hour, - 10*time.Hour, - nil, - ), - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:refreshTokenID:refreshTokenID")), - }, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - c := &Commands{ - eventstore: tt.fields.eventstore, - keyAlgorithm: tt.fields.keyAlgorithm, - } - gotEvent, gotRefreshToken, err := c.addRefreshToken(tt.args.ctx, tt.args.accessToken, tt.args.authMethodsReferences, tt.args.authTime, tt.args.idleExpiration, tt.args.expiration, tt.args.actor) - if tt.res.err == nil { - assert.NoError(t, err) - } - if tt.res.err != nil && !tt.res.err(err) { - t.Errorf("got wrong err: %v ", err) - } - if tt.res.err == nil { - assert.Equal(t, tt.res.event, gotEvent) - assert.Equal(t, tt.res.refreshToken, gotRefreshToken) - } - }) - } -} - -func TestCommands_renewRefreshToken(t *testing.T) { - type fields struct { - eventstore *eventstore.Eventstore - idGenerator id.Generator - keyAlgorithm crypto.EncryptionAlgorithm - } - type args struct { - ctx context.Context - userID string - orgID string - refreshToken string - idleExpiration time.Duration - } - type res struct { - event *user.HumanRefreshTokenRenewedEvent - refreshTokenID string - newRefreshToken string - } - tests := []struct { - name string - fields fields - args args - want *renewedRefreshToken - wantErr func(error) bool - }{ - { - name: "empty token, error", - fields: fields{ - eventstore: eventstoreExpect(t), - }, - args: args{ - ctx: context.Background(), - }, - wantErr: zerrors.IsErrorInvalidArgument, - }, - { - name: "invalid token, error", - fields: fields{ - eventstore: eventstoreExpect(t), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - refreshToken: "invalid", - }, - wantErr: zerrors.IsErrorInvalidArgument, - }, - { - name: "invalid token (invalid userID), error", - fields: fields{ - eventstore: eventstoreExpect(t), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID2:tokenID:token")), - }, - wantErr: zerrors.IsErrorInvalidArgument, - }, - { - name: "token inactive, error", - fields: fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher(user.NewHumanRefreshTokenAddedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - "applicationID", - "userAgentID", - "de", - []string{"clientID1"}, - []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - []string{"password"}, - time.Now(), - 1*time.Hour, - 24*time.Hour, - nil, - )), - eventFromEventPusher(user.NewHumanRefreshTokenRemovedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - )), - ), - ), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:token")), - }, - wantErr: zerrors.IsErrorInvalidArgument, - }, - { - name: "token expired, error", - fields: fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusher(user.NewHumanRefreshTokenAddedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - "applicationID", - "userAgentID", - "de", - []string{"clientID1"}, - []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - []string{"password"}, - time.Now(), - 1*time.Hour, - 24*time.Hour, - nil, - )), - ), - ), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:tokenID")), - }, - wantErr: zerrors.IsErrorInvalidArgument, - }, - { - name: "user deactivated, error", - fields: fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusherWithCreationDateNow(user.NewHumanRefreshTokenAddedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - "applicationID", - "userAgentID", - "de", - []string{"clientID1"}, - []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - []string{"password"}, - time.Now(), - 1*time.Hour, - 24*time.Hour, - nil, - )), - eventFromEventPusher( - user.NewUserDeactivatedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - ), - ), - ), - ), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:tokenID")), - idleExpiration: 1 * time.Hour, - }, - wantErr: zerrors.IsErrorInvalidArgument, - }, - { - name: "user signedout, error", - fields: fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusherWithCreationDateNow(user.NewHumanRefreshTokenAddedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - "applicationID", - "userAgentID", - "de", - []string{"clientID1"}, - []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - []string{"password"}, - time.Now(), - 1*time.Hour, - 24*time.Hour, - nil, - )), - eventFromEventPusher( - user.NewHumanSignedOutEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "userAgentID", - ), - ), - ), - ), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:tokenID")), - idleExpiration: 1 * time.Hour, - }, - wantErr: zerrors.IsErrorInvalidArgument, - }, - { - name: "token renewed, ok", - fields: fields{ - eventstore: eventstoreExpect(t, - expectFilter( - eventFromEventPusherWithCreationDateNow(user.NewHumanRefreshTokenAddedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - "applicationID", - "userAgentID", - "de", - []string{"clientID1"}, - []string{oidc.ScopeOpenID, oidc.ScopeProfile, oidc.ScopeEmail, oidc.ScopeOfflineAccess}, - []string{"password"}, - time.Now(), - 1*time.Hour, - 24*time.Hour, - nil, - )), - ), - ), - keyAlgorithm: refreshTokenEncryptionAlgorithm(gomock.NewController(t)), - idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "refreshToken1"), - }, - args: args{ - ctx: context.Background(), - userID: "userID", - orgID: "orgID", - refreshToken: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:tokenID")), - idleExpiration: 1 * time.Hour, - }, - want: &renewedRefreshToken{ - event: user.NewHumanRefreshTokenRenewedEvent( - context.Background(), - &user.NewAggregate("userID", "orgID").Aggregate, - "tokenID", - "refreshToken1", - 1*time.Hour, - ), - authMethodsReferences: []string{"password"}, - tokenID: "tokenID", - token: base64.RawURLEncoding.EncodeToString([]byte("userID:tokenID:refreshToken1")), - }, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - c := &Commands{ - eventstore: tt.fields.eventstore, - idGenerator: tt.fields.idGenerator, - keyAlgorithm: tt.fields.keyAlgorithm, - } - got, err := c.renewRefreshToken(tt.args.ctx, tt.args.userID, tt.args.orgID, tt.args.refreshToken, tt.args.idleExpiration) - if tt.wantErr != nil && !tt.wantErr(err) { - t.Errorf("got wrong err: %v ", err) - } - if tt.wantErr == nil { - require.NoError(t, err) - assert.Equal(t, tt.want.event, got.event) - assert.Equal(t, tt.want.authMethodsReferences, got.authMethodsReferences) - assert.Equal(t, tt.want.tokenID, got.tokenID) - assert.Equal(t, tt.want.token, got.token) - } - }) - } -} diff --git a/internal/command/user_test.go b/internal/command/user_test.go index b906b7b5b5..5de57a153a 100644 --- a/internal/command/user_test.go +++ b/internal/command/user_test.go @@ -11,7 +11,6 @@ import ( "github.com/zitadel/zitadel/internal/command/preparation" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" - "github.com/zitadel/zitadel/internal/id" "github.com/zitadel/zitadel/internal/repository/instance" "github.com/zitadel/zitadel/internal/repository/org" "github.com/zitadel/zitadel/internal/repository/project" @@ -1433,91 +1432,6 @@ func TestCommandSide_RemoveUser(t *testing.T) { } } -func TestCommandSide_AddUserToken(t *testing.T) { - type fields struct { - eventstore *eventstore.Eventstore - idGenerator id.Generator - } - type ( - args struct { - ctx context.Context - orgID string - agentID string - clientID string - userID string - audience []string - scopes []string - authMethodsReferences []string - lifetime time.Duration - authTime time.Time - reason domain.TokenReason - actor *domain.TokenActor - } - ) - type res struct { - want *domain.Token - err func(error) bool - } - tests := []struct { - name string - fields fields - args args - res res - }{ - { - name: "userid missing, invalid argument error", - fields: fields{ - eventstore: eventstoreExpect( - t, - ), - }, - args: args{ - ctx: context.Background(), - orgID: "org1", - userID: "", - }, - res: res{ - err: zerrors.IsErrorInvalidArgument, - }, - }, - { - name: "user not existing, not found error", - fields: fields{ - eventstore: eventstoreExpect( - t, - expectFilter(), - ), - }, - args: args{ - ctx: context.Background(), - orgID: "org1", - userID: "user1", - }, - res: res{ - err: zerrors.IsNotFound, - }, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - r := &Commands{ - eventstore: tt.fields.eventstore, - idGenerator: tt.fields.idGenerator, - } - got, err := r.AddUserToken(tt.args.ctx, tt.args.orgID, tt.args.agentID, tt.args.clientID, tt.args.userID, tt.args.audience, tt.args.scopes, tt.args.authMethodsReferences, tt.args.lifetime, tt.args.authTime, tt.args.reason, tt.args.actor) - if tt.res.err == nil { - assert.NoError(t, err) - } - if tt.res.err != nil && !tt.res.err(err) { - t.Errorf("got wrong err: %v ", err) - } - if tt.res.err == nil { - assert.Equal(t, tt.res.want, got) - } - }) - } -} - func TestCommands_RevokeAccessToken(t *testing.T) { type fields struct { eventstore *eventstore.Eventstore diff --git a/internal/domain/auth_request.go b/internal/domain/auth_request.go index 0a7704d691..7bdd7bcb86 100644 --- a/internal/domain/auth_request.go +++ b/internal/domain/auth_request.go @@ -34,6 +34,7 @@ type AuthRequest struct { AvatarKey string PresignedAvatar string UserOrgID string + PreferredLanguage *language.Tag RequestedOrgID string RequestedOrgName string RequestedPrimaryDomain string diff --git a/internal/domain/browser_info.go b/internal/domain/browser_info.go index bd5b5d7d97..7261cb3e6e 100644 --- a/internal/domain/browser_info.go +++ b/internal/domain/browser_info.go @@ -11,6 +11,7 @@ type BrowserInfo struct { UserAgent string AcceptLanguage string RemoteIP net.IP + Header net_http.Header } func BrowserInfoFromRequest(r *net_http.Request) *BrowserInfo { @@ -18,5 +19,18 @@ func BrowserInfoFromRequest(r *net_http.Request) *BrowserInfo { UserAgent: r.Header.Get(http_util.UserAgentHeader), AcceptLanguage: r.Header.Get(http_util.AcceptLanguage), RemoteIP: http_util.RemoteIPFromRequest(r), + Header: r.Header, + } +} + +func (b *BrowserInfo) ToUserAgent() *UserAgent { + if b == nil { + return nil + } + return &UserAgent{ + FingerprintID: &b.UserAgent, + IP: b.RemoteIP, + Description: &b.UserAgent, + Header: b.Header, } } diff --git a/internal/domain/device_auth.go b/internal/domain/device_auth.go index d8e4bb3870..eb37e90216 100644 --- a/internal/domain/device_auth.go +++ b/internal/domain/device_auth.go @@ -18,6 +18,7 @@ const ( DeviceAuthStateApproved // approved DeviceAuthStateDenied // denied DeviceAuthStateExpired // expired + DeviceAuthStateDone // done deviceAuthStateCount // invalid ) diff --git a/internal/domain/deviceauthstate_string.go b/internal/domain/deviceauthstate_string.go index 0381287c71..df61b82bb2 100644 --- a/internal/domain/deviceauthstate_string.go +++ b/internal/domain/deviceauthstate_string.go @@ -13,12 +13,13 @@ func _() { _ = x[DeviceAuthStateApproved-2] _ = x[DeviceAuthStateDenied-3] _ = x[DeviceAuthStateExpired-4] - _ = x[deviceAuthStateCount-5] + _ = x[DeviceAuthStateDone-5] + _ = x[deviceAuthStateCount-6] } -const _DeviceAuthState_name = "undefinedinitiatedapproveddeniedexpiredinvalid" +const _DeviceAuthState_name = "undefinedinitiatedapproveddeniedexpireddoneinvalid" -var _DeviceAuthState_index = [...]uint8{0, 9, 18, 26, 32, 39, 46} +var _DeviceAuthState_index = [...]uint8{0, 9, 18, 26, 32, 39, 43, 50} func (i DeviceAuthState) String() string { if i >= DeviceAuthState(len(_DeviceAuthState_index)-1) { diff --git a/internal/domain/oidc_error_reason.go b/internal/domain/oidc_error_reason.go index 5a4c8d2c7a..889ea4c751 100644 --- a/internal/domain/oidc_error_reason.go +++ b/internal/domain/oidc_error_reason.go @@ -1,5 +1,13 @@ package domain +import ( + "errors" + + "github.com/zitadel/oidc/v3/pkg/oidc" + + "github.com/zitadel/zitadel/internal/zerrors" +) + type OIDCErrorReason int32 const ( @@ -20,4 +28,21 @@ const ( OIDCErrorReasonRequestNotSupported OIDCErrorReasonRequestURINotSupported OIDCErrorReasonRegistrationNotSupported + OIDCErrorReasonInvalidGrant ) + +func OIDCErrorReasonFromError(err error) OIDCErrorReason { + if errors.Is(err, oidc.ErrInvalidRequest()) { + return OIDCErrorReasonInvalidRequest + } + if errors.Is(err, oidc.ErrInvalidGrant()) { + return OIDCErrorReasonInvalidGrant + } + if zerrors.IsPreconditionFailed(err) { + return OIDCErrorReasonAccessDenied + } + if zerrors.IsInternal(err) { + return OIDCErrorReasonServerError + } + return OIDCErrorReasonUnspecified +} diff --git a/internal/domain/oidc_error_reason_test.go b/internal/domain/oidc_error_reason_test.go new file mode 100644 index 0000000000..75ab456a09 --- /dev/null +++ b/internal/domain/oidc_error_reason_test.go @@ -0,0 +1,51 @@ +package domain + +import ( + "io" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/zitadel/oidc/v3/pkg/oidc" + + "github.com/zitadel/zitadel/internal/zerrors" +) + +func TestOIDCErrorReasonFromError(t *testing.T) { + tests := []struct { + name string + err error + want OIDCErrorReason + }{ + { + name: "invalid request", + err: oidc.ErrInvalidRequest().WithDescription("foo"), + want: OIDCErrorReasonInvalidRequest, + }, + { + name: "invalid grant", + err: oidc.ErrInvalidGrant().WithDescription("foo"), + want: OIDCErrorReasonInvalidGrant, + }, + { + name: "precondition failed", + err: zerrors.ThrowPreconditionFailed(nil, "123", "bar"), + want: OIDCErrorReasonAccessDenied, + }, + { + name: "internal", + err: zerrors.ThrowInternal(nil, "123", "bar"), + want: OIDCErrorReasonServerError, + }, + { + name: "unspecified", + err: io.ErrClosedPipe, + want: OIDCErrorReasonUnspecified, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := OIDCErrorReasonFromError(tt.err) + assert.Equal(t, tt.want, got) + }) + } +} diff --git a/internal/domain/token.go b/internal/domain/token.go index 1c12efc28d..83937554c0 100644 --- a/internal/domain/token.go +++ b/internal/domain/token.go @@ -3,27 +3,10 @@ package domain import ( "context" "strings" - "time" "github.com/zitadel/zitadel/internal/api/authz" - es_models "github.com/zitadel/zitadel/internal/eventstore/v1/models" ) -type Token struct { - es_models.ObjectRoot - - TokenID string - ApplicationID string - UserAgentID string - RefreshTokenID string - Audience []string - Expiration time.Time - Scopes []string - PreferredLanguage string - Reason TokenReason - Actor *TokenActor -} - func AddAudScopeToAudience(ctx context.Context, audience, scopes []string) []string { for _, scope := range scopes { if !(strings.HasPrefix(scope, ProjectIDScope) && strings.HasSuffix(scope, AudSuffix)) { diff --git a/internal/domain/user_agent.go b/internal/domain/user_agent.go index ca72c6bec4..9a52f62460 100644 --- a/internal/domain/user_agent.go +++ b/internal/domain/user_agent.go @@ -15,3 +15,10 @@ type UserAgent struct { func (ua UserAgent) IsEmpty() bool { return ua.FingerprintID == nil && len(ua.IP) == 0 && ua.Description == nil && ua.Header == nil } + +func (ua *UserAgent) GetFingerprintID() string { + if ua == nil || ua.FingerprintID == nil { + return "" + } + return *ua.FingerprintID +} diff --git a/internal/domain/user_agent_test.go b/internal/domain/user_agent_test.go new file mode 100644 index 0000000000..0a2b293977 --- /dev/null +++ b/internal/domain/user_agent_test.go @@ -0,0 +1,42 @@ +package domain + +import ( + "testing" + + "github.com/muhlemmer/gu" + "github.com/stretchr/testify/assert" +) + +func TestUserAgent_GetFingerprintID(t *testing.T) { + tests := []struct { + name string + fields *UserAgent + want string + }{ + { + name: "nil useragent", + fields: nil, + want: "", + }, + { + name: "nil fingerprintID", + fields: &UserAgent{ + FingerprintID: nil, + }, + want: "", + }, + { + name: "value", + fields: &UserAgent{ + FingerprintID: gu.Ptr("fp"), + }, + want: "fp", + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := tt.fields.GetFingerprintID() + assert.Equal(t, tt.want, got) + }) + } +} diff --git a/internal/integration/oidc.go b/internal/integration/oidc.go index d928c3e004..3ba655c65b 100644 --- a/internal/integration/oidc.go +++ b/internal/integration/oidc.go @@ -299,3 +299,24 @@ func (s *Tester) CreateOIDCCredentialsClient(ctx context.Context) (userID, clien } return user.GetUserId(), secret.GetClientId(), secret.GetClientSecret(), nil } + +func (s *Tester) CreateOIDCJWTProfileClient(ctx context.Context) (userID string, keyData []byte, err error) { + name := gofakeit.Username() + user, err := s.Client.Mgmt.AddMachineUser(ctx, &management.AddMachineUserRequest{ + Name: name, + UserName: name, + AccessTokenType: user.AccessTokenType_ACCESS_TOKEN_TYPE_JWT, + }) + if err != nil { + return "", nil, err + } + keyResp, err := s.Client.Mgmt.AddMachineKey(ctx, &management.AddMachineKeyRequest{ + UserId: user.GetUserId(), + Type: authn.KeyType_KEY_TYPE_JSON, + ExpirationDate: timestamppb.New(time.Now().Add(time.Hour)), + }) + if err != nil { + return "", nil, err + } + return user.GetUserId(), keyResp.GetKeyDetails(), nil +} diff --git a/internal/query/access_token.go b/internal/query/access_token.go index 2b927cf7b5..40d9b1700a 100644 --- a/internal/query/access_token.go +++ b/internal/query/access_token.go @@ -5,6 +5,8 @@ import ( "strings" "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/oidcsession" @@ -24,10 +26,13 @@ type OIDCSessionAccessTokenReadModel struct { Scope []string AuthMethods []domain.UserAuthMethodType AuthTime time.Time + Nonce string State domain.OIDCSessionState AccessTokenID string AccessTokenCreation time.Time AccessTokenExpiration time.Time + PreferredLanguage *language.Tag + UserAgent *domain.UserAgent Reason domain.TokenReason Actor *domain.TokenActor } @@ -79,6 +84,9 @@ func (wm *OIDCSessionAccessTokenReadModel) reduceAdded(e *oidcsession.AddedEvent wm.Scope = e.Scope wm.AuthMethods = e.AuthMethods wm.AuthTime = e.AuthTime + wm.Nonce = e.Nonce + wm.PreferredLanguage = e.PreferredLanguage + wm.UserAgent = e.UserAgent wm.State = domain.OIDCSessionStateActive } @@ -112,7 +120,7 @@ func (q *Queries) ActiveAccessTokenByToken(ctx context.Context, token string) (m if !model.AccessTokenExpiration.After(time.Now()) { return nil, zerrors.ThrowPermissionDenied(nil, "QUERY-SAF3rf", "Errors.OIDCSession.Token.Expired") } - if err = q.checkSessionNotTerminatedAfter(ctx, model.SessionID, model.UserID, model.AccessTokenCreation); err != nil { + if err = q.checkSessionNotTerminatedAfter(ctx, model.SessionID, model.UserID, model.AccessTokenCreation, model.UserAgent.GetFingerprintID()); err != nil { return nil, err } return model, nil @@ -132,16 +140,17 @@ func (q *Queries) accessTokenByOIDCSessionAndTokenID(ctx context.Context, oidcSe return model, nil } -// checkSessionNotTerminatedAfter checks if a [session.TerminateType] event occurred after a certain time -// and will return an error if so. -func (q *Queries) checkSessionNotTerminatedAfter(ctx context.Context, sessionID, userID string, creation time.Time) (err error) { +// checkSessionNotTerminatedAfter checks if a [session.TerminateType] event (or user events leading to a session termination) +// occurred after a certain time and will return an error if so. +func (q *Queries) checkSessionNotTerminatedAfter(ctx context.Context, sessionID, userID string, creation time.Time, fingerprintID string) (err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() model := &sessionTerminatedModel{ - sessionID: sessionID, - creation: creation, - userID: userID, + sessionID: sessionID, + creation: creation, + userID: userID, + fingerPrintID: fingerprintID, } err = q.eventstore.FilterToQueryReducer(ctx, model) if err != nil { @@ -155,9 +164,10 @@ func (q *Queries) checkSessionNotTerminatedAfter(ctx context.Context, sessionID, } type sessionTerminatedModel struct { - creation time.Time - sessionID string - userID string + creation time.Time + sessionID string + userID string + fingerPrintID string events int terminated bool @@ -195,5 +205,12 @@ func (s *sessionTerminatedModel) Query() *eventstore.SearchQueryBuilder { user.UserLockedType, user.UserRemovedType, ). + Or(). // for specific logout on v1 sessions from the same user agent + AggregateTypes(user.AggregateType). + AggregateIDs(s.userID). + EventTypes( + user.HumanSignedOutType, + ). + EventData(map[string]interface{}{"userAgentID": s.fingerPrintID}). Builder() } diff --git a/internal/query/authn_key.go b/internal/query/authn_key.go index 99ccca0d97..679f444327 100644 --- a/internal/query/authn_key.go +++ b/internal/query/authn_key.go @@ -209,7 +209,7 @@ func (q *Queries) GetAuthNKeyByID(ctx context.Context, shouldTriggerBulk bool, i return key, err } -func (q *Queries) GetAuthNKeyPublicKeyByIDAndIdentifier(ctx context.Context, id string, identifier string, withOwnerRemoved bool) (key []byte, err error) { +func (q *Queries) GetAuthNKeyPublicKeyByIDAndIdentifier(ctx context.Context, id string, identifier string) (key []byte, err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() diff --git a/internal/query/device_auth.go b/internal/query/device_auth.go index 9cef26d2bd..d63bfe0209 100644 --- a/internal/query/device_auth.go +++ b/internal/query/device_auth.go @@ -4,7 +4,6 @@ import ( "context" "database/sql" "errors" - "time" sq "github.com/Masterminds/squirrel" @@ -59,34 +58,6 @@ var ( } ) -type DeviceAuth struct { - ClientID string - DeviceCode string - UserCode string - Expires time.Time - Scopes []string - Audience []string - State domain.DeviceAuthState - Subject string - UserAuthMethods []domain.UserAuthMethodType - AuthTime time.Time -} - -// DeviceAuthByDeviceCode gets the current state of a Device Authorization directly from the eventstore. -func (q *Queries) DeviceAuthByDeviceCode(ctx context.Context, deviceCode string) (deviceAuth *DeviceAuth, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { span.EndWithError(err) }() - - model := NewDeviceAuthReadModel(deviceCode, authz.GetInstance(ctx).InstanceID()) - if err := q.eventstore.FilterToQueryReducer(ctx, model); err != nil { - return nil, err - } - if !model.State.Exists() { - return nil, zerrors.ThrowNotFound(nil, "QUERY-eeR0e", "Errors.DeviceAuth.NotExisting") - } - return &model.DeviceAuth, nil -} - // DeviceAuthRequestByUserCode finds a Device Authorization request by User-Code from the `device_auth_requests` projection. func (q *Queries) DeviceAuthRequestByUserCode(ctx context.Context, userCode string) (authReq *domain.AuthRequestDevice, err error) { ctx, span := tracing.NewSpan(ctx) diff --git a/internal/query/device_auth_model.go b/internal/query/device_auth_model.go deleted file mode 100644 index 91ad06ddfc..0000000000 --- a/internal/query/device_auth_model.go +++ /dev/null @@ -1,59 +0,0 @@ -package query - -import ( - "github.com/zitadel/zitadel/internal/domain" - "github.com/zitadel/zitadel/internal/eventstore" - "github.com/zitadel/zitadel/internal/repository/deviceauth" -) - -type DeviceAuthReadModel struct { - eventstore.ReadModel - DeviceAuth -} - -func NewDeviceAuthReadModel(deviceCode, resourceOwner string) *DeviceAuthReadModel { - return &DeviceAuthReadModel{ - ReadModel: eventstore.ReadModel{ - AggregateID: deviceCode, - ResourceOwner: resourceOwner, - }, - } -} - -func (m *DeviceAuthReadModel) Reduce() error { - for _, event := range m.Events { - switch e := event.(type) { - case *deviceauth.AddedEvent: - m.ClientID = e.ClientID - m.DeviceCode = e.DeviceCode - m.UserCode = e.UserCode - m.Expires = e.Expires - m.Scopes = e.Scopes - m.Audience = e.Audience - m.State = e.State - case *deviceauth.ApprovedEvent: - m.State = domain.DeviceAuthStateApproved - m.Subject = e.Subject - m.UserAuthMethods = e.UserAuthMethods - m.AuthTime = e.AuthTime - case *deviceauth.CanceledEvent: - m.State = e.Reason.State() - } - } - - return m.ReadModel.Reduce() -} - -func (m *DeviceAuthReadModel) Query() *eventstore.SearchQueryBuilder { - return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent). - ResourceOwner(m.ResourceOwner). - AddQuery(). - AggregateTypes(deviceauth.AggregateType). - AggregateIDs(m.AggregateID). - EventTypes( - deviceauth.AddedEventType, - deviceauth.ApprovedEventType, - deviceauth.CanceledEventType, - ). - Builder() -} diff --git a/internal/query/device_auth_test.go b/internal/query/device_auth_test.go index d9773cdc7f..ff6a91e222 100644 --- a/internal/query/device_auth_test.go +++ b/internal/query/device_auth_test.go @@ -6,167 +6,18 @@ import ( "database/sql/driver" "errors" "fmt" - "io" "regexp" "testing" - "time" "github.com/DATA-DOG/go-sqlmock" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" - "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/database" db_mock "github.com/zitadel/zitadel/internal/database/mock" "github.com/zitadel/zitadel/internal/domain" - "github.com/zitadel/zitadel/internal/eventstore" - "github.com/zitadel/zitadel/internal/repository/deviceauth" - "github.com/zitadel/zitadel/internal/zerrors" ) -func TestQueries_DeviceAuthByDeviceCode(t *testing.T) { - ctx := authz.NewMockContext("inst1", "org1", "user1") - timestamp := time.Date(2015, 12, 15, 22, 13, 45, 0, time.UTC) - tests := []struct { - name string - eventstore func(t *testing.T) *eventstore.Eventstore - want *DeviceAuth - wantErr error - }{ - { - name: "filter error", - eventstore: expectEventstore( - expectFilterError(io.ErrClosedPipe), - ), - wantErr: io.ErrClosedPipe, - }, - { - name: "not found", - eventstore: expectEventstore( - expectFilter(), - ), - wantErr: zerrors.ThrowNotFound(nil, "QUERY-eeR0e", "Errors.DeviceAuth.NotExisting"), - }, - { - name: "ok, initiated", - eventstore: expectEventstore( - expectFilter( - eventFromEventPusher(deviceauth.NewAddedEvent( - ctx, - deviceauth.NewAggregate("device1", "instance1"), - "client1", "device1", "user-code", timestamp, []string{"foo", "bar"}, - []string{"projectID", "clientID"}, - )), - ), - ), - want: &DeviceAuth{ - ClientID: "client1", - DeviceCode: "device1", - UserCode: "user-code", - Expires: timestamp, - Scopes: []string{"foo", "bar"}, - Audience: []string{"projectID", "clientID"}, - State: domain.DeviceAuthStateInitiated, - }, - }, - { - name: "ok, approved", - eventstore: expectEventstore( - expectFilter( - eventFromEventPusher(deviceauth.NewAddedEvent( - ctx, - deviceauth.NewAggregate("device1", "instance1"), - "client1", "device1", "user-code", timestamp, []string{"foo", "bar"}, - []string{"projectID", "clientID"}, - )), - eventFromEventPusher(deviceauth.NewApprovedEvent( - ctx, - deviceauth.NewAggregate("device1", "instance1"), - "user1", []domain.UserAuthMethodType{domain.UserAuthMethodTypePasswordless}, - timestamp, - )), - ), - ), - want: &DeviceAuth{ - ClientID: "client1", - DeviceCode: "device1", - UserCode: "user-code", - Expires: timestamp, - Scopes: []string{"foo", "bar"}, - Audience: []string{"projectID", "clientID"}, - State: domain.DeviceAuthStateApproved, - Subject: "user1", - UserAuthMethods: []domain.UserAuthMethodType{domain.UserAuthMethodTypePasswordless}, - AuthTime: timestamp, - }, - }, - { - name: "ok, denied", - eventstore: expectEventstore( - expectFilter( - eventFromEventPusher(deviceauth.NewAddedEvent( - ctx, - deviceauth.NewAggregate("device1", "instance1"), - "client1", "device1", "user-code", timestamp, []string{"foo", "bar"}, - []string{"projectID", "clientID"}, - )), - eventFromEventPusher(deviceauth.NewCanceledEvent( - ctx, - deviceauth.NewAggregate("device1", "instance1"), - domain.DeviceAuthCanceledDenied, - )), - ), - ), - want: &DeviceAuth{ - ClientID: "client1", - DeviceCode: "device1", - UserCode: "user-code", - Expires: timestamp, - Scopes: []string{"foo", "bar"}, - Audience: []string{"projectID", "clientID"}, - State: domain.DeviceAuthStateDenied, - }, - }, - { - name: "ok, expired", - eventstore: expectEventstore( - expectFilter( - eventFromEventPusher(deviceauth.NewAddedEvent( - ctx, - deviceauth.NewAggregate("device1", "instance1"), - "client1", "device1", "user-code", timestamp, []string{"foo", "bar"}, - []string{"projectID", "clientID"}, - )), - eventFromEventPusher(deviceauth.NewCanceledEvent( - ctx, - deviceauth.NewAggregate("device1", "instance1"), - domain.DeviceAuthCanceledExpired, - )), - ), - ), - want: &DeviceAuth{ - ClientID: "client1", - DeviceCode: "device1", - UserCode: "user-code", - Expires: timestamp, - Scopes: []string{"foo", "bar"}, - Audience: []string{"projectID", "clientID"}, - State: domain.DeviceAuthStateExpired, - }, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - q := &Queries{ - eventstore: tt.eventstore(t), - } - got, err := q.DeviceAuthByDeviceCode(ctx, "device1") - require.ErrorIs(t, err, tt.wantErr) - assert.Equal(t, tt.want, got) - }) - } -} - const ( expectedDeviceAuthQueryC = `SELECT` + ` projections.device_auth_requests2.client_id,` + diff --git a/internal/query/projection/device_auth.go b/internal/query/projection/device_auth.go index 4fd3be5510..5a620ab93b 100644 --- a/internal/query/projection/device_auth.go +++ b/internal/query/projection/device_auth.go @@ -74,6 +74,10 @@ func (p *deviceAuthRequestProjection) Reducers() []handler.AggregateReducer { Event: deviceauth.CanceledEventType, Reduce: p.reduceDoneEvents, }, + { + Event: deviceauth.DoneEventType, + Reduce: p.reduceDoneEvents, + }, }, }, } @@ -103,7 +107,7 @@ func (p *deviceAuthRequestProjection) reduceAdded(event eventstore.Event) (*hand // reduceDoneEvents removes the device auth request from the projection. func (p *deviceAuthRequestProjection) reduceDoneEvents(event eventstore.Event) (*handler.Statement, error) { switch event.(type) { - case *deviceauth.ApprovedEvent, *deviceauth.CanceledEvent: + case *deviceauth.ApprovedEvent, *deviceauth.CanceledEvent, *deviceauth.DoneEvent: return handler.NewDeleteStatement(event, []handler.Condition{ handler.NewCond(DeviceAuthRequestColumnInstanceID, event.Aggregate().InstanceID), diff --git a/internal/repository/authrequest/auth_request.go b/internal/repository/authrequest/auth_request.go index 5e9f1ad390..0492c541f8 100644 --- a/internal/repository/authrequest/auth_request.go +++ b/internal/repository/authrequest/auth_request.go @@ -22,20 +22,21 @@ const ( type AddedEvent struct { eventstore.BaseEvent `json:"-"` - LoginClient string `json:"login_client"` - ClientID string `json:"client_id"` - RedirectURI string `json:"redirect_uri"` - State string `json:"state,omitempty"` - Nonce string `json:"nonce,omitempty"` - Scope []string `json:"scope,omitempty"` - Audience []string `json:"audience,omitempty"` - ResponseType domain.OIDCResponseType `json:"response_type,omitempty"` - CodeChallenge *domain.OIDCCodeChallenge `json:"code_challenge,omitempty"` - Prompt []domain.Prompt `json:"prompt,omitempty"` - UILocales []string `json:"ui_locales,omitempty"` - MaxAge *time.Duration `json:"max_age,omitempty"` - LoginHint *string `json:"login_hint,omitempty"` - HintUserID *string `json:"hint_user_id,omitempty"` + LoginClient string `json:"login_client"` + ClientID string `json:"client_id"` + RedirectURI string `json:"redirect_uri"` + State string `json:"state,omitempty"` + Nonce string `json:"nonce,omitempty"` + Scope []string `json:"scope,omitempty"` + Audience []string `json:"audience,omitempty"` + ResponseType domain.OIDCResponseType `json:"response_type,omitempty"` + CodeChallenge *domain.OIDCCodeChallenge `json:"code_challenge,omitempty"` + Prompt []domain.Prompt `json:"prompt,omitempty"` + UILocales []string `json:"ui_locales,omitempty"` + MaxAge *time.Duration `json:"max_age,omitempty"` + LoginHint *string `json:"login_hint,omitempty"` + HintUserID *string `json:"hint_user_id,omitempty"` + NeedRefreshToken bool `json:"need_refresh_token,omitempty"` } func (e *AddedEvent) Payload() interface{} { @@ -62,6 +63,7 @@ func NewAddedEvent(ctx context.Context, maxAge *time.Duration, loginHint, hintUserID *string, + needRefreshToken bool, ) *AddedEvent { return &AddedEvent{ BaseEvent: *eventstore.NewBaseEventForPush( @@ -69,20 +71,21 @@ func NewAddedEvent(ctx context.Context, aggregate, AddedType, ), - LoginClient: loginClient, - ClientID: clientID, - RedirectURI: redirectURI, - State: state, - Nonce: nonce, - Scope: scope, - Audience: audience, - ResponseType: responseType, - CodeChallenge: codeChallenge, - Prompt: prompt, - UILocales: uiLocales, - MaxAge: maxAge, - LoginHint: loginHint, - HintUserID: hintUserID, + LoginClient: loginClient, + ClientID: clientID, + RedirectURI: redirectURI, + State: state, + Nonce: nonce, + Scope: scope, + Audience: audience, + ResponseType: responseType, + CodeChallenge: codeChallenge, + Prompt: prompt, + UILocales: uiLocales, + MaxAge: maxAge, + LoginHint: loginHint, + HintUserID: hintUserID, + NeedRefreshToken: needRefreshToken, } } diff --git a/internal/repository/deviceauth/device_auth.go b/internal/repository/deviceauth/device_auth.go index 4822c0b332..d2f6886693 100644 --- a/internal/repository/deviceauth/device_auth.go +++ b/internal/repository/deviceauth/device_auth.go @@ -4,6 +4,8 @@ import ( "context" "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" ) @@ -13,18 +15,20 @@ const ( AddedEventType = eventTypePrefix + "added" ApprovedEventType = eventTypePrefix + "approved" CanceledEventType = eventTypePrefix + "canceled" + DoneEventType = eventTypePrefix + "done" ) type AddedEvent struct { *eventstore.BaseEvent `json:"-"` - ClientID string - DeviceCode string - UserCode string - Expires time.Time - Scopes []string - Audience []string - State domain.DeviceAuthState + ClientID string + DeviceCode string + UserCode string + Expires time.Time + Scopes []string + Audience []string + State domain.DeviceAuthState + NeedRefreshToken bool } func (e *AddedEvent) SetBaseEvent(b *eventstore.BaseEvent) { @@ -48,20 +52,26 @@ func NewAddedEvent( expires time.Time, scopes []string, audience []string, + needRefreshToken bool, ) *AddedEvent { return &AddedEvent{ eventstore.NewBaseEventForPush( ctx, aggregate, AddedEventType, ), - clientID, deviceCode, userCode, expires, scopes, audience, domain.DeviceAuthStateInitiated} + clientID, deviceCode, userCode, expires, scopes, audience, + domain.DeviceAuthStateInitiated, needRefreshToken, + } } type ApprovedEvent struct { *eventstore.BaseEvent `json:"-"` - Subject string - UserAuthMethods []domain.UserAuthMethodType - AuthTime time.Time + UserID string + UserOrgID string + UserAuthMethods []domain.UserAuthMethodType + AuthTime time.Time + PreferredLanguage *language.Tag + UserAgent *domain.UserAgent } func (e *ApprovedEvent) SetBaseEvent(b *eventstore.BaseEvent) { @@ -79,17 +89,23 @@ func (e *ApprovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint { func NewApprovedEvent( ctx context.Context, aggregate *eventstore.Aggregate, - subject string, + userID, + userOrgID string, userAuthMethods []domain.UserAuthMethodType, authTime time.Time, + preferredLanguage *language.Tag, + userAgent *domain.UserAgent, ) *ApprovedEvent { return &ApprovedEvent{ eventstore.NewBaseEventForPush( ctx, aggregate, ApprovedEventType, ), - subject, + userID, + userOrgID, userAuthMethods, authTime, + preferredLanguage, + userAgent, } } @@ -114,3 +130,23 @@ func (e *CanceledEvent) UniqueConstraints() []*eventstore.UniqueConstraint { func NewCanceledEvent(ctx context.Context, aggregate *eventstore.Aggregate, reason domain.DeviceAuthCanceled) *CanceledEvent { return &CanceledEvent{eventstore.NewBaseEventForPush(ctx, aggregate, CanceledEventType), reason} } + +type DoneEvent struct { + *eventstore.BaseEvent `json:"-"` +} + +func (e *DoneEvent) SetBaseEvent(b *eventstore.BaseEvent) { + e.BaseEvent = b +} + +func (e *DoneEvent) Payload() any { + return e +} + +func (e *DoneEvent) UniqueConstraints() []*eventstore.UniqueConstraint { + return nil +} + +func NewDoneEvent(ctx context.Context, aggregate *eventstore.Aggregate) *DoneEvent { + return &DoneEvent{eventstore.NewBaseEventForPush(ctx, aggregate, DoneEventType)} +} diff --git a/internal/repository/deviceauth/eventstore.go b/internal/repository/deviceauth/eventstore.go index 75ce37c9e5..8e7d2d7124 100644 --- a/internal/repository/deviceauth/eventstore.go +++ b/internal/repository/deviceauth/eventstore.go @@ -6,4 +6,5 @@ func init() { eventstore.RegisterFilterEventMapper(AggregateType, AddedEventType, eventstore.GenericEventMapper[AddedEvent]) eventstore.RegisterFilterEventMapper(AggregateType, ApprovedEventType, eventstore.GenericEventMapper[ApprovedEvent]) eventstore.RegisterFilterEventMapper(AggregateType, CanceledEventType, eventstore.GenericEventMapper[CanceledEvent]) + eventstore.RegisterFilterEventMapper(AggregateType, DoneEventType, eventstore.GenericEventMapper[DoneEvent]) } diff --git a/internal/repository/oidcsession/oidc_session.go b/internal/repository/oidcsession/oidc_session.go index ff127b3696..55316635b3 100644 --- a/internal/repository/oidcsession/oidc_session.go +++ b/internal/repository/oidcsession/oidc_session.go @@ -4,6 +4,8 @@ import ( "context" "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" ) @@ -21,13 +23,17 @@ const ( type AddedEvent struct { eventstore.BaseEvent `json:"-"` - UserID string `json:"userID"` - SessionID string `json:"sessionID"` - ClientID string `json:"clientID"` - Audience []string `json:"audience"` - Scope []string `json:"scope"` - AuthMethods []domain.UserAuthMethodType `json:"authMethods"` - AuthTime time.Time `json:"authTime"` + UserID string `json:"userID"` + UserResourceOwner string `json:"userResourceOwner"` + SessionID string `json:"sessionID"` + ClientID string `json:"clientID"` + Audience []string `json:"audience"` + Scope []string `json:"scope"` + AuthMethods []domain.UserAuthMethodType `json:"authMethods"` + AuthTime time.Time `json:"authTime"` + Nonce string `json:"nonce,omitempty"` + PreferredLanguage *language.Tag `json:"preferredLanguage,omitempty"` + UserAgent *domain.UserAgent `json:"userAgent,omitempty"` } func (e *AddedEvent) Payload() interface{} { @@ -45,12 +51,16 @@ func (e *AddedEvent) SetBaseEvent(event *eventstore.BaseEvent) { func NewAddedEvent(ctx context.Context, aggregate *eventstore.Aggregate, userID, + userResourceOwner, sessionID, clientID string, audience, scope []string, authMethods []domain.UserAuthMethodType, authTime time.Time, + nonce string, + preferredLanguage *language.Tag, + userAgent *domain.UserAgent, ) *AddedEvent { return &AddedEvent{ BaseEvent: *eventstore.NewBaseEventForPush( @@ -58,13 +68,17 @@ func NewAddedEvent(ctx context.Context, aggregate, AddedType, ), - UserID: userID, - SessionID: sessionID, - ClientID: clientID, - Audience: audience, - Scope: scope, - AuthMethods: authMethods, - AuthTime: authTime, + UserID: userID, + UserResourceOwner: userResourceOwner, + SessionID: sessionID, + ClientID: clientID, + Audience: audience, + Scope: scope, + AuthMethods: authMethods, + AuthTime: authTime, + Nonce: nonce, + PreferredLanguage: preferredLanguage, + UserAgent: userAgent, } } diff --git a/internal/repository/session/session.go b/internal/repository/session/session.go index 116d85a186..b8768c6396 100644 --- a/internal/repository/session/session.go +++ b/internal/repository/session/session.go @@ -4,6 +4,8 @@ import ( "context" "time" + "golang.org/x/text/language" + "github.com/zitadel/zitadel/internal/api/http" "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" @@ -75,9 +77,10 @@ func AddedEventMapper(event eventstore.Event) (eventstore.Event, error) { type UserCheckedEvent struct { eventstore.BaseEvent `json:"-"` - UserID string `json:"userID"` - UserResourceOwner string `json:"userResourceOwner"` - CheckedAt time.Time `json:"checkedAt"` + UserID string `json:"userID"` + UserResourceOwner string `json:"userResourceOwner"` + CheckedAt time.Time `json:"checkedAt"` + PreferredLanguage *language.Tag `json:"preferredLanguage,omitempty"` } func (e *UserCheckedEvent) Payload() interface{} { @@ -94,6 +97,7 @@ func NewUserCheckedEvent( userID, userResourceOwner string, checkedAt time.Time, + preferredLanguage *language.Tag, ) *UserCheckedEvent { return &UserCheckedEvent{ BaseEvent: *eventstore.NewBaseEventForPush( @@ -104,6 +108,7 @@ func NewUserCheckedEvent( UserID: userID, UserResourceOwner: userResourceOwner, CheckedAt: checkedAt, + PreferredLanguage: preferredLanguage, } } diff --git a/internal/repository/user/eventstore.go b/internal/repository/user/eventstore.go index 02df90f369..e04754e54a 100644 --- a/internal/repository/user/eventstore.go +++ b/internal/repository/user/eventstore.go @@ -42,6 +42,7 @@ func init() { eventstore.RegisterFilterEventMapper(AggregateType, UserReactivatedType, UserReactivatedEventMapper) eventstore.RegisterFilterEventMapper(AggregateType, UserRemovedType, UserRemovedEventMapper) eventstore.RegisterFilterEventMapper(AggregateType, UserTokenAddedType, UserTokenAddedEventMapper) + eventstore.RegisterFilterEventMapper(AggregateType, UserTokenV2AddedType, eventstore.GenericEventMapper[UserTokenV2AddedEvent]) eventstore.RegisterFilterEventMapper(AggregateType, UserImpersonatedType, eventstore.GenericEventMapper[UserImpersonatedEvent]) eventstore.RegisterFilterEventMapper(AggregateType, UserTokenRemovedType, UserTokenRemovedEventMapper) eventstore.RegisterFilterEventMapper(AggregateType, UserDomainClaimedType, DomainClaimedEventMapper) diff --git a/internal/repository/user/user.go b/internal/repository/user/user.go index bb64609cd8..a736cb4d2a 100644 --- a/internal/repository/user/user.go +++ b/internal/repository/user/user.go @@ -19,6 +19,7 @@ const ( UserReactivatedType = userEventTypePrefix + "reactivated" UserRemovedType = userEventTypePrefix + "removed" UserTokenAddedType = userEventTypePrefix + "token.added" + UserTokenV2AddedType = userEventTypePrefix + "token.v2.added" UserTokenRemovedType = userEventTypePrefix + "token.removed" UserImpersonatedType = userEventTypePrefix + "impersonated" UserDomainClaimedType = userEventTypePrefix + "domain.claimed" @@ -279,6 +280,39 @@ func UserTokenAddedEventMapper(event eventstore.Event) (eventstore.Event, error) return tokenAdded, nil } +type UserTokenV2AddedEvent struct { + *eventstore.BaseEvent `json:"-"` + + TokenID string `json:"tokenId,omitempty"` +} + +func (e *UserTokenV2AddedEvent) Payload() interface{} { + return e +} + +func (e *UserTokenV2AddedEvent) SetBaseEvent(b *eventstore.BaseEvent) { + e.BaseEvent = b +} + +func (e *UserTokenV2AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint { + return nil +} + +func NewUserTokenV2AddedEvent( + ctx context.Context, + aggregate *eventstore.Aggregate, + tokenID string, +) *UserTokenV2AddedEvent { + return &UserTokenV2AddedEvent{ + BaseEvent: eventstore.NewBaseEventForPush( + ctx, + aggregate, + UserTokenV2AddedType, + ), + TokenID: tokenID, + } +} + type UserImpersonatedEvent struct { eventstore.BaseEvent `json:"-"` diff --git a/internal/static/i18n/bg.yaml b/internal/static/i18n/bg.yaml index b1ba504c26..91085035de 100644 --- a/internal/static/i18n/bg.yaml +++ b/internal/static/i18n/bg.yaml @@ -631,6 +631,7 @@ EventTypes: failed: Проверката на инициализацията е неуспешна token: added: Токенът за достъп е създаден + v2.added: Токенът за достъп е създаден removed: Токенът за достъп е премахнат impersonated: Имитиран потребител username: diff --git a/internal/static/i18n/cs.yaml b/internal/static/i18n/cs.yaml index ab303086b5..6a375443bb 100644 --- a/internal/static/i18n/cs.yaml +++ b/internal/static/i18n/cs.yaml @@ -612,6 +612,7 @@ EventTypes: failed: Kontrola inicializace selhala token: added: Přístupový token vytvořen + v2.added: Přístupový token vytvořen removed: Přístupový token odstraněn impersonated: Usuario suplantado username: diff --git a/internal/static/i18n/de.yaml b/internal/static/i18n/de.yaml index a5cfd521cd..0a1aae5d4a 100644 --- a/internal/static/i18n/de.yaml +++ b/internal/static/i18n/de.yaml @@ -614,6 +614,7 @@ EventTypes: failed: Benutzerinitialisierung fehlgeschlagen token: added: Access Token ausgestellt + v2.added: Access Token ausgestellt removed: Access Token gelöscht impersonated: Benutzer hat sich als Benutzer ausgegeben username: diff --git a/internal/static/i18n/en.yaml b/internal/static/i18n/en.yaml index fc1ef19ac0..12a7151c9a 100644 --- a/internal/static/i18n/en.yaml +++ b/internal/static/i18n/en.yaml @@ -614,6 +614,7 @@ EventTypes: failed: Initialization check failed token: added: Access Token created + v2.added: Access Token created removed: Access Token removed impersonated: User impersonated username: diff --git a/internal/static/i18n/es.yaml b/internal/static/i18n/es.yaml index fff4bf468d..5fc15409bb 100644 --- a/internal/static/i18n/es.yaml +++ b/internal/static/i18n/es.yaml @@ -614,6 +614,7 @@ EventTypes: failed: La comprobación de inicialización falló token: added: Token de acceso creado + v2.added: Token de acceso creado removed: Token de acceso eliminado impersonated: Usuario suplantado username: diff --git a/internal/static/i18n/fr.yaml b/internal/static/i18n/fr.yaml index 500d3f3225..55bff2a7ae 100644 --- a/internal/static/i18n/fr.yaml +++ b/internal/static/i18n/fr.yaml @@ -614,6 +614,7 @@ EventTypes: failed: La vérification de l'initialisation a échoué token: added: Jeton d'accès créé + v2.added: Jeton d'accès créé impersonated: Utilisateur usurpé l'identité username: reserved: Nom d'utilisateur réservé diff --git a/internal/static/i18n/it.yaml b/internal/static/i18n/it.yaml index ce1b04b982..0a1e8e76aa 100644 --- a/internal/static/i18n/it.yaml +++ b/internal/static/i18n/it.yaml @@ -614,6 +614,7 @@ EventTypes: failed: Controllo dell'inizializzazione fallito token: added: Access Token creato + v2.added: Access Token creato impersonated: Utente impersonificato username: reserved: Nome utente riservato diff --git a/internal/static/i18n/ja.yaml b/internal/static/i18n/ja.yaml index 2e980e4925..be42786b08 100644 --- a/internal/static/i18n/ja.yaml +++ b/internal/static/i18n/ja.yaml @@ -603,6 +603,7 @@ EventTypes: failed: 初期化チェックの失敗 token: added: アクセストークンの作成 + v2.added: アクセストークンの作成 removed: アクセストークンの削除 impersonated: ユーザーがなりすました username: diff --git a/internal/static/i18n/mk.yaml b/internal/static/i18n/mk.yaml index eceb252c71..826b4cc4e1 100644 --- a/internal/static/i18n/mk.yaml +++ b/internal/static/i18n/mk.yaml @@ -613,6 +613,7 @@ EventTypes: failed: Проверката на иницијализацијата е неуспешна token: added: Креиран е токен за пристап + v2.added: Креиран е токен за пристап removed: Токенот за пристап е отстранет impersonated: Корисникот имитиран username: diff --git a/internal/static/i18n/nl.yaml b/internal/static/i18n/nl.yaml index a03d9e177a..fa7c202033 100644 --- a/internal/static/i18n/nl.yaml +++ b/internal/static/i18n/nl.yaml @@ -613,6 +613,7 @@ EventTypes: failed: Initialisatiecontrole mislukt token: added: Toegangstoken aangemaakt + v2.added: Toegangstoken aangemaakt removed: Toegangstoken verwijderd impersonated: Gebruiker nagebootst username: diff --git a/internal/static/i18n/pl.yaml b/internal/static/i18n/pl.yaml index 7d54595a2f..35f73fbec7 100644 --- a/internal/static/i18n/pl.yaml +++ b/internal/static/i18n/pl.yaml @@ -614,6 +614,7 @@ EventTypes: failed: Sprawdzenie inicjujące nie powiodło się token: added: Token dostępu utworzony + v2.added: Token dostępu utworzony removed: Token dostępu usunięty impersonated: Użytkownik podszywał się pod użytkownika username: diff --git a/internal/static/i18n/pt.yaml b/internal/static/i18n/pt.yaml index 4e16036395..a9e3f4c1f6 100644 --- a/internal/static/i18n/pt.yaml +++ b/internal/static/i18n/pt.yaml @@ -609,6 +609,7 @@ EventTypes: failed: Verificação de inicialização falhou token: added: Token de acesso criado + v2.added: Token de acesso criado removed: Token de acesso removido impersonated: Usuário personificado username: diff --git a/internal/static/i18n/ru.yaml b/internal/static/i18n/ru.yaml index 5b3e46e6bd..53b95ea362 100644 --- a/internal/static/i18n/ru.yaml +++ b/internal/static/i18n/ru.yaml @@ -603,6 +603,7 @@ EventTypes: failed: Проверка инициализации не удалась token: added: Токен доступа создан + v2.added: Токен доступа создан removed: Токен доступа удалён impersonated: Пользователь олицетворяет себя username: diff --git a/internal/static/i18n/zh.yaml b/internal/static/i18n/zh.yaml index 9b6b30b14f..fd9ed9ed19 100644 --- a/internal/static/i18n/zh.yaml +++ b/internal/static/i18n/zh.yaml @@ -614,6 +614,7 @@ EventTypes: failed: 初始化检查失败 token: added: 已创建访问令牌 + v2.added: 已创建访问令牌 impersonated: 用户冒充 username: reserved: 保留用户名 From df608bcda13f9d28b8e22e9c2a2834189dc7294a Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Thu, 16 May 2024 15:27:45 +0200 Subject: [PATCH 09/35] chore(stable): update to v2.47.10 (#7960) --- release-channels.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release-channels.yaml b/release-channels.yaml index d8b29a5ab7..496ddee451 100644 --- a/release-channels.yaml +++ b/release-channels.yaml @@ -1 +1 @@ -stable: "v2.46.7" +stable: "v2.47.10" From 9e91b53bd4f80cfe622fd6be40bdb66712d955fc Mon Sep 17 00:00:00 2001 From: Dakshitha Ratnayake Date: Thu, 16 May 2024 20:23:27 +0530 Subject: [PATCH 10/35] docs:Update quickstart.mdx (#7958) [docs]Update quickstart.mdx --- docs/docs/guides/start/quickstart.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docs/guides/start/quickstart.mdx b/docs/docs/guides/start/quickstart.mdx index e0805a4a0a..e76c98bd05 100644 --- a/docs/docs/guides/start/quickstart.mdx +++ b/docs/docs/guides/start/quickstart.mdx @@ -181,7 +181,7 @@ As a user of the ZITADEL Cloud Customer Portal, you now can create multiple inst ![Add Role](/img/guides/quickstart/25.png) -### 6. Add authorizations to your project +### 6. Add authorizations to your project (optional) 1. Click on “Authorizations” on the top menu. From b924fd59a5ca8f2d1e1fa47fd8a7d3db0341b3f3 Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Fri, 17 May 2024 09:52:15 +0200 Subject: [PATCH 11/35] fix: allow sorting of MyProjectOrgs (by name) (#7970) --- internal/api/grpc/admin/org_converter.go | 12 +----------- internal/api/grpc/auth/user.go | 7 ++++--- internal/api/grpc/org/converter.go | 11 +++++++++++ internal/query/org.go | 5 +++-- proto/zitadel/auth.proto | 2 ++ 5 files changed, 21 insertions(+), 16 deletions(-) diff --git a/internal/api/grpc/admin/org_converter.go b/internal/api/grpc/admin/org_converter.go index 7f3066925e..62887cc34c 100644 --- a/internal/api/grpc/admin/org_converter.go +++ b/internal/api/grpc/admin/org_converter.go @@ -5,7 +5,6 @@ import ( org_grpc "github.com/zitadel/zitadel/internal/api/grpc/org" "github.com/zitadel/zitadel/internal/query" "github.com/zitadel/zitadel/pkg/grpc/admin" - "github.com/zitadel/zitadel/pkg/grpc/org" ) func listOrgRequestToModel(req *admin.ListOrgsRequest) (*query.OrgSearchQueries, error) { @@ -18,18 +17,9 @@ func listOrgRequestToModel(req *admin.ListOrgsRequest) (*query.OrgSearchQueries, SearchRequest: query.SearchRequest{ Offset: offset, Limit: limit, - SortingColumn: fieldNameToOrgColumn(req.SortingColumn), + SortingColumn: org_grpc.FieldNameToOrgColumn(req.SortingColumn), Asc: asc, }, Queries: queries, }, nil } - -func fieldNameToOrgColumn(fieldName org.OrgFieldName) query.Column { - switch fieldName { - case org.OrgFieldName_ORG_FIELD_NAME_NAME: - return query.OrgColumnName - default: - return query.Column{} - } -} diff --git a/internal/api/grpc/auth/user.go b/internal/api/grpc/auth/user.go index f32af2f74b..1efdbe8dd2 100644 --- a/internal/api/grpc/auth/user.go +++ b/internal/api/grpc/auth/user.go @@ -266,9 +266,10 @@ func ListMyProjectOrgsRequestToQuery(req *auth_pb.ListMyProjectOrgsRequest) (*qu } return &query.OrgSearchQueries{ SearchRequest: query.SearchRequest{ - Offset: offset, - Limit: limit, - Asc: asc, + Offset: offset, + Limit: limit, + Asc: asc, + SortingColumn: org.FieldNameToOrgColumn(req.SortingColumn), }, Queries: queries, }, nil diff --git a/internal/api/grpc/org/converter.go b/internal/api/grpc/org/converter.go index d3c3cb3c11..3f0084c978 100644 --- a/internal/api/grpc/org/converter.go +++ b/internal/api/grpc/org/converter.go @@ -186,3 +186,14 @@ func DomainValidationTypeFromModel(validationType domain.OrgDomainValidationType return org_pb.DomainValidationType_DOMAIN_VALIDATION_TYPE_UNSPECIFIED } } + +func FieldNameToOrgColumn(fieldName org_pb.OrgFieldName) query.Column { + switch fieldName { + case org_pb.OrgFieldName_ORG_FIELD_NAME_NAME: + return query.OrgColumnName + case org_pb.OrgFieldName_ORG_FIELD_NAME_UNSPECIFIED: + return query.Column{} + default: + return query.Column{} + } +} diff --git a/internal/query/org.go b/internal/query/org.go index eaeaf6eb29..18715d015e 100644 --- a/internal/query/org.go +++ b/internal/query/org.go @@ -52,8 +52,9 @@ var ( table: orgsTable, } OrgColumnName = Column{ - name: projection.OrgColumnName, - table: orgsTable, + name: projection.OrgColumnName, + table: orgsTable, + isOrderByLower: true, } OrgColumnDomain = Column{ name: projection.OrgColumnDomain, diff --git a/proto/zitadel/auth.proto b/proto/zitadel/auth.proto index 58767f9fe9..5e5dcd6fb9 100644 --- a/proto/zitadel/auth.proto +++ b/proto/zitadel/auth.proto @@ -1569,6 +1569,8 @@ message ListMyProjectOrgsRequest { zitadel.v1.ListQuery query = 1; //criteria the client is looking for repeated zitadel.org.v1.OrgQuery queries = 2; + // States by which field the results are sorted. + zitadel.org.v1.OrgFieldName sorting_column = 3; } message ListMyProjectOrgsResponse { From 6858ed7b21043db9fab877a5b641ae08cd46c637 Mon Sep 17 00:00:00 2001 From: Aurel004 Date: Fri, 17 May 2024 13:16:55 +0200 Subject: [PATCH 12/35] fix: Update fr translations (#7910) update fr translations Co-authored-by: Max Peintner --- console/src/assets/i18n/fr.json | 518 +++++++++++----------- internal/api/ui/login/static/i18n/fr.yaml | 196 ++++---- internal/notification/static/i18n/fr.yaml | 10 +- internal/static/i18n/fr.yaml | 14 +- 4 files changed, 369 insertions(+), 369 deletions(-) diff --git a/console/src/assets/i18n/fr.json b/console/src/assets/i18n/fr.json index 95cda8bd48..92d18bffce 100644 --- a/console/src/assets/i18n/fr.json +++ b/console/src/assets/i18n/fr.json @@ -3,78 +3,78 @@ "DESCRIPTIONS": { "METADATA_TITLE": "Métadonnées", "HOME": { - "TITLE": "Commence avec ZITADEL", + "TITLE": "Commencez avec ZITADEL", "NEXT": { - "TITLE": "Tes prochaines étapes", - "DESCRIPTION": "Complète les étapes suivantes pour sécuriser ton application.", + "TITLE": "Vos prochaines étapes", + "DESCRIPTION": "Complétez les étapes suivantes pour sécuriser votre application.", "CREATE_PROJECT": { "TITLE": "Créer un projet", - "DESCRIPTION": "Ajoute un projet et définis ses rôles et autorisations." + "DESCRIPTION": "Ajoutez un projet et définissez ses rôles et autorisations." } }, "MORE_SHORTCUTS": { "GET_STARTED": { "TITLE": "Commencer", - "DESCRIPTION": "Suis le guide de démarrage rapide étape par étape et commence à construire immédiatement." + "DESCRIPTION": "Suivez le guide de démarrage rapide étape par étape et commencez à construire immédiatement." }, "DOCS": { "TITLE": "Documentation", - "DESCRIPTION": "Explore la base de connaissances de ZITADEL pour te familiariser avec les concepts et idées clés. Apprends comment fonctionne ZITADEL et comment l'utiliser." + "DESCRIPTION": "Explorez la base de connaissances de ZITADEL pour vous familiariser avec les concepts et idées clés. Apprennez comment fonctionne ZITADEL et comment l'utiliser." }, "EXAMPLES": { "TITLE": "Exemples et Kits de Développement Logiciel", - "DESCRIPTION": "Parcours nos exemples et SDKs pour utiliser ZITADEL avec tes langages de programmation et outils préférés." + "DESCRIPTION": "Parcourez nos exemples et SDKs pour utiliser ZITADEL avec vos langages de programmation et outils préférés." } } }, "ORG": { "TITLE": "Organisation", - "DESCRIPTION": "Une organisation héberge des utilisateurs, des projets avec des applications, des fournisseurs d'identité et des paramètres comme le branding de l'entreprise. Tu veux partager des paramètres à travers plusieurs organisations ? Configure les paramètres par défaut.", - "METADATA": "Ajoute des attributs personnalisés à l'organisation comme son emplacement ou un identifiant dans un autre système. Tu peux utiliser cette information dans tes actions." + "DESCRIPTION": "Une organisation héberge des utilisateurs, des projets avec des applications, des fournisseurs d'identité et des paramètres comme le branding de l'entreprise. Voulez-vous partager des paramètres à travers plusieurs organisations ? Configurez les paramètres par défaut.", + "METADATA": "Ajoutez des attributs personnalisés à l'organisation comme son emplacement ou un identifiant dans un autre système. Vous pouvez utiliser cette information dans vos actions." }, "PROJECTS": { "TITLE": "Projets", - "DESCRIPTION": "Un projet héberge une ou plusieurs applications, que tu peux utiliser pour authentifier tes utilisateurs. Tu peux également autoriser tes utilisateurs avec des projets. Pour permettre aux utilisateurs d'autres organisations de se connecter à tes applications, accorde-leur l'accès à ton projet.

Si tu ne trouves pas un projet, contacte le propriétaire du projet ou quelqu'un avec les droits correspondants pour obtenir l'accès.", + "DESCRIPTION": "Un projet héberge une ou plusieurs applications, que vous pouvez utiliser pour authentifier vos utilisateurs. Vous pouvez également autoriser vos utilisateurs avec des projets. Pour permettre aux utilisateurs d'autres organisations de se connecter à vos applications, accordez-leur l'accès à votre projet.

Si vous ne trouvez pas un projet, contactez le propriétaire du projet ou quelqu'un avec les droits correspondants pour obtenir l'accès.", "OWNED": { "TITLE": "Projets Possédés", - "DESCRIPTION": "Ce sont les projets que tu possèdes. Tu peux gérer les paramètres de ces projets, les autorisations et les applications." + "DESCRIPTION": "Ce sont les projets que vous possédez. Vous pouvez gérer les paramètres de ces projets, les autorisations et les applications." }, "GRANTED": { - "TITLE": "Projets Accordés", - "DESCRIPTION": "Ce sont les projets que d'autres organisations t'ont accordés. Avec les projets accordés, tu peux donner à tes utilisateurs l'accès aux applications d'autres organisations." + "TITLE": "Projets Octroyés", + "DESCRIPTION": "Ce sont les projets que d'autres organisations vous ont octroyés. Avec les projets octroyés, vous pouvez donner à vos utilisateurs l'accès aux applications d'autres organisations." } }, "USERS": { "TITLE": "Utilisateurs", - "DESCRIPTION": "Un utilisateur est un humain ou une machine qui peut accéder à tes applications.", + "DESCRIPTION": "Un utilisateur est un humain ou une machine qui peut accéder à vos applications.", "HUMANS": { - "TITLE": "utilisateurs", + "TITLE": "Utilisateurs", "DESCRIPTION": "Les utilisateurs s'authentifient de manière interactive dans une session de navigateur avec une invite de connexion.", - "METADATA": "Ajoute des attributs personnalisés à l'utilisateur comme le département. Tu peux utiliser cette information dans tes actions." + "METADATA": "Ajoutez des attributs personnalisés à l'utilisateur comme le département. Vous pouvez utiliser cette information dans vos actions." }, "MACHINES": { "TITLE": "Utilisateurs des services", "DESCRIPTION": "Les utilisateurs des services s'authentifient de manière non interactive en utilisant un token porteur JWT signé avec une clé privée. Elles peuvent également utiliser un token d'accès personnel.", - "METADATA": "Ajoute des attributs personnalisés à l'utilisateur comme le système d'authentification. Tu peux utiliser cette information dans tes actions." + "METADATA": "Ajoute des attributs personnalisés à l'utilisateur comme le système d'authentification. Vous pouvez utiliser cette information dans vos actions." }, "SELF": { - "METADATA": "Ajoute des attributs personnalisés à ton utilisateur comme ton département. Tu peux utiliser cette information dans les actions de ton organisation." + "METADATA": "Ajoutez des attributs personnalisés à votre utilisateur comme votre département. Vous pouvez utiliser cette information dans les actions de votre organisation." } }, "AUTHORIZATIONS": { "TITLE": "Autorisations", - "DESCRIPTION": "Les autorisations définissent les droits d'accès d'un utilisateur à un projet. Tu peux accorder à un utilisateur l'accès à un projet et définir les rôles de l'utilisateur au sein de ce projet." + "DESCRIPTION": "Les autorisations définissent les droits d'accès d'un utilisateur à un projet. Vous pouvez octroyer à un utilisateur l'accès à un projet et définir les rôles de l'utilisateur au sein de ce projet." }, "ACTIONS": { "TITLE": "Actions", - "DESCRIPTION": "Exécute du code personnalisé sur des événements qui se produisent lorsque tes utilisateurs s'authentifient chez ZITADEL. Automatise tes processus, enrichis les métadonnées de tes utilisateurs et leurs tokens ou notifie des systèmes externes.", + "DESCRIPTION": "Exécutez du code personnalisé sur des événements qui se produisent lorsque vos utilisateurs s'authentifient chez ZITADEL. Automatisez vos processus, enrichissez les métadonnées de vos utilisateurs et leurs tokens ou notifiez des systèmes externes.", "SCRIPTS": { "TITLE": "Scripts", - "DESCRIPTION": "Écris ton code JavaScript une fois et déclenche-le dans plusieurs flux." + "DESCRIPTION": "Écrivez votre code JavaScript une fois et déclenchez-le dans plusieurs flux." }, "FLOWS": { "TITLE": "Flux", - "DESCRIPTION": "Choisis un flux d'authentification et déclenche ton action sur un événement spécifique dans ce flux." + "DESCRIPTION": "Choisissez un flux d'authentification et déclenchez votre action sur un événement spécifique dans ce flux." } }, "SETTINGS": { @@ -84,7 +84,7 @@ }, "ORG": { "TITLE": "Paramètres de l'Organisation", - "DESCRIPTION": "Personnalise les paramètres de ton organisation." + "DESCRIPTION": "Personnalisez les paramètres de votre organisation." }, "FEATURES": { "TITLE": "Paramètres des fonctionnalités", @@ -92,7 +92,7 @@ }, "IDPS": { "TITLE": "Fournisseurs d'Identité", - "DESCRIPTION": "Crée et active des fournisseurs d'identité externes. Choisis un fournisseur bien connu ou configure tout autre fournisseur compatible OIDC, OAuth ou SAML de ton choix. Tu peux même utiliser tes tokens JWT existants comme identités fédérées en configurant un fournisseur d'identité JWT.", + "DESCRIPTION": "Créez et activez des fournisseurs d'identité externes. Choisissez un fournisseur bien connu ou configurez tout autre fournisseur compatible OIDC, OAuth ou SAML de votre choix. Vous pouvez même utiliser vos tokens JWT existants comme identités fédérées en configurant un fournisseur d'identité JWT.", "NEXT": "Et maintenant ?", "SAML": { "TITLE": "Configurez votre fournisseur d'identité SAML", @@ -121,11 +121,11 @@ }, "PW_COMPLEXITY": { "TITLE": "Complexité du Mot de Passe", - "DESCRIPTION": "Assure-toi que tes utilisateurs utilisent des mots de passe forts en définissant des règles de complexité." + "DESCRIPTION": "Assurez-vous que vos utilisateurs utilisent des mots de passe forts en définissant des règles de complexité." }, "BRANDING": { "TITLE": "Branding", - "DESCRIPTION": "Personnalise l'apparence de ton formulaire de connexion. N'oublie pas d'appliquer ta configuration lorsque tu as terminé." + "DESCRIPTION": "Personnalisez l'apparence de votre formulaire de connexion. N'oubliez pas d'appliquer votre configuration lorsque vous avez terminé." }, "PRIVACY_POLICY": { "TITLE": "Liens Externes", @@ -133,44 +133,44 @@ }, "SMTP_PROVIDER": { "TITLE": "Paramètres SMTP", - "DESCRIPTION": "Configure ton serveur SMTP pour utiliser un domaine pour l'adresse de l'expéditeur que tes utilisateurs connaissent et en qui ils ont confiance." + "DESCRIPTION": "Configurez votre serveur SMTP pour utiliser un domaine pour l'adresse de l'expéditeur que vos utilisateurs connaissent et en qui ils ont confiance." }, "SMS_PROVIDER": { "TITLE": "Paramètres SMS", - "DESCRIPTION": "Pour débloquer toutes les fonctionnalités de ZITADEL, configure Twilio pour envoyer des messages SMS à tes utilisateurs." + "DESCRIPTION": "Pour débloquer toutes les fonctionnalités de ZITADEL, configurez Twilio pour envoyer des messages SMS à vos utilisateurs." }, "IAM_EVENTS": { "TITLE": "Événements", - "DESCRIPTION": "Cette page montre tous les changements d'état dans ton instance aussi loin que la limite de piste d'audit de tes instances. Filtre la liste par plage de temps à des fins de débogage ou filtre-la par un agrégat à des fins d'audit." + "DESCRIPTION": "Cette page montre tous les changements d'état dans votre instance aussi loin que la limite de piste d'audit de vos instances. Filtrez la liste par plage de temps à des fins de débogage ou filtrez-la par un agrégat à des fins d'audit." }, "IAM_FAILED_EVENTS": { "TITLE": "Événements Échoués", - "DESCRIPTION": "Cette page montre tous les événements échoués dans ton instance. Si ZITADEL ne se comporte pas comme tu l'attends, vérifie toujours cette liste en premier." + "DESCRIPTION": "Cette page montre tous les événements échoués dans votre instance. Si ZITADEL ne se comporte pas comme vous l'attendez, vérifiez toujours cette liste en premier." }, "IAM_VIEWS": { "TITLE": "Vues", - "DESCRIPTION": "Cette page montre toutes tes vues de base de données et quand elles ont traité leur dernier événement. Si des données te manquent, vérifie si la vue est à jour." + "DESCRIPTION": "Cette page montre toutes vos vues de base de données et quand elles ont traité leur dernier événement. Si des données vous manquent, vérifiez si la vue est à jour." }, "LANGUAGES": { "TITLE": "Langues", - "DESCRIPTION": "Restreins les langues dans lesquelles le formulaire de connexion et les messages de notification sont traduits. Si tu souhaites désactiver certaines langues, déplace-les vers la section Langues Non Autorisées. Tu peux spécifier une langue autorisée comme langue par défaut. Si la langue préférée d'un utilisateur n'est pas autorisée, la langue par défaut est utilisée." + "DESCRIPTION": "Restreignez les langues dans lesquelles le formulaire de connexion et les messages de notification sont traduits. Si vous souhaitez désactiver certaines langues, déplacez-les vers la section Langues Non Autorisées. Vous pouvez spécifier une langue autorisée comme langue par défaut. Si la langue préférée d'un utilisateur n'est pas autorisée, la langue par défaut est utilisée." }, "SECRET_GENERATORS": { "TITLE": "Générateurs de Secret", - "DESCRIPTION": "Définis la complexité et la durée de vie de tes secrets. Une complexité et une durée de vie plus élevées améliorent la sécurité, une complexité et une durée de vie plus faibles améliorent la performance de déchiffrement." + "DESCRIPTION": "Définissez la complexité et la durée de vie de vos secrets. Une complexité et une durée de vie plus élevées améliorent la sécurité, une complexité et une durée de vie plus faibles améliorent la performance de déchiffrement." }, "SECURITY": { "TITLE": "Paramètres de Sécurité", - "DESCRIPTION": "Active les fonctionnalités de ZITADEL qui peuvent avoir des impacts sur la sécurité. Tu devrais vraiment savoir ce que tu fais avant de changer ces paramètres." + "DESCRIPTION": "Activez les fonctionnalités de ZITADEL qui peuvent avoir des impacts sur la sécurité. Vous devriez vraiment savoir ce que vous faites avant de changer ces paramètres." }, "OIDC": { "TITLE": "Paramètres OpenID Connect", - "DESCRIPTION": "Configure la durée de vie de tes tokens OIDC. Utilise des durées plus courtes pour augmenter la sécurité de tes utilisateurs, utilise des durées plus longues pour augmenter leur commodité.", + "DESCRIPTION": "Configurez la durée de vie de vos tokens OIDC. Utilisez des durées plus courtes pour augmenter la sécurité de vos utilisateurs, utilisez des durées plus longues pour augmenter leur commodité.", "LABEL_HOURS": "Durée de vie maximale en heures", "LABEL_DAYS": "Durée de vie maximale en jours", "ACCESS_TOKEN": { "TITLE": "Token d'Accès", - "DESCRIPTION": "Le token d'accès est utilisé pour authentifier un utilisateur. C'est un token de courte durée qui est utilisé pour accéder aux données de l'utilisateur. Utilise une courte durée de vie pour minimiser le risque d'accès non autorisé. Les tokens d'accès peuvent être automatiquement rafraîchis en utilisant un token de rafraîchissement." + "DESCRIPTION": "Le token d'accès est utilisé pour authentifier un utilisateur. C'est un token de courte durée qui est utilisé pour accéder aux données de l'utilisateur. Utilisez une courte durée de vie pour minimiser le risque d'accès non autorisé. Les tokens d'accès peuvent être automatiquement rafraîchis en utilisant un token de rafraîchissement." }, "ID_TOKEN": { "TITLE": "Token ID", @@ -187,107 +187,107 @@ }, "MESSAGE_TEXTS": { "TITLE": "Textes des Messages", - "DESCRIPTION": "Personnalise les textes de tes emails de notification ou messages SMS. Si tu souhaites désactiver certaines langues, restreins-les dans les paramètres de langue de tes instances.", + "DESCRIPTION": "Personnalisez les textes de vos e-mails de notification ou messages SMS. Si vous souhaitez désactiver certaines langues, restreignez-les dans les paramètres de langue de vos instances.", "TYPE_DESCRIPTIONS": { - "DC": "Lorsque tu revendiques un domaine pour ton organisation, les utilisateurs qui n'utilisent pas ce domaine dans leur nom de connexion seront invités à changer leur nom de connexion pour correspondre au domaine revendiqué.", - "INIT": "Lorsqu'un utilisateur est créé, il recevra un email avec un lien pour définir son mot de passe.", - "PC": "Lorsqu'un utilisateur change son mot de passe, il recevra une notification sur le changement si tu as activé cela dans les paramètres de notification.", - "PL": "Lorsqu'un utilisateur ajoute une méthode d'authentification sans mot de passe, il doit l'activer en cliquant sur un lien dans un email.", - "PR": "Lorsqu'un utilisateur réinitialise son mot de passe, il recevra un email avec un lien pour définir un nouveau mot de passe.", - "VE": "Lorsqu'un utilisateur change son adresse email, il recevra un email avec un lien pour vérifier la nouvelle adresse.", + "DC": "Lorsque vous revendiquez un domaine pour votre organisation, les utilisateurs qui n'utilisent pas ce domaine dans leur nom de connexion seront invités à changer leur nom de connexion pour correspondre au domaine revendiqué.", + "INIT": "Lorsqu'un utilisateur est créé, il recevra un e-mail avec un lien pour définir son mot de passe.", + "PC": "Lorsqu'un utilisateur change son mot de passe, il recevra une notification sur le changement si vous avez activé cela dans les paramètres de notification.", + "PL": "Lorsqu'un utilisateur ajoute une méthode d'authentification sans mot de passe, il doit l'activer en cliquant sur un lien dans un e-mail.", + "PR": "Lorsqu'un utilisateur réinitialise son mot de passe, il recevra un e-mail avec un lien pour définir un nouveau mot de passe.", + "VE": "Lorsqu'un utilisateur change son adresse e-mail, il recevra un e-mail avec un lien pour vérifier la nouvelle adresse.", "VP": "Lorsqu'un utilisateur change son numéro de téléphone, il recevra un SMS avec un code pour vérifier le nouveau numéro.", - "VEO": "Lorsqu'un utilisateur ajoute un Mot de Passe à Usage Unique via email, il doit l'activer en entrant un code envoyé à son adresse email.", + "VEO": "Lorsqu'un utilisateur ajoute un Mot de Passe à Usage Unique via e-mail, il doit l'activer en entrant un code envoyé à son adresse e-mail.", "VSO": "Lorsqu'un utilisateur ajoute un Mot de Passe à Usage Unique via SMS, il doit l'activer en entrant un code envoyé à son numéro de téléphone." } }, "LOGIN_TEXTS": { "TITLE": "Textes de l'Interface de Connexion", - "DESCRIPTION": "Personnalise les textes de ton formulaire de connexion. Si un texte est vide, le placeholder montre la valeur par défaut. Si tu souhaites désactiver certaines langues, restreins-les dans les paramètres de langue de tes instances." + "DESCRIPTION": "Personnalisez les textes de votre formulaire de connexion. Si un texte est vide, le placeholder montre la valeur par défaut. Si vous souhaitez désactiver certaines langues, restreignez-les dans les paramètres de langue de vos instances." }, "DOMAINS": { "TITLE": "Paramètres de Domaine", - "DESCRIPTION": "Définis des restrictions sur tes domaines et configure les modèles de nom de connexion.", + "DESCRIPTION": "Définissez des restrictions sur vos domaines et configurez les modèles de nom de connexion.", "REQUIRE_VERIFICATION": { "TITLE": "Exiger que les domaines personnalisés soient vérifiés", "DESCRIPTION": "Si cela est activé, les domaines de l'organisation doivent être vérifiés avant qu'ils puissent être utilisés pour la découverte de domaine ou le suffixage de nom d'utilisateur." }, "LOGIN_NAME_PATTERN": { "TITLE": "Modèle de Nom de Connexion", - "DESCRIPTION": "Contrôle le modèle des noms de connexion de tes utilisateurs. ZITADEL sélectionne l'organisation de tes utilisateurs dès qu'ils entrent leur nom de connexion. Par conséquent, les noms de connexion doivent être uniques dans toutes les organisations. Si tu as des utilisateurs qui ont un compte dans plusieurs domaines, tu peux assurer l'unicité en suffixant tes noms de connexion avec le domaine de l'organisation." + "DESCRIPTION": "Contrôlez le modèle des noms de connexion de vos utilisateurs. ZITADEL sélectionne l'organisation de vos utilisateurs dès qu'ils entrent leur nom de connexion. Par conséquent, les noms de connexion doivent être uniques dans toutes les organisations. Si vous avez des utilisateurs qui ont un compte dans plusieurs domaines, vous pouvez assurer l'unicité en suffixant vos noms de connexion avec le domaine de l'organisation." }, "DOMAIN_VERIFICATION": { "TITLE": "Vérification de Domaine", - "DESCRIPTION": "Permet uniquement à ton organisation d'utiliser les domaines qu'elle contrôle réellement. Si activé, les domaines de l'organisation sont vérifiés périodiquement par DNS ou défi HTTP avant qu'ils puissent être utilisés. C'est une fonctionnalité de sécurité pour prévenir le détournement de domaine." + "DESCRIPTION": "Permet uniquement à votre organisation d'utiliser les domaines qu'elle contrôle réellement. Si activé, les domaines de l'organisation sont vérifiés périodiquement par DNS ou défi HTTP avant qu'ils puissent être utilisés. C'est une fonctionnalité de sécurité pour prévenir le détournement de domaine." }, "SMTP_SENDER_ADDRESS": { "TITLE": "Adresse de l'Expéditeur SMTP", - "DESCRIPTION": "Permet uniquement une adresse de l'expéditeur SMTP si elle correspond à l'un de tes domaines d'instance." + "DESCRIPTION": "Permet uniquement une adresse de l'expéditeur SMTP si elle correspond à l'un de vos domaines d'instance." } }, "LOGIN": { "LIFETIMES": { "TITLE": "Durées de Vie de Connexion", - "DESCRIPTION": "Renforce ta sécurité en réduisant certaines durées de vie maximales liées à la connexion.", + "DESCRIPTION": "Renforcez votre sécurité en réduisant certaines durées de vie maximales liées à la connexion.", "LABEL": "Durée de vie maximale en heures", "PW_CHECK": { "TITLE": "Vérification de Mot de Passe", - "DESCRIPTION": "Tes utilisateurs doivent changer leurs mots de passe pendant ces périodes." + "DESCRIPTION": "Vos utilisateurs doivent changer leurs mots de passe pendant ces périodes." }, "EXT_LOGIN_CHECK": { "TITLE": "Vérification de Connexion Externe", - "DESCRIPTION": "Tes utilisateurs sont redirigés vers leurs fournisseurs d'identité externes pendant ces périodes." + "DESCRIPTION": "Vos utilisateurs sont redirigés vers leurs fournisseurs d'identité externes pendant ces périodes." }, "MULTI_FACTOR_INIT": { "TITLE": "Vérification d'Initiation Multifacteur", - "DESCRIPTION": "Il sera demandé à tes utilisateurs de configurer un second facteur ou un Multifacteur pendant ces périodes, s'ils ne l'ont pas déjà fait. Une durée de vie de 0 désactive cette invite." + "DESCRIPTION": "Il sera demandé à vos utilisateurs de configurer un second facteur ou un Multifacteur pendant ces périodes, s'ils ne l'ont pas déjà fait. Une durée de vie de 0 désactive cette demande." }, "SECOND_FACTOR_CHECK": { "TITLE": "Vérification du Second Facteur", - "DESCRIPTION": "Tes utilisateurs doivent revalider leur second facteur pendant ces périodes." + "DESCRIPTION": "Vos utilisateurs doivent re-valider leur second facteur pendant ces périodes." }, "MULTI_FACTOR_CHECK": { "TITLE": "Vérification Multifacteur", - "DESCRIPTION": "Tes utilisateurs doivent revalider leur Multifacteur pendant ces périodes." + "DESCRIPTION": "Vos utilisateurs doivent re-valider leur Multifacteur pendant ces périodes." } }, "FORM": { - "TITLE": "Login Form", - "DESCRIPTION": "Customize the login form.", + "TITLE": "Formulaire de connexion", + "DESCRIPTION": "Personnalisez le formulaire de connexion", "USERNAME_PASSWORD_ALLOWED": { - "TITLE": "Username and Password allowed", - "DESCRIPTION": "Allow your users to log in with their username and password. If this is deactivated, your users can only log in using passwordless authentication or with an external identity provider." + "TITLE": "Nom d'utilisateur et mot de passe autorisés", + "DESCRIPTION": "Autorisez vos utilisateurs à se connecter avec leur nom d'utilisateur et mot de passe. Si désactivé, vos utilisateurs pourront uniquement se connecter avec une méthode d'authentification sans mot de passe ou avec un fournisseur d'identité externe" }, "USER_REGISTRATION_ALLOWED": { - "TITLE": "User Registration allowed", - "DESCRIPTION": "Allow anonymous users to create an account." + "TITLE": "Enregistrement de nouveaux utilisateurs autorisé", + "DESCRIPTION": "Autorisez des utilisateurs anonymes à s'enregistrer." }, "ORG_REGISTRATION_ALLOWED": { - "TITLE": "Organization Registration allowed", - "DESCRIPTION": "Allow anonymous users to create an organization." + "TITLE": "Enregistrement de nouvelles organisations autorisé", + "DESCRIPTION": "Autorisez des utilisateurs anonymes à créer une organisation." }, "EXTERNAL_LOGIN_ALLOWED": { - "TITLE": "External Login allowed", - "DESCRIPTION": "Allow your users to log in with an external identity provider instead of using the ZITADEL user to log in." + "TITLE": "Connexion externe autorisée", + "DESCRIPTION": "Autorisez vos utilisateurs à se connecter avec un fournisseur d'identité externe à la place de la connexion avec le nom d'utilisateur ZITADEL." }, "HIDE_PASSWORD_RESET": { "TITLE": "Réinitialisation du mot de passe masquée", "DESCRIPTION": "Ne permettez pas à vos utilisateurs de réinitialiser leur mot de passe." }, "DOMAIN_DISCOVERY_ALLOWED": { - "TITLE": "Domain Discovery allowed", - "DESCRIPTION": "Find your users organizations depending on their login names domain, for example their email address." + "TITLE": "Découverte du domaine autorisée", + "DESCRIPTION": "Trouvez les organisations de vos utilisateurs en fonction de leur nom de domaine de connexion, par exemple leur adresse e-mail." }, "IGNORE_UNKNOWN_USERNAMES": { - "TITLE": "Ignore unknown Usernames", - "DESCRIPTION": "If this is activated, the login form will not show an error message if the username is unknown. This helps to prevent username guessing." + "TITLE": "Ignorer les nom d'utilisateurs inconnus", + "DESCRIPTION": "Si activé, le formulaire de connexion n'affichera pas un message d'erreur si le nom d'utilisateur est inconnu. Cela permet d'éviter de deviner les noms d'utilisateurs." }, "DISABLE_EMAIL_LOGIN": { - "TITLE": "Disable Email Login", - "DESCRIPTION": "If this is activated, your users can't use their email addresses to log in. Beware that if you deactivate this, your users email addresses must be unique accross all organizations in order to log in." + "TITLE": "Désactiver la connexion par e-mail", + "DESCRIPTION": "Si activé, vos utilisateurs ne pourront pas utiliser leur adresse e-mail pour se connecter. Veuillez noter que si vous le désactivez, les adresses e-mails de vos utilisateurs devront être uniques à travers toutes les organisations afin de pouvoir se connecter." }, "DISABLE_PHONE_LOGIN": { - "TITLE": "Disable Phone Login", - "DESCRIPTION": "If this is activated, your users can't use their phone numbers to log in. Beware that if you deactivate this, your users phone numbers must be unique accross all organizations in order to log in." + "TITLE": "Désactiver la connexion par numéro de téléphone", + "DESCRIPTION": "Si activé, vos utilisateurs ne pourront pas utiliser leur numéro de téléphone pour se connecter. Veuillez noter que si vous le désactivez, les numéros de téléphone devront être uniques à travers toutes les organisations afin de pouvoir se connecter." } } } @@ -297,7 +297,7 @@ "PREVIOUS": "Précédent", "NEXT": "Suivant", "COUNT": "Résultats totaux", - "MORE": "plus" + "MORE": "Plus" }, "FOOTER": { "LINKS": { @@ -336,7 +336,7 @@ "DESCRIPTION": "Votre processus d'intégration", "MOREDESCRIPTION": "plus de raccourcis", "COMPLETED": "terminé", - "DISMISS": "fermer", + "DISMISS": "Passer", "CARD": { "TITLE": "Faites fonctionner votre ZITADEL", "DESCRIPTION": "Cette liste de contrôle vous aide à configurer votre instance et vous guide à travers les étapes les plus essentielles." @@ -345,22 +345,22 @@ "instance.policy.label.added": { "title": "Créez votre marque", "description": "Définissez la couleur et la forme de votre connexion et téléchargez votre logo et vos icônes.", - "action": "Définissez" + "action": "Configurez votre marque" }, "instance.smtp.config.added": { - "title": "Configurez paramètres SMTP", - "description": "Définissez paramètres de serveur de messagerie", - "action": "Configurez" + "title": "Configurez les paramètres SMTP", + "description": "Définissez les paramètres de serveur de messagerie", + "action": "Configurez le SMTP" }, "PROJECT_CREATED": { - "title": "Créez projet", - "description": "Ajoutez projet et définissez ses rôles et autorisations.", - "action": "Créez projet" + "title": "Créez un projet", + "description": "Ajoutez un projet et définissez ses rôles et autorisations.", + "action": "Créez un projet" }, "APPLICATION_CREATED": { - "title": "Enregistrez votre application", - "description": "Enregistrez votre application web, native, api ou saml et configurez un flux d'authentification.", - "action": "Enregistrez l'application" + "title": "Créez votre application", + "description": "Créez votre application web, native, api ou saml et configurez un flux d'authentification.", + "action": "Créez l'application" }, "AUTHENTICATION_SUCCEEDED_ON_APPLICATION": { "title": "Connectez-vous à votre application", @@ -369,18 +369,18 @@ }, "user.human.added": { "title": "Ajouter des utilisateurs", - "description": "Ajouter les utilisateurs de application", - "action": "Ajuter utilisateur" + "description": "Ajoutez les utilisateurs de l'application", + "action": "Ajoutez un utilisateur" }, "user.grant.added": { - "title": "Utilisateurs de subventions", + "title": "Octroyer des droits", "description": "Autorisez les utilisateurs à accéder à votre application et définissez leur rôle.", - "action": "Autorisez" + "action": "Accordez des droits à un utilisateur" } } }, "MENU": { - "INSTANCE": "paramètres par défaut", + "INSTANCE": "Paramètres par défaut", "DASHBOARD": "Accueil", "PERSONAL_INFO": "Informations personnelles", "DOCUMENTATION": "Documentation", @@ -392,9 +392,9 @@ "ORGANIZATION": "Organisation", "PROJECT": "Projets", "PROJECTOVERVIEW": "Vue d'ensemble", - "PROJECTGRANTS": "Subventions", + "PROJECTGRANTS": "Droits", "ROLES": "Rôles", - "GRANTEDPROJECT": "Projets accordés", + "GRANTEDPROJECT": "Projets octroyés", "HUMANUSERS": "Utilisateurs", "MACHINEUSERS": "Utilisateurs de services", "LOGOUT": "Déconnexion de tous les utilisateurs", @@ -407,19 +407,19 @@ "TOS": "Conditions de service", "OPENSHORTCUTSTOOLTIP": "Tapez ? pour afficher les raccourcis clavier", "SETTINGS": "Paramètres", - "CUSTOMERPORTAL": "Customer Portal" + "CUSTOMERPORTAL": "Portail Client" }, "QUICKSTART": { "TITLE": "Intégrer ZITADEL dans votre application", - "DESCRIPTION": "Intégrez ZITADEL dans votre application ou utilisez l'un de nos échantillons pour démarrer en quelques minutes", + "DESCRIPTION": "Intégrez ZITADEL dans votre application ou utilisez l'un de nos échantillons pour démarrer en quelques minutes.", "BTN_START": "Créer une application", "BTN_LEARNMORE": "En savoir plus", "CREATEPROJECTFORAPP": "Créer un projet {{value}}", - "SELECT_FRAMEWORK": "Select Framework", + "SELECT_FRAMEWORK": "Sélectionner un framework", "FRAMEWORK": "Framework", "FRAMEWORK_OTHER": "Autre (OIDC, SAML, API)", "ALMOSTDONE": "Vous avez presque terminé", - "REVIEWCONFIGURATION": "Review Configuration", + "REVIEWCONFIGURATION": "Aperçu de la configuration", "REVIEWCONFIGURATION_DESCRIPTION": "Nous avons créé une configuration de base pour les applications {{value}}. Vous pouvez adapter cette configuration à vos besoins après sa création.", "REDIRECTS": "Configurer les redirections", "DEVMODEWARN": "Le mode développement est activé par défaut. Vous pouvez mettre à jour les valeurs pour la production ultérieurement.", @@ -428,7 +428,7 @@ "DUPLICATEAPPRENAME": "Une application avec ce nom existe déjà. Veuillez choisir un autre nom.", "DIALOG": { "CHANGE": { - "TITLE": "Cadre de changement", + "TITLE": "Modifier le framework", "DESCRIPTION": "Choisissez l'un des frameworks disponibles pour une configuration rapide de votre application." } } @@ -441,8 +441,8 @@ "COPY": "Copier dans le presse-papiers", "COPIED": "Copié dans le presse-papiers.", "RESET": "Réinitialiser", - "RESETDEFAULT": "Réinitialiser par défaut", - "RESETTO": "Réinitialiser à", + "RESETDEFAULT": "Réinitialiser à la valeur par défaut", + "RESETTO": "Réinitialiser à : ", "RESETCURRENT": "Réinitialiser à la valeur actuelle", "SHOW": "Afficher", "HIDE": "Cacher", @@ -459,7 +459,7 @@ "CANCEL": "Annuler", "INFO": "Info", "OK": "OK", - "SELECT": "Sélectionnez", + "SELECT": "Sélectionner", "VIEW": "Afficher", "SELECTIONDELETE": "Supprimer la sélection", "DELETE": "Supprimer", @@ -474,7 +474,7 @@ "REFRESH": "Rafraîchir", "LOGIN": "Connexion", "EDIT": "Modifier", - "PIN": "Pin / Unpin", + "PIN": "Épingler / Désépingler", "CONFIGURE": "Configurer", "SEND": "Envoyer", "NEWVALUE": "Nouvelle valeur", @@ -483,18 +483,18 @@ "OF": "de", "PREVIOUS": "Précédent", "NEXT": "Suivant", - "MORE": "plus", + "MORE": "Plus", "STEP": "Étape", "UNSAVEDCHANGES": "Modifications non enregistrées", "UNSAVED": { "DIALOG": { "DESCRIPTION": "Voulez-vous vraiment annuler cette nouvelle action ? Votre action sera perdue", "CANCEL": "Annuler", - "DISCARD": "Jeter" + "DISCARD": "Abandonner" } }, "TABLE": { - "SHOWUSER": "Afficher l'utilisateur{{value}}" + "SHOWUSER": "Afficher l'utilisateur {{value}}" }, "DOWNLOAD": "Télécharger" }, @@ -508,17 +508,17 @@ "ORG_OWNER": "A le droit de contrôler l'ensemble de l'organisation", "ORG_USER_MANAGER": "A le droit de créer et de gérer les utilisateurs de l'organisation", "ORG_OWNER_VIEWER": "A le droit de passer en revue l'ensemble de l'organisation", - "ORG_USER_PERMISSION_EDITOR": "A le droit de gérer les subventions aux utilisateurs", - "ORG_PROJECT_PERMISSION_EDITOR": "A le droit de gérer les subventions aux projets", + "ORG_USER_PERMISSION_EDITOR": "A le droit d'octroyer des droits aux utilisateurs", + "ORG_PROJECT_PERMISSION_EDITOR": "A le droit d'octroyer des droits aux projets", "ORG_PROJECT_CREATOR": "A le droit de créer ses propres projets et leurs paramètres sous-jacents.", "ORG_ADMIN_IMPERSONATOR": "A l'autorisation de se faire passer pour l'administrateur et les utilisateurs finaux de l'organisation", "ORG_END_USER_IMPERSONATOR": "Est autorisé à usurper l'identité des utilisateurs finaux de l'organisation", "PROJECT_OWNER": "A le droit de gérer l'ensemble du projet", "PROJECT_OWNER_VIEWER": "A le droit de passer en revue l'ensemble du projet", "PROJECT_OWNER_GLOBAL": "A le droit d'accéder à l'ensemble du projet", - "PROJECT_OWNER_VIEWER_GLOBAL": "A le droit de réviser l'ensemble du projet", - "PROJECT_GRANT_OWNER": "A le droit de gérer la subvention du projet", - "PROJECT_GRANT_OWNER_VIEWER": "A le droit de réviser la subvention du projet" + "PROJECT_OWNER_VIEWER_GLOBAL": "A le droit de passer en revue l'ensemble du projet", + "PROJECT_GRANT_OWNER": "A le droit de gérer les autorisations du projet", + "PROJECT_GRANT_OWNER_VIEWER": "A le droit de passer en revue les autorisations du projet" }, "OVERLAYS": { "ORGSWITCHER": { @@ -537,7 +537,7 @@ "TEXT": "Attention ! Le contexte de l'organisation a changé." }, "SWITCHEDTOINSTANCE": { - "TEXT": "La vue vient de changer en instance !" + "TEXT": "La vue vient de changer en instance !" } }, "FILTER": { @@ -562,9 +562,9 @@ "SIDEWIDE": "Raccourcis pour l'ensemble du site", "SHORTCUTS": { "HOME": "Aller à Accueil", - "INSTANCE": "Vers l'aperçu des instances", + "INSTANCE": "Aller dans l'aperçu des instances", "ORG": "Aller à Organisation", - "ORGSETTINGS": "Vers les paramètres de l'organisation", + "ORGSETTINGS": "Aller dans les paramètres de l'organisation", "ORGSWITCHER": "Modifier l'organisation", "ME": "Aller à son propre profil", "PROJECTS": "Aller à Projets", @@ -581,7 +581,7 @@ "NOROWS": "Pas de données" }, "ERRORS": { - "REQUIRED": "Remplis ce champ s'il te plaît.", + "REQUIRED": "Merci de remplir ce champ.", "ATLEASTONE": "Indiquez au moins une valeur.", "TOKENINVALID": { "TITLE": "Votre jeton d'autorisation a expiré.", @@ -591,8 +591,8 @@ "TITLE": "Votre instance est bloquée.", "DESCRIPTION": "Demandez à votre administrateur d'instance ZITADEL de mettre à jour l'abonnement." }, - "INVALID_FORMAT": "Le format n'est pas valide", - "NOTANEMAIL": "La valeur donnée n'est pas une adresse e-mail", + "INVALID_FORMAT": "Le format n'est pas valide.", + "NOTANEMAIL": "La valeur donnée n'est pas une adresse e-mail.", "MINLENGTH": "Doit comporter au moins {{length}} caractères.", "UPPERCASEMISSING": "Doit inclure un caractère majuscule.", "LOWERCASEMISSING": "Doit inclure un caractère minuscule.", @@ -653,9 +653,9 @@ "DELETE_BTN": "Supprimer définitivement" }, "SENDEMAILDIALOG": { - "TITLE": "Envoyer une notification par e-mail", - "DESCRIPTION": "Cliquez sur le bouton ci-dessous pour envoyer une notification à l'adresse e-mail actuelle ou modifier l'adresse e-mail dans le champ.", - "NEWEMAIL": "Nouvelle adresse e-mail" + "TITLE": "Envoyer une notification pare-mail", + "DESCRIPTION": "Cliquez sur le bouton ci-dessous pour envoyer une notification à l'adressee-mail actuelle ou modifier l'adressee-mail dans le champ.", + "NEWEMAIL": "Nouvelle adressee-mail" }, "SECRETDIALOG": { "CLIENTSECRET": "Client Secret", @@ -667,12 +667,12 @@ "CHANGEDATE": "Dernière modification", "CREATIONDATE": "Créé à", "FILTER": { - "0": "Filtre pour DisplayName", + "0": "Filtre pour le nom d'utilisateur affiché", "1": "Filtre sur le nom d'utilisateur", - "2": "filtre pour DisplayName", + "2": "filtre pour le nom d'utilisateur affiché", "3": "filtre pour Username", - "4": "filtre pour Email", - "5": "filtre pour DisplayName", + "4": "filtre pour E-mail", + "5": "filtre pour le nom d'utilisateur affiché", "10": "filtre pour le nom de l'organisation", "12": "filtre pour le nom du projet" }, @@ -690,7 +690,7 @@ "U2F": "Ajouter une méthode", "U2F_DIALOG_TITLE": "Vérifier l'authentifiant", "U2F_DIALOG_DESCRIPTION": "Entrez un nom pour votre connexion sans mot de passe utilisée", - "U2F_SUCCESS": "Auth sans mot de passe créé avec succès !", + "U2F_SUCCESS": "Connexion sans mot de passe créé avec succès !", "U2F_ERROR": "Une erreur s'est produite pendant la configuration !", "U2F_NAME": "Nom de l'authentificateur", "TYPE": { @@ -711,7 +711,7 @@ "ADD_DESCRIPTION": "Sélectionnez l'une des options disponibles pour créer une méthode d'authentification sans mot de passe.", "SEND_DESCRIPTION": "Envoyez vous-même un lien d'enregistrement à votre adresse électronique.", "SEND": "Envoyer le lien d'enregistrement", - "SENT": "L'email a été délivré avec succès. Vérifiez votre boîte aux lettres électronique pour poursuivre la configuration.", + "SENT": "L'e-mail a été délivré avec succès. Vérifiez votre boîte aux lettres électronique pour poursuivre la configuration.", "QRCODE_DESCRIPTION": "Générer un code QR à scanner avec un autre appareil.", "QRCODE": "Générer un code QR", "QRCODE_SCAN": "Scannez ce code QR pour poursuivre la configuration sur votre appareil.", @@ -738,8 +738,8 @@ "U2F_ERROR": "Une erreur s'est produite pendant l'installation !", "U2F_NAME": "Nom de l'authentificateur", "OTPSMS": "OTP (One-Time Password) avec SMS", - "OTPEMAIL": "OTP (password monouso) con e-mail", - "SETUPOTPSMSDESCRIPTION": "Voulez-vous configurer ce numéro de téléphone comme deuxième facteur OTP (mot de passe à usage unique) ?", + "OTPEMAIL": "OTP (password monouso) cone-mail", + "SETUPOTPSMSDESCRIPTION": "Voulez-vous configurer ce numéro de téléphone comme deuxième facteur OTP (mot de passe à usage unique) ?", "OTPSMSSUCCESS": "OTP Factor mis en place avec succès.", "OTPSMSPHONEMUSTBEVERIFIED": "Votre téléphone doit être vérifié pour pouvoir utiliser cette méthode.", "OTPEMAILSUCCESS": "OTP Factor mis en place avec succès.", @@ -777,7 +777,7 @@ "CREATE": { "TITLE": "Créer un nouvel utilisateur", "DESCRIPTION": "Veuillez fournir les informations nécessaires.", - "NAMEANDEMAILSECTION": "Nom et e-mail", + "NAMEANDEMAILSECTION": "Nom ete-mail", "GENDERLANGSECTION": "Sexe et langue", "PHONESECTION": "Numéro de téléphone", "PASSWORDSECTION": "Mot de passe initial", @@ -803,7 +803,7 @@ "TITLE": "Profil", "EMAIL": "Courriel", "PHONE": "Numéro de téléphone", - "PHONE_HINT": "Utilisez le symbole + suivi de l'indicatif du pays de l'appelant, ou sélectionnez le pays dans la liste déroulante et saisissez enfin le numéro de téléphone", + "PHONE_HINT": "Utilisez le symbole + suivi de l'indicatif du pays de l'appelant, ou sélectionnez le pays dans la liste déroulante et saisissez enfin le numéro de téléphone.", "USERNAME": "Nom de l'utilisateur", "CHANGEUSERNAME": "modifier", "CHANGEUSERNAME_TITLE": "Modifier le nom d'utilisateur", @@ -892,19 +892,19 @@ "ISINITIAL": "L'utilisateur n'est pas encore actif", "LOGINMETHODS": { "TITLE": "Informations sur le contact", - "DESCRIPTION": "Les informations fournies sont utilisées pour vous envoyer des informations importantes, comme des e-mails de réinitialisation de mot de passe.", + "DESCRIPTION": "Les informations fournies sont utilisées pour vous envoyer des informations importantes, comme dese-mails de réinitialisation de mot de passe.", "EMAIL": { "TITLE": "Courriel", - "VALID": "validé", + "VALID": "Validé", "ISVERIFIED": "Courriel vérifié", "ISVERIFIEDDESC": "Si l'e-mail est indiqué comme vérifié, aucune demande de vérification d'e-mail ne sera effectuée.", "RESEND": "Renvoyer l'e-mail de vérification", "EDITTITLE": "Modifier l'e-mail", - "EDITDESC": "Entrez le nouvel e-mail dans le champ ci-dessous." + "EDITDESC": "Entrez le nouvele-mail dans le champ ci-dessous." }, "PHONE": { "TITLE": "Téléphone", - "VALID": "validé", + "VALID": "Validé", "RESEND": "Renvoyer le message texte de vérification", "EDITTITLE": "Changer le numéro", "EDITVALUE": "Numéro de téléphone", @@ -957,7 +957,7 @@ "EDITACCOUNT": "Modifier le compte", "ADDACCOUNT": "Se connecter avec un autre compte", "RESENDINITIALEMAIL": "Renvoyer le courrier d'activation", - "RESENDEMAILNOTIFICATION": "Renvoyer la notification par e-mail", + "RESENDEMAILNOTIFICATION": "Renvoyer la notification pare-mail", "TOAST": { "CREATED": "Utilisateur créé avec succès.", "SAVED": "Profil enregistré avec succès.", @@ -971,7 +971,7 @@ "EMAILVERIFICATIONSENT": "Code de vérification de l'e-mail envoyé.", "OTPREMOVED": "OTP supprimé.", "U2FREMOVED": "Facteur supprimé.", - "PASSWORDLESSREMOVED": "Sans mot de passe supprimé.", + "PASSWORDLESSREMOVED": "Connexion sans mot de passe supprimée.", "INITIALPASSWORDSET": "Mot de passe initial défini.", "PASSWORDNOTIFICATIONSENT": "Notification de changement de mot de passe envoyée.", "PASSWORDCHANGED": "Mot de passe modifié avec succès.", @@ -989,8 +989,8 @@ "SECRETREMOVED": "Secret supprimé avec succès !" }, "MEMBERSHIPS": { - "TITLE": "Rôles du gestionnaire ZITADEL", - "DESCRIPTION": "Il s'agit de toutes les attributions des membres de l'utilisateur. Vous pouvez les modifier également sur les pages de détails de l'organisation, du projet ou de l'IAM.", + "TITLE": "Rôles du responsable ZITADEL", + "DESCRIPTION": "Il s'agit de toutes les attributions des membres de l'utilisateur. Vous pouvez également les modifier sur les pages de détails de l'organisation, du projet ou de l'IAM.", "ORGCONTEXT": "Vous voyez toutes les organisations et tous les projets qui sont liés à l'organisation actuellement sélectionnée.", "USERCONTEXT": "Vous voyez toutes les organisations et tous les projets auxquels vous êtes autorisé. Y compris les autres organisations.", "CREATIONDATE": "Date de création", @@ -1005,7 +1005,7 @@ "UNKNOWN": "Inconnu", "ORG": "Organisation", "PROJECT": "Projet", - "GRANTEDPROJECT": "Projet accordé" + "GRANTEDPROJECT": "Projet octroyé" } }, "PERSONALACCESSTOKEN": { @@ -1080,7 +1080,7 @@ }, "REMOVEACTIONSLIST": { "TITLE": "Supprimer les actions sélectionnées ?", - "DESCRIPTION": "Voulez-vous vraiment supprimer les actions sélectionnées du flux ?" + "DESCRIPTION": "Voulez-vous vraiment supprimer les actions sélectionnées du flux ?" } }, "TOAST": { @@ -1099,8 +1099,8 @@ "DESCRIPTION": "Gérez vos vues ZITADEL et les événements échoués." }, "MEMBER": { - "TITLE": "Managers", - "DESCRIPTION": "Ces gestionnaires sont autorisés à effectuer des changements dans votre instance." + "TITLE": "Responsables", + "DESCRIPTION": "Ces responsables sont autorisés à effectuer des changements dans votre instance." }, "PAGES": { "STATE": "Statut", @@ -1189,10 +1189,10 @@ } }, "TOAST": { - "MEMBERREMOVED": "Gestionnaire supprimé.", - "MEMBERSADDED": "Gestionnaires ajoutés.", - "MEMBERADDED": "Gestionnaire ajouté.", - "MEMBERCHANGED": "Manager changé.", + "MEMBERREMOVED": "Responsable supprimé.", + "MEMBERSADDED": "Responsable ajoutés.", + "MEMBERADDED": "Responsable ajouté.", + "MEMBERCHANGED": "Responsable modifié.", "ROLEREMOVED": "Rôle supprimé.", "ROLECHANGED": "Rôle modifié.", "REACTIVATED": "Réactivé", @@ -1230,20 +1230,20 @@ }, "ORGDOMAIN": { "TITLE": "Vérifier la propriété de {{value}}", - "VERIFICATION": "Nous vous proposons deux méthodes pour valider manuellement votre domaine :", + "VERIFICATION": "Nous vous proposons deux méthodes pour valider manuellement votre domaine :", "VERIFICATION_HTML": "-HTTP. Hébergez un fichier de vérification temporaire sur votre site Web", "VERIFICATION_DNS": "-DNS. Créer une entrée DNS d'enregistrement TXT", - "VERIFICATION_DNS_DESC": "Si vous gérez {{ value }} et que vous avez accès à vos enregistrements DNS, vous pouvez créer un nouvel enregistrement TXT avec les valeurs suivantes :", + "VERIFICATION_DNS_DESC": "Si vous gérez {{ value }} et que vous avez accès à vos enregistrements DNS, vous pouvez créer un nouvel enregistrement TXT avec les valeurs suivantes :", "VERIFICATION_DNS_HOST_LABEL": "Host:", - "VERIFICATION_DNS_CHALLENGE_LABEL": "Utilisez ce code pour la valeur de l'enregistrement TXT :", + "VERIFICATION_DNS_CHALLENGE_LABEL": "Utilisez ce code pour la valeur de l'enregistrement TXT :", "VERIFICATION_HTTP_DESC": "Si vous avez accès à l'hébergement de votre site Web, téléchargez simplement le fichier de vérification et téléchargez-le à l'URL fournie.", - "VERIFICATION_HTTP_URL_LABEL": "URL attendue :", - "VERIFICATION_HTTP_FILE_LABEL": "Dossier de vérification :", - "VERIFICATION_SKIP": "Vous pouvez ignorer la vérification pour le moment et continuer à créer votre organisation, mais pour pouvoir utiliser votre domaine, cette étape doit être complétée !", + "VERIFICATION_HTTP_URL_LABEL": "URL attendue :", + "VERIFICATION_HTTP_FILE_LABEL": "Dossier de vérification :", + "VERIFICATION_SKIP": "Vous pouvez ignorer la vérification pour le moment et continuer à créer votre organisation, mais pour pouvoir utiliser votre domaine, cette étape doit être complétée !", "VERIFICATION_VALIDATION_DESC": "Ne supprimez pas le code de vérification, car ZITADEL revérifiera de temps en temps la propriété de votre domaine.", "VERIFICATION_NEWTOKEN_TITLE": "Demander un nouveau jeton", "VERIFICATION_VALIDATION_ONGOING": "La méthode {{ value }} a été sélectionnée pour vérifier votre domaine. Cliquez sur le bouton pour déclencher une vérification ou réinitialiser le processus de vérification.", - "VERIFICATION_SUCCESSFUL": "Domaine vérifié avec succès !", + "VERIFICATION_SUCCESSFUL": "Domaine vérifié avec succès !", "RESETMETHOD": "Réinitialiser la méthode de vérification" }, "DOWNLOAD_FILE": "Télécharger le fichier", @@ -1277,7 +1277,7 @@ "2": "Désactivé" }, "MEMBER": { - "TITLE": "Gestionnaires de l'organisation", + "TITLE": "Responsables de l'organisation", "DESCRIPTION": "Définissez les utilisateurs qui peuvent modifier les préférences de votre organisation." }, "TOAST": { @@ -1286,9 +1286,9 @@ "REACTIVATED": "Organisation réactivée.", "DOMAINADDED": "Domaine ajouté.", "DOMAINREMOVED": "Domaine supprimé.", - "MEMBERADDED": "Gestionnaire ajouté.", - "MEMBERREMOVED": "Gestionnaire supprimé.", - "MEMBERCHANGED": "Gestionnaire modifié.", + "MEMBERADDED": "Responsable ajouté.", + "MEMBERREMOVED": "Responsable supprimé.", + "MEMBERCHANGED": "Responsable modifié.", "SETPRIMARY": "Domaine primaire défini.", "DELETED": "Organisation supprimée avec succès", "DEFAULTORGNOTFOUND": "L'organisation par défaut est introuvable", @@ -1297,11 +1297,11 @@ "DIALOG": { "DEACTIVATE": { "TITLE": "Désactiver l'organisation", - "DESCRIPTION": "Vous êtes sur le point de désactiver votre organisation. Les utilisateurs ne peuvent plus se connecter ? Voulez-vous continuer ?" + "DESCRIPTION": "Vous êtes sur le point de désactiver votre organisation. Les utilisateurs ne pourront plus se connecter. Voulez-vous continuer ?" }, "REACTIVATE": { "TITLE": "Réactiver l'organisation", - "DESCRIPTION": "Vous êtes sur le point de réactiver votre organisation. Les utilisateurs peuvent ensuite se reconnecter ? Voulez-vous continuer ?" + "DESCRIPTION": "Vous êtes sur le point de réactiver votre organisation. Les utilisateurs pourront se reconnecter. Voulez-vous continuer ?" }, "DELETE": { "TITLE": "Supprimer l'organisation", @@ -1336,7 +1336,7 @@ "BRANDING": "Image de marque", "PRIVACYPOLICY": "Politique de confidentialité", "OIDC": "Durée de vie et expiration des jetons OIDC", - "SECRETS": "Apparence secrète", + "SECRETS": "Générateur de secrets", "SECURITY": "Paramètres de sécurité", "EVENTS": "Événements", "FAILEDEVENTS": "Événements échoués", @@ -1383,7 +1383,7 @@ "SMTP": { "TITLE": "Paramètres SMTP", "DESCRIPTION": "Description", - "SENDERADDRESS": "Adresse e-mail de l'expéditeur", + "SENDERADDRESS": "Adressee-mail de l'expéditeur", "SENDERNAME": "Nom de l'expéditeur", "REPLYTOADDRESS": "Adresse Reply-to", "HOSTANDPORT": "Hôte et port", @@ -1392,8 +1392,8 @@ "SETPASSWORD": "Définir le mot de passe SMTP", "PASSWORDSET": "Le mot de passe SMTP a été défini avec succès.", "TLS": "Sécurité de la couche de transport (TLS)", - "SAVED": "Enregistré avec succès!", - "NOCHANGES": "Aucun changement!", + "SAVED": "Enregistré avec succès !", + "NOCHANGES": "Aucun changement !", "REQUIREDWARN": "Pour envoyer des notifications depuis votre domaine, vous devez entrer vos données SMTP." }, "SMS": { @@ -1432,7 +1432,7 @@ "5": "Initialisation sans mot de passe", "6": "Secret de l'application", "7": "Mot de passe à usage unique (OTP) - SMS", - "8": "Mot de passe à usage unique (OTP) - e-mail" + "8": "Mot de passe à usage unique (OTP) -e-mail" }, "ADDGENERATOR": "Configurer générateur de mot de passe", "GENERATORTYPE": "Type", @@ -1459,7 +1459,7 @@ "OIDCLEGACYINTROSPECTION": "Introspection héritée OIDC", "OIDCLEGACYINTROSPECTION_DESCRIPTION": "Nous avons récemment refondu le point d'introspection pour des raisons de performances. Cette fonctionnalité peut être utilisée pour revenir à l'implémentation héritée en cas de bogues inattendus.", "OIDCTOKENEXCHANGE": "Échange de jetons OIDC", - "OIDCTOKENEXCHANGE_DESCRIPTION": "Activez le type de subvention expérimentale urn:ietf:params:oauth:grant-type:token-exchange pour le point de terminaison de jeton OIDC. L'échange de jetons peut être utilisé pour demander des jetons avec une portée moindre ou pour usurper d'autres utilisateurs. Consultez la politique de sécurité pour autoriser l'usurpation sur une instance.", + "OIDCTOKENEXCHANGE_DESCRIPTION": "Activez le type d'octroi expérimental urn:ietf:params:oauth:grant-type:token-exchange pour le point de terminaison de jeton OIDC. L'échange de jetons peut être utilisé pour demander des jetons avec une portée moindre ou pour usurper d'autres utilisateurs. Consultez la politique de sécurité pour autoriser l'usurpation sur une instance.", "OIDCTRIGGERINTROSPECTIONPROJECTIONS": "Déclencheurs de projections d'introspection OIDC", "OIDCTRIGGERINTROSPECTIONPROJECTIONS_DESCRIPTION": "Activez les déclencheurs de projection lors d'une demande d'introspection. Cela peut agir comme un contournement s'il existe des problèmes de cohérence perceptibles dans la réponse à l'introspection, mais cela peut avoir un impact sur les performances. Nous prévoyons de supprimer les déclencheurs pour les demandes d'introspection à l'avenir.", "USERSCHEMA": "Schéma utilisateur", @@ -1498,14 +1498,14 @@ "PASSWORDCHANGE": "Changement de mot de passe" }, "PRIVATELABELING": { - "DESCRIPTION": "Donnez au login votre style personnalisé et modifiez son comportement.", + "DESCRIPTION": "Donnez à la connexion votre style personnalisé et modifiez son comportement.", "PREVIEW_DESCRIPTION": "Les modifications de la politique seront automatiquement déployées dans l'environnement de prévisualisation.", "BTN": "Sélectionner le fichier", "ACTIVATEPREVIEW": "Appliquer la configuration", - "DARK": "Mode foncé", + "DARK": "Mode sombre", "LIGHT": "Mode clair", "CHANGEVIEW": "Modifier la vue", - "ACTIVATED": "Les changements de politique sont maintenant LIVE", + "ACTIVATED": "Les changements de politique sont maintenant propagés", "THEME": "Thème", "COLORS": "Couleurs", "FONT": "Police de caractères", @@ -1516,7 +1516,7 @@ "RELEASEFONT": "Release", "USEOFLOGO": "Votre logo sera utilisé dans la connexion ainsi que dans les courriels, tandis que l'icône est utilisée pour les petits éléments de l'interface utilisateur, comme le sélecteur d'organisation dans la console.", "MAXSIZE": "La taille maximale est limitée à 524 Ko.", - "EMAILNOSVG": "Le format de fichier SVG n'est pas supporté dans les emails. Téléchargez donc votre logo en PNG ou dans un autre format pris en charge.", + "EMAILNOSVG": "Le format de fichier SVG n'est pas supporté dans les e-mails. Téléchargez donc votre logo en PNG ou dans un autre format pris en charge.", "MAXSIZEEXCEEDED": "La taille maximale de 524kB est dépassée.", "NOSVGSUPPORTED": "SVG n'est pas pris en charge", "FONTINLOGINONLY": "La police n'est actuellement affichée que dans l'interface de connexion.", @@ -1532,8 +1532,8 @@ "TITLE": "Connexion", "SECOND": "Connectez-vous avec votre compte ZITADEL.", "ERROR": "L'utilisateur n'a pas pu être trouvé !", - "PRIMARYBUTTON": "suivant", - "SECONDARYBUTTON": "enregistrez-vous" + "PRIMARYBUTTON": "Suivant", + "SECONDARYBUTTON": "Enregistrez-vous" }, "THEMEMODE": { "THEME_MODE_AUTO": "Mode automatique", @@ -1559,7 +1559,7 @@ "TITLE": "Paramètres de connexion", "DESCRIPTION": "Définir la manière dont les utilisateurs peuvent être authentifiés et configurer les fournisseurs d'identité.", "DESCRIPTIONCREATEADMIN": "Les utilisateurs peuvent choisir parmi les fournisseurs d'identité disponibles ci-dessous.", - "DESCRIPTIONCREATEMGMT": "Les utilisateurs peuvent choisir parmi les fournisseurs d'identité disponibles ci-dessous. Note", + "DESCRIPTIONCREATEMGMT": "Les utilisateurs peuvent choisir parmi les fournisseurs d'identité disponibles ci-dessous. Note : vous pouvez utiliser des fournisseurs configurés dans le système aussi bien que des fournisseurs configurés uniquement pour votre organisation.", "LIFETIME_INVALID": "Le formulaire contient des valeurs non valides.", "SAVED": "Enregistré avec succès !", "PROVIDER_ADDED": "Fournisseur d'identité activé." @@ -1584,13 +1584,13 @@ "NEWERVERSIONEXISTS": "Une version plus récente existe", "CURRENTDATE": "Configuration actuelle", "CHANGEDATE": "Version plus récente de", - "KEYNAME": "Écran / Interface de connexion", + "KEYNAME": "Interface / Page de connexion", "RESET_TITLE": "Restaurer les valeurs par défaut", "RESET_DESCRIPTION": "Vous êtes sur le point de restaurer toutes les valeurs par défaut. Toutes les modifications que vous avez apportées seront définitivement supprimées. Voulez-vous vraiment continuer ?", "UNSAVED_TITLE": "Continuer sans sauvegarder ?", "UNSAVED_DESCRIPTION": "Vous avez apporté des modifications sans les sauvegarder. Voulez-vous les enregistrer maintenant ?", "ACTIVE_LANGUAGE_NOT_ALLOWED": "Vous avez sélectionné une langue qui n'est pas autorisée. Vous pouvez continuer à modifier les textes. Mais si vous voulez que vos utilisateurs puissent réellement utiliser cette langue, modifiez les restrictions de vos instances.", - "LANGUAGES_NOT_ALLOWED": "Non autorisé:", + "LANGUAGES_NOT_ALLOWED": "Non autorisé :", "LANGUAGE": "Langue", "LANGUAGES": { "de": "Deutsch", @@ -1609,8 +1609,8 @@ "nl": "Nederlands" }, "KEYS": { - "emailVerificationDoneText": "Vérification de l'email effectuée", - "emailVerificationText": "Vérification de l'email", + "emailVerificationDoneText": "Vérification de l'e-mail effectuée", + "emailVerificationText": "Vérification de l'e-mail", "externalUserNotFoundText": "Utilisateur externe non trouvé", "footerText": "Pied de page", "initMfaDoneText": "Initialiser MFA terminé", @@ -1634,14 +1634,14 @@ "registrationOrgText": "Enregistrer l'organisation", "registrationUserText": "Enregistrer un utilisateur", "selectAccountText": "Sélectionner un compte", - "successLoginText": "Connexion avec succès", + "successLoginText": "Connecté avec succès", "usernameChangeDoneText": "Changement de nom d'utilisateur effectué", "usernameChangeText": "Changement de nom d'utilisateur", "verifyMfaOtpText": "Vérifier l'OTP", "verifyMfaU2fText": "Vérifier le second facteur universel", "passwordlessPromptText": "Invitation sans mot de passe", - "passwordlessRegistrationDoneText": "Enregistrement sans mot de passe Terminé", - "passwordlessRegistrationText": "Enregistrement sans mot de passe", + "passwordlessRegistrationDoneText": "Enregistrement d'une connexion sans mot de passe terminé", + "passwordlessRegistrationText": "Enregistrement d'une connexion sans mot de passe", "passwordlessText": "Sans mot de passe", "externalRegistrationUserOverviewText": "Enregistrement externe Aperçu de l'utilisateur" } @@ -1650,14 +1650,14 @@ "TYPE": "Notification", "TYPES": { "INIT": "Initialisation", - "VE": "Vérifier l'email", + "VE": "Vérifier l'e-mail", "VP": "Vérifier le téléphone", "VSO": "Vérifier SMS OTP", "VEO": "Vérifier l'OTP par courrier électronique", "PR": "Réinitialisation du mot de passe", "DC": "Réclamation de domaine", "PL": "Sans mot de passe", - "PC": "Changement de mot de passe" + "PC": "Modification du mot de passe" }, "CHIPS": { "firstname": "Prénom", @@ -1668,7 +1668,7 @@ "nickName": "Surnom", "loginnames": "Noms de connexion", "domain": "Domaine", - "lastEmail": "Dernier email", + "lastEmail": "Dernier e-mail", "lastPhone": "Dernier téléphone", "verifiedEmail": "Courriel vérifié", "verifiedPhone": "Téléphone vérifié", @@ -1687,15 +1687,15 @@ "BTN_EDIT": "Modifier", "DATA": { "DESCRIPTION": "Description", - "MINLENGTH": "longueur minimale", - "HASNUMBER": "a numéro", - "HASSYMBOL": "a un symbole", - "HASLOWERCASE": "a minuscule", - "HASUPPERCASE": "a majuscule", + "MINLENGTH": "doit comporter une longueur minimale", + "HASNUMBER": "doit comporter un numéro", + "HASSYMBOL": "doit comporter un symbole", + "HASLOWERCASE": "doit comporter une minuscule", + "HASUPPERCASE": "doit comporter une majuscule", "SHOWLOCKOUTFAILURES": "montrer les échecs de verrouillage", - "MAXPASSWORDATTEMPTS": "Mot de passe maximum tentatives", - "MAXOTPATTEMPTS": "Maximal de tentatives OTP", - "EXPIREWARNDAYS": "Expiration Avertissement après le jour", + "MAXPASSWORDATTEMPTS": "Tentatives maximales du mot de passe", + "MAXOTPATTEMPTS": "Tentatives maximales de l'OTP", + "EXPIREWARNDAYS": "Avertissement d'expiration après le jour", "MAXAGEDAYS": "Âge maximum en jours", "USERLOGINMUSTBEDOMAIN": "Le nom de connexion de l'utilisateur doit contenir le nom de domaine de l'organisation", "USERLOGINMUSTBEDOMAIN_DESCRIPTION": "Si vous activez ce paramètre, tous les noms de connexion seront suffixés avec le domaine de l'organisation. Si ce paramètre est désactivé, vous devez vous assurer que les noms d'utilisateur sont uniques pour toutes les organisations.", @@ -1770,11 +1770,11 @@ "CREATE_DESC": "Insérez le nom de votre projet.", "ROLE": "Rôle", "NOITEMS": "Aucun projet", - "ZITADELPROJECT": "Ceci appartient au projet ZITADEL. Attention", + "ZITADELPROJECT": "Ceci appartient au projet ZITADEL. Attention : si vous faites de changements, ZITADEL pourrait ne pas fonctionner correctement.", "TYPE": { "OWNED": "Projets possédés", - "OWNED_SINGULAR": "Projet propre", - "GRANTED_SINGULAR": "Projet concédé" + "OWNED_SINGULAR": "Projet possédé", + "GRANTED_SINGULAR": "Projet octroyé" }, "PRIVATELABEL": { "TITLE": "Image de marque", @@ -1830,7 +1830,7 @@ "TITLE": "Type", "0": "Type inconnu", "1": "Propriété", - "2": "Accordé" + "2": "Octroyé" }, "NAME": "Nom", "NAMEDIALOG": { @@ -1839,10 +1839,10 @@ "NAME": "Nouveau nom" }, "MEMBER": { - "TITLE": "Managers", - "TITLEDESC": "Les gestionnaires peuvent apporter des modifications à ce projet en fonction de leur rôle.", - "DESCRIPTION": "Ces gestionnaires peuvent être en mesure de modifier votre projet.", - "USERNAME": "Nom de l'utilisateur", + "TITLE": "Responsables", + "TITLEDESC": "Les responsables peuvent apporter des modifications à ce projet en fonction de leur rôle.", + "DESCRIPTION": "Ces responsables peuvent être en mesure de modifier votre projet.", + "USERNAME": "Nom d'utilisateur", "DISPLAYNAME": "Nom d'affichage", "LOGINNAME": "Nom de connexion", "EMAIL": "E-mail", @@ -1850,28 +1850,28 @@ "USERID": "ID de l'utilisateur" }, "GRANT": { - "EMPTY": "Aucune organisation subventionnée.", - "TITLE": "Subventions de projet", + "EMPTY": "Aucune organisation octroyée.", + "TITLE": "Accords de projet", "DESCRIPTION": "Autoriser une autre organisation à utiliser votre projet.", "EDITTITLE": "Rôles d'édition", "CREATE": { - "TITLE": "Créer une subvention d'organisation", + "TITLE": "Octroyer une organisation", "SEL_USERS": "Sélectionnez les utilisateurs auxquels vous souhaitez accorder l'accès", "SEL_PROJECT": "Rechercher un projet", "SEL_ROLES": "Sélectionnez les rôles que vous souhaitez ajouter à l'autorisation.", "SEL_USER": "Sélectionnez les utilisateurs", "SEL_ORG": "Rechercher une organisation", - "SEL_ORG_DESC": "Rechercher l'organisme à accorder", - "ORG_DESCRIPTION": "Vous êtes sur le point d'accorder un utilisateur pour l'organisation{{name}}.", + "SEL_ORG_DESC": "Rechercher l'organisme à octroyer", + "ORG_DESCRIPTION": "Vous êtes sur le point d'octroyer un utilisateur pour l'organisation {{name}}.", "ORG_DESCRIPTION_DESC": "Changez le contexte dans l'en-tête ci-dessus pour accorder un utilisateur pour une autre organisation.", "SEL_ORG_FORMFIELD": "Organisation", "FOR_ORG": "L'autorisation est créée pour" }, "DETAIL": { - "TITLE": "Subvention de projet", - "DESC": "Vous pouvez sélectionner les rôles qui peuvent être utilisés par l'organisation spécifiée, et élire les managers.", + "TITLE": "Octroyer un projet", + "DESC": "Vous pouvez sélectionner les rôles qui peuvent être utilisés par l'organisation spécifiée, et élire les responsables.", "MEMBERTITLE": "Responsables", - "MEMBERDESC": "Il s'agit des gestionnaires de l'organisation subventionnée. Ajoutez ici les utilisateurs qui doivent avoir accès à la modification des données du projet.", + "MEMBERDESC": "Il s'agit des responsables de l'organisation accordée. Ajoutez ici les utilisateurs qui doivent avoir accès à la modification des données du projet.", "PROJECTNAME": "Nom du projet", "GRANTEDORG": "Organisation autorisée", "RESOURCEOWNER": "Propriétaire des ressources" @@ -1884,14 +1884,14 @@ "ALL": "Tous", "SHOWDETAIL": "Afficher les détails", "USER": "Utilisateur", - "MEMBERS": "Managers", + "MEMBERS": "Responsables", "ORG": "Organisation", "PROJECTNAME": "Nom du projet", - "GRANTEDORG": "Organisation accordée", + "GRANTEDORG": "Organisation octroyée", "GRANTEDORGDOMAIN": "Domaine", "RESOURCEOWNER": "Propriétaire de la ressource", "GRANTEDORGNAME": "Nom de l'organisation", - "GRANTID": "Grant Id", + "GRANTID": "Id de l'octroi", "CREATIONDATE": "Date de création", "CHANGEDATE": "Dernière modification", "DATES": "Dates", @@ -1899,17 +1899,17 @@ "NOROLES": "Aucun rôle", "TYPE": "Type", "TOAST": { - "PROJECTGRANTUSERGRANTADDED": "Subvention de projet créée.", - "PROJECTGRANTADDED": "Accord de projet créé.", - "PROJECTGRANTCHANGED": "Subvention de projet modifiée.", - "PROJECTGRANTMEMBERADDED": "Ajout d'un gestionnaire de subvention.", - "PROJECTGRANTMEMBERCHANGED": "Directeur de subvention modifié.", - "PROJECTGRANTMEMBERREMOVED": "Gestionnaire de subvention supprimé.", - "PROJECTGRANTUPDATED": "Subvention de projet mise à jour" + "PROJECTGRANTUSERGRANTADDED": "Octroi de projet créée.", + "PROJECTGRANTADDED": "Octroi de projet créé.", + "PROJECTGRANTCHANGED": "Octroi de projet modifiée.", + "PROJECTGRANTMEMBERADDED": "Responsable d'octrois ajouté.", + "PROJECTGRANTMEMBERCHANGED": "Responsable d'octrois modifié.", + "PROJECTGRANTMEMBERREMOVED": "Responsable d'octrois supprimé.", + "PROJECTGRANTUPDATED": "Octroi de projet mise à jour" }, "DIALOG": { - "DELETE_TITLE": "Supprimer une subvention de projet", - "DELETE_DESCRIPTION": "Vous êtes sur le point de supprimer une subvention de projet. Vous êtes sûr ?" + "DELETE_TITLE": "Supprimer un octroi de projet", + "DELETE_DESCRIPTION": "Vous êtes sur le point de supprimer un accord de projet. Êtes-vous sûr ?" }, "ROLES": "Rôles du projet" }, @@ -1923,7 +1923,7 @@ "ADDNEWLINE": "Ajouter un rôle supplémentaire", "KEY": "Clé", "TITLE": "Rôles", - "DESCRIPTION": "Définissez certains rôles qui peuvent être utilisés pour créer des subventions de projet.", + "DESCRIPTION": "Définissez certains rôles qui peuvent être utilisés pour créer des accords de projet.", "NAME": "Nom", "DISPLAY_NAME": "Afficher le nom", "GROUP": "Groupe", @@ -1935,7 +1935,7 @@ "DELETE": "Supprimer un rôle", "CREATIONDATE": "Créé", "CHANGEDATE": "Dernière modification", - "SELECTGROUPTOOLTIP": "Sélectionner tous les Rôles du groupe{{group}}.", + "SELECTGROUPTOOLTIP": "Sélectionner tous les Rôles du groupe {{group}}.", "OPTIONS": "Options", "ASSERTION": "Affirmer les rôles lors de l'authentification", "ASSERTION_DESCRIPTION": "Les informations sur les rôles sont envoyées par le point de terminaison Userinfo et, selon les paramètres de votre application, sous forme de jetons ou d'autres types.", @@ -1966,10 +1966,10 @@ "EMPTY": "Aucun projet trouvé" }, "TOAST": { - "MEMBERREMOVED": "Gestionnaire supprimé.", - "MEMBERSADDED": "Gestionnaires ajoutés.", - "MEMBERADDED": "Gestionnaire ajouté.", - "MEMBERCHANGED": "Manager changé.", + "MEMBERREMOVED": "Responsable supprimé.", + "MEMBERSADDED": "Responsables ajoutés.", + "MEMBERADDED": "Responsable ajouté.", + "MEMBERCHANGED": "Responsable modifié.", "ROLESCREATED": "Rôles créés.", "ROLEREMOVED": "Rôle supprimé.", "ROLECHANGED": "Rôle modifié.", @@ -1977,7 +1977,7 @@ "DEACTIVATED": "Désactivé.", "CREATED": "Projet créé.", "UPDATED": "Projet modifié.", - "GRANTUPDATED": "Subvention modifiée.", + "GRANTUPDATED": "Octroi modifié.", "DELETED": "Projet supprimé." } }, @@ -2048,11 +2048,11 @@ "OPTIONS": { "ISAUTOCREATION": "Création automatique", "ISAUTOCREATION_DESC": "Détermine si un compte sera créé s'il n'existe pas déjà.", - "ISAUTOUPDATE": "est mise à jour automatiquement", + "ISAUTOUPDATE": "Mise à jour automatique", "ISAUTOUPDATE_DESC": "Si cette option est sélectionnée, les comptes sont mis à jour lors de la réauthentification.", - "ISCREATIONALLOWED": "la création est-elle autorisée", + "ISCREATIONALLOWED": "Création de comptes autorisée", "ISCREATIONALLOWED_DESC": "Détermine si des comptes peuvent être créés.", - "ISLINKINGALLOWED": "la liaison est-elle autorisée", + "ISLINKINGALLOWED": "Liaison de comptes autorisée", "ISLINKINGALLOWED_DESC": "Détermine si une identité peut être liée à un compte existant.", "AUTOLINKING_DESC": "Détermine si une identité sera invitée à être liée à un compte existant.", "AUTOLINKINGTYPE": { @@ -2087,8 +2087,8 @@ "NAMEHINT": "Si elle est spécifiée, elle sera affichée dans l'interface de connexion.", "OPTIONAL": "optionnel", "LDAPATTRIBUTES": "Attributs LDAP", - "UPDATEBINDPASSWORD": "mettre à jour le mot de bind password", - "UPDATECLIENTSECRET": "mise à jour du secret client", + "UPDATEBINDPASSWORD": "mettre à jour le mot de passe Bind", + "UPDATECLIENTSECRET": "mettre à jour le secret client", "ADD": "Ajouter un fournisseur d'identité", "TYPE": "Type", "OWNER": "Propriétaire", @@ -2101,8 +2101,8 @@ "AVAILABILITY": "Disponibilité", "AVAILABLE": "disponible", "AVAILABLEBUTINACTIVE": "disponible mais inactif", - "SETAVAILABLE": "défini comme disponible", - "SETUNAVAILABLE": "défini comme non disponible", + "SETAVAILABLE": "définir comme disponible", + "SETUNAVAILABLE": "définir comme non disponible", "CONFIG": "Configuration", "STATE": "Statut", "ISSUER": "Émetteur", @@ -2124,8 +2124,8 @@ "LDAPIDATTRIBUTE": "ID attribute", "AVATARURLATTRIBUTE": "Avatar Url attribute", "DISPLAYNAMEATTRIBUTE": "Displayname attribute", - "EMAILATTRIBUTEATTRIBUTE": "Email attribute", - "EMAILVERIFIEDATTRIBUTE": "Email verified attribute", + "EMAILATTRIBUTEATTRIBUTE": "E-mail attribute", + "EMAILVERIFIEDATTRIBUTE": "E-mail verified attribute", "FIRSTNAMEATTRIBUTE": "Firstname attribute", "LASTNAMEATTRIBUTE": "Lastname attribute", "NICKNAMEATTRIBUTE": "Nickname attribute", @@ -2142,10 +2142,10 @@ "DEACTIVATE": "Désactiver", "ACTIVATE": "Activer", "DELETE": "Supprimer", - "DELETE_TITLE": "Supprimer Idp", + "DELETE_TITLE": "Supprimer l'IDP", "DELETE_DESCRIPTION": "Vous êtes sur le point de supprimer un fournisseur d'identité. Les changements qui en résultent sont irrévocables. Voulez-vous vraiment le faire ?", "REMOVE_WARN_TITLE": "Supprimer le fournisseur d'identité", - "REMOVE_WARN_DESCRIPTION": "Vous êtes sur le point de supprimer un fournisseur d'identité. Cela supprimera la sélection de l'IDP disponible pour vos utilisateurs et les utilisateurs déjà enregistrés ne pourront plus se reconnecter. Êtes-vous sûr de continuer ?", + "REMOVE_WARN_DESCRIPTION": "Vous êtes sur le point de supprimer un fournisseur d'identité. Cela supprimera la sélection de l'IDP disponible pour vos utilisateurs et les utilisateurs déjà enregistrés ne pourront plus se reconnecter. Êtes-vous sûr de continuer ?", "DELETE_SELECTION_TITLE": "Supprimer Idp", "DELETE_SELECTION_DESCRIPTION": "Vous êtes sur le point de supprimer un fournisseur d'identité. Les changements qui en résultent sont irrévocables. Voulez-vous vraiment le faire ?", "EMPTY": "Aucun IDP disponible", @@ -2202,9 +2202,9 @@ }, "SECONDFACTORTYPES": { "0": "Inconnu", - "1": "One Time Password par authenticator app (TOTP)", + "1": "One Time Password via une application d'authentification (TOTP)", "2": "Empreinte digitale, clés de sécurité, Face ID et autres", - "3": "One Time Password par email (Email OTP)", + "3": "One Time Password par e-mail (E-mail OTP)", "4": "One Time Password par SMS (SMS OTP)" } }, @@ -2233,13 +2233,13 @@ "ACTIVATED": "Activé", "ACTIVATE": "Activer le fournisseur", "DEACTIVATE": "Désactiver le fournisseur", - "TYPE": "Taper", + "TYPE": "Type", "DIALOG": { "ACTIVATED": "La configuration SMTP a été activée", "ACTIVATE_WARN_TITLE": "Activer la configuration SMTP", - "ACTIVATE_WARN_DESCRIPTION": "Vous êtes sur le point d'activer une configuration SMTP. Nous allons d’abord désactiver le fournisseur actif actuel, puis activer cette configuration. Es-tu sûr?", + "ACTIVATE_WARN_DESCRIPTION": "Vous êtes sur le point d'activer une configuration SMTP. Nous allons d’abord désactiver le fournisseur actif actuel, puis activer cette configuration. Etes-vous sûr?", "DEACTIVATE_WARN_TITLE": "Désactiver la configuration SMTP", - "DEACTIVATE_WARN_DESCRIPTION": "Vous êtes sur le point de désactiver une configuration SMTP. Es-tu sûr?", + "DEACTIVATE_WARN_DESCRIPTION": "Vous êtes sur le point de désactiver une configuration SMTP. Etes-vous sûr?", "DEACTIVATED": "La configuration SMTP a été désactivée", "DELETE_TITLE": "Supprimer la configuration SMTP", "DELETE_DESCRIPTION": "Vous êtes sur le point de supprimer une configuration. Confirmez cette action en tapant le nom de l'expéditeur", @@ -2277,9 +2277,9 @@ "TITLE": "Application", "ID": "ID", "DESCRIPTION": "Ici vous pouvez modifier les données de votre application et sa configuration.", - "CREATE": "Application OIDC", + "CREATE": "Créer une application", "CREATE_SELECT_PROJECT": "Sélectionnez d'abord votre projet", - "CREATE_NEW_PROJECT": "ou créez-en un nouveau here.", + "CREATE_NEW_PROJECT": "ou entrez le nom de votre nouveau projet", "CREATE_DESC_TITLE": "Entrez les détails de votre application étape par étape", "CREATE_DESC_SUB": "Une configuration recommandée sera automatiquement générée.", "STATE": "Statut", @@ -2330,7 +2330,7 @@ "TYPE": "Type d'application", "AUTHMETHOD": "Méthode d'authentification", "AUTHMETHODSECTION": "Méthode d'authentification", - "GRANT": "Types de subventions", + "GRANT": "Types d'octrois", "ADDITIONALORIGINS": "Origines supplémentaires", "ADDITIONALORIGINSDESC": "Si vous voulez ajouter des origines supplémentaires à votre application qui n'est pas utilisée comme une redirection, vous pouvez le faire ici.", "ORIGINS": "Origines", @@ -2341,17 +2341,17 @@ "ISSUER": "Émetteur", "CLIENTID": "Id client" }, - "CURRENT": "Current Config", + "CURRENT": "Configuration actuelle", "TOKENSECTIONTITLE": "Options AuthToken", "REDIRECTSECTIONTITLE": "Paramètres de redirection", "PROSWITCH": "Je suis un pro. Sautez cet assistant.", "NAMEANDTYPESECTION": "Nom et type", "TITLEFIRST": "Commencez par insérer un nom.", "TYPETITLE": "Quel type d'application voulez-vous créer ?", - "REDIRECTTITLE": "Indiquez les URI vers lesquels le login sera redirigé.", + "REDIRECTTITLE": "Indiquez les URIs vers lesquels le login sera redirigé.", "POSTREDIRECTTITLE": "Il s'agit de l'URI de redirection après la déconnexion.", - "REDIRECTDESCRIPTIONWEB": "Les URI de redirection doivent commencer par https.", - "REDIRECTDESCRIPTIONNATIVE": "Les URI de redirection doivent commencer par votre propre protocole, http.", + "REDIRECTDESCRIPTIONWEB": "Les URIs de redirection doivent commencer par https.", + "REDIRECTDESCRIPTIONNATIVE": "Les URIs de redirection doivent commencer par votre propre protocole, http://127.0.0.1, http://[::1] ou http://localhost.", "REDIRECTNOTVALID": "Cet URI de redirection n'est pas valide.", "COMMAORENTERSEPERATION": "séparer par ↵", "TYPEREQUIRED": "Le type est obligatoire.", @@ -2367,22 +2367,22 @@ "DEVMODEDESC": "Attention", "SKIPNATIVEAPPSUCCESSPAGE": "Sauter la page de succès de connexion", "SKIPNATIVEAPPSUCCESSPAGE_DESCRIPTION": "Sauter la page de succès après la connexion pour cette application native", - "REDIRECT": "Rediriger les URI", - "REDIRECTSECTION": "URI de redirection", + "REDIRECT": "Rediriger les URIs", + "REDIRECTSECTION": "URIs de redirection", "POSTLOGOUTREDIRECT": "URIs de post-déconnexion", "RESPONSESECTION": "Types de réponses", - "GRANTSECTION": "Types de subventions", - "GRANTTITLE": "Sélectionnez vos types de subventions. Note", + "GRANTSECTION": "Types d'octrois", + "GRANTTITLE": "Sélectionnez vos types d'octrois. Note : Implicite est uniquement disponible pour les applications basées sur le navigateur.", "APPTYPE": { "0": "Web", - "1": "Agent utilisateur", + "1": "User Agent", "2": "Natif" }, "RESPONSETYPE": "Types de réponse", "RESPONSE": { "0": "Code", - "1": "ID-Jeton", - "2": "ID-Jeton Jeton" + "1": "ID Token", + "2": "Token-ID Token" }, "REFRESHTOKEN": "Jeton de rafraîchissement", "GRANTTYPE": "Types d'octroi", @@ -2410,7 +2410,7 @@ "IDTOKENROLEASSERTION": "Rôles de l'utilisateur dans le jeton d'identification", "IDTOKENROLEASSERTION_DESCRIPTION": "Si sélectionné, les rôles demandés à l'utilisateur authentifié sont ajoutés au jeton d'identification.", "IDTOKENUSERINFOASSERTION": "Informations sur l'utilisateur dans le jeton d'identification", - "IDTOKENUSERINFOASSERTION_DESCRIPTION": "Permet aux clients de récupérer le profil, l'email, le téléphone et l'adresse à partir du jeton d'identification.", + "IDTOKENUSERINFOASSERTION_DESCRIPTION": "Permet aux clients de récupérer le profil, l'e-mail, le téléphone et l'adresse à partir du jeton d'identification.", "CLOCKSKEW": "Permet aux clients de gérer le décalage d'horloge de l'OP et du client. La durée (0-5s) sera ajoutée à la réclamation exp et soustraite de iats, auth_time et nbf.", "RECOMMENDED": "recommandé", "NOTRECOMMENDED": "non recommandé", @@ -2451,7 +2451,7 @@ "DESCRIPTION": "Applications SAML" }, "CONFIGSECTION": "Configuration SAML", - "CHOOSEMETADATASOURCE": "Fournissez votre configuration SAML à l'aide de l'une des options suivantes :", + "CHOOSEMETADATASOURCE": "Fournissez votre configuration SAML à l'aide de l'une des options suivantes :", "METADATAOPT1": "Option 1. Spécifiez l'URL où se trouve le fichier de métadonnées", "METADATAOPT2": "Option 2. Téléchargez un fichier contenant vos métadonnées XML", "METADATAOPT3": "Option 3. Créer un fichier de métadonnées minimal à la volée fournissant l'ENTITYID et l'URL ACS", @@ -2533,20 +2533,20 @@ "nl": "Nederlands" }, "MEMBER": { - "ADD": "Ajouter un manager", + "ADD": "Ajouter un responsable", "CREATIONTYPE": "Type de création", "CREATIONTYPES": { "3": "IAM", "2": "Organisation", "0": "Projet Détenu", - "1": "Projet Concédé", + "1": "Projet Octroyé", "4": "Projet" }, "EDITROLE": "Modifier les rôles", "EDITFOR": "Modifier les rôles de l'utilisateur", "DIALOG": { - "DELETE_TITLE": "Supprimer un manager", - "DELETE_DESCRIPTION": "Vous êtes sur le point de supprimer un manager. Vous êtes sûr ?" + "DELETE_TITLE": "Supprimer un responsable", + "DELETE_DESCRIPTION": "Vous êtes sur le point de supprimer un responsable. Etes-vous sûr ?" }, "SHOWDETAILS": "Cliquez pour afficher les détails." }, diff --git a/internal/api/ui/login/static/i18n/fr.yaml b/internal/api/ui/login/static/i18n/fr.yaml index df717b7aa4..44532ca8de 100644 --- a/internal/api/ui/login/static/i18n/fr.yaml +++ b/internal/api/ui/login/static/i18n/fr.yaml @@ -4,68 +4,68 @@ Login: TitleLinking: Login pour la liaison des utilisateurs DescriptionLinking: Entrez vos données de connexion pour lier votre utilisateur externe avec un utilisateur ZITADEL. LoginNameLabel: Identifiant - UsernamePlaceHolder: nom d'utilisateur - LoginnamePlaceHolder: nom d'utilisateur@domaine + UsernamePlaceHolder: Nom d'utilisateur + LoginnamePlaceHolder: Nom d'utilisateur ExternalUserDescription: Se connecter avec un utilisateur externe. - MustBeMemberOfOrg: L'utilisateur doit être membre de l'organisation {{.OrgName}} . - RegisterButtonText: s'inscrire - NextButtonText: suivant + MustBeMemberOfOrg: L'utilisateur doit être membre de l'organisation {{.OrgName}}. + RegisterButtonText: S'inscrire + NextButtonText: Suivant LDAP: Title: Connexion Description: Entrez vos données de connexion. LoginNameLabel: Identifiant PasswordLabel: Mot de passe - NextButtonText: suivant + NextButtonText: Suivant SelectAccount: Title: Sélectionner un compte - Description: Utilisez votre compte ZITADEL + Description: Utilisez votre compte ZITADEL. TitleLinking: Sélectionnez le compte pour le lien avec l'utilisateur DescriptionLinking: Sélectionnez votre compte pour établir un lien avec votre utilisateur externe. OtherUser: Autre utilisateur - SessionState0: actif + SessionState0: Actif SessionState1: Déconnecté MustBeMemberOfOrg: L'utilisateur doit être membre de l'organisation {{.OrgName}}. Password: Title: Mot de passe - Description: Entrez vos données de connexion. + Description: Entrez vos identifiants. PasswordLabel: Mot de passe MinLength: Longueur minimale HasUppercase: Lettre majuscule HasLowercase: Lettre minuscule HasNumber: Numéro HasSymbol: Symbole - Confirmation: Correspondance de confirmation - ResetLinkText: réinitialiser le mot de passe - BackButtonText: retour - NextButtonText: suivant + Confirmation: Les mots de passe sont identiques + ResetLinkText: Réinitialiser le mot de passe + BackButtonText: Retour + NextButtonText: Suivant UsernameChange: Title: Modifier le nom d'utilisateur - Description: Définissez votre nouveau nom d'utilisateur + Description: Définissez votre nouveau nom d'utilisateur. UsernameLabel: Nom d'utilisateur - CancelButtonText: annuler - NextButtonText: suivant + CancelButtonText: Annuler + NextButtonText: Suivant UsernameChangeDone: Title: Nom d'utilisateur modifié - Description: Votre nom d'utilisateur a été changé avec succès. - NextButtonText: suivant + Description: Votre nom d'utilisateur a bien été modifié. + NextButtonText: Suivant InitPassword: Title: Définir un mot de passe - Description: Vous avez reçu un code, que vous devez saisir dans le formulaire ci-dessous, pour définir votre nouveau mot de passe. + Description: Vous avez reçu un code, que vous devez saisir dans le formulaire ci-dessous pour définir votre nouveau mot de passe. CodeLabel: Code NewPasswordLabel: Nouveau mot de passe NewPasswordConfirmLabel: Confirmer le mot de passe - ResendButtonText: renvoyer le code - NextButtonText: suivant + ResendButtonText: Renvoyer le code + NextButtonText: Suivant InitPasswordDone: Title: Mot de passe défini - Description: Mot de passe défini avec succès + Description: Mot de passe défini avec succès. NextButtonText: Suivant CancelButtonText: Annuler @@ -76,17 +76,17 @@ InitUser: NewPasswordLabel: Nouveau mot de passe NewPasswordConfirm: Confirmer le mot de passe NextButtonText: Suivant - ResendButtonText: renvoyer le code + ResendButtonText: Renvoyer le code InitUserDone: - Title: User Utilisateur activé - Description: Email vérifié et mot de passe défini avec succès + Title: Utilisateur activé + Description: Email vérifié et mot de passe défini avec succès. NextButtonText: Suivant - CancelButtonText: annuler + CancelButtonText: Annuler InitMFAPrompt: - Title: Configuration à 2 facteurs - Description: L'authentification à deux facteurs vous offre une sécurité supplémentaire pour votre compte d'utilisateur. Vous êtes ainsi assuré d'être le seul à avoir accès à votre compte. + Title: Configuration authentification à 2 facteurs + Description: L'authentification authentification à 2 facteurs vous offre une sécurité supplémentaire pour votre compte d'utilisateur. Vous êtes ainsi assuré d'être le seul à avoir accès à votre compte. Provider0: Application d'authentification (par exemple, Google/Microsoft Authenticator, Authy) Provider1: Dépend de l'appareil (par ex. FaceID, Windows Hello, empreinte digitale) Provider3: OTP SMS @@ -95,8 +95,8 @@ InitMFAPrompt: SkipButtonText: Passer InitMFAOTP: - Title: Vérification à deux facteurs - Description: Créez votre 2-facteurs. Téléchargez une application d'authentification si vous n'en avez pas déjà une. + Title: Vérification authentification à 2 facteurs + Description: Créez votre authentification à 2 facteurs. Téléchargez une application d'authentification si vous n'en avez pas déjà une. OTPDescription: Scannez le code avec votre application d'authentification (par exemple Google Authenticator) ou copiez le secret et insérez le code généré ci-dessous. SecretLabel: Secret CodeLabel: Code @@ -118,12 +118,12 @@ InitMFAU2F: Description: Une clé de sécurité est une méthode de vérification qui peut être intégrée à votre téléphone, utiliser Bluetooth ou se brancher directement sur le port USB de votre ordinateur. TokenNameLabel: Nom de la clé de sécurité / de l'appareil NotSupported: WebAuthN n'est pas pris en charge par votre navigateur. Veuillez vous assurer qu'il est à jour ou utiliser un autre navigateur (par exemple Chrome, Safari, Firefox). - RegisterTokenButtonText: Enregistrez 2-facteurs + RegisterTokenButtonText: Enregistrez l'authentification à 2 facteurs ErrorRetry: Réessayez, créez un nouveau défi ou choisissez une autre méthode. InitMFADone: Title: Clé de sécurité ajoutée - Description: Génial! Vous venez de configurer avec succès votre facteur 2 et de rendre votre compte beaucoup plus sûr. Le facteur doit être saisi à chaque connexion. + Description: Génial! Vous venez de configurer avec succès votre authentification à 2 facteurs et de rendre votre compte beaucoup plus sûr. Le code doit être saisi à chaque connexion. NextButtonText: Suivant CancelButtonText: Annuler @@ -132,58 +132,58 @@ MFAProvider: Provider1: Dépend de l'appareil (par ex. FaceID, Windows Hello, empreinte digitale) Provider3: OTP SMS Provider4: OTP e-mail - ChooseOther: ou choisissez une autre option + ChooseOther: Ou choisissez une autre option VerifyMFAOTP: - Title: Vérifier 2-Facteurs - Description: Vérifiez votre second facteur + Title: Vérifier authentification à 2 facteurs + Description: Vérifiez votre authentification à 2 facteurs CodeLabel: Code NextButtonText: Suivant VerifyOTP: - Title: Vérifier 2-Facteurs - Description: Vérifiez votre second facteur + Title: Vérifier authentification à 2 facteurs + Description: Vérifiez votre authentification à 2 facteurs CodeLabel: Code ResendButtonText: Renvoyer le code NextButtonText: Suivant VerifyMFAU2F: - Title: Vérifier 2-Facteurs - Description: Vérifiez votre facteur 2 avec l'appareil enregistré (par exemple FaceID, Windows Hello, empreinte digitale). + Title: Vérifier authentification à 2 facteurs + Description: Vérifiez votre authentification à 2 facteurs avec l'appareil enregistré (par exemple FaceID, Windows Hello, empreinte digitale). NotSupported: WebAuthN n'est pas pris en charge par votre navigateur. Assurez-vous que vous utilisez la dernière version ou changez votre navigateur pour un navigateur pris en charge (Chrome, Safari, Firefox). - ErrorRetry: Réessayer, créer une nouvelle demande ou choisir une autre méthode. - ValidateTokenButtonText: Vérifier 2-Facteurs + ErrorRetry: Réessayez, créez une nouvelle demande ou choisissez une autre méthode. + ValidateTokenButtonText: Vérifier l'authentification à 2 facteurs Passwordless: Title: Connexion sans mot de passe Description: Connectez-vous avec les méthodes d'authentification fournies par votre appareil, comme FaceID, Windows Hello ou les empreintes digitales. NotSupported: WebAuthN n'est pas pris en charge par votre navigateur. Veuillez vous assurer qu'il est à jour ou utiliser un autre navigateur (par exemple Chrome, Safari, Firefox). ErrorRetry: Réessayez, créez un nouveau défi ou choisissez une autre méthode. - LoginWithPwButtonText: Connectez-vous avec le mot de passe + LoginWithPwButtonText: Connexion avec mot de passe ValidateTokenButtonText: Connexion sans mot de passe PasswordlessPrompt: - Title: Configuration sans mot de passe - Description: Souhaitez-vous configurer une connexion sans mot de passe? Méthodes d'authentification de votre appareil comme FaceID, Windows Hello ou Fingerprint. + Title: Configuration connexion sans mot de passe + Description: Souhaitez-vous configurer une connexion sans mot de passe ? (Méthodes d'authentification de votre appareil comme FaceID, Windows Hello ou empreintes digitales) DescriptionInit: Vous devez configurer la connexion sans mot de passe. Utilisez le lien qui vous a été donné pour enregistrer votre appareil. - PasswordlessButtonText: Aller sans mot de passe - NextButtonText: suivant + PasswordlessButtonText: Configurer la connexion sans mot de passe + NextButtonText: Suivant SkipButtonText: Passer PasswordlessRegistration: - Title: Configuration sans mot de passe - Description: Ajoutez votre authentification en fournissant un nom (par exemple MyMobilePhone, MacBook, etc.) et cliquez ensuite sur le bouton "Register passwordless" ci-dessous. + Title: Configuration connexion sans mot de passe + Description: Ajoutez votre authentification en fournissant un nom (par exemple MyMobilePhone, MacBook, etc.) et cliquez ensuite sur le bouton "Enregistrer la connexion sans mot de passe" ci-dessous. TokenNameLabel: Nom de l'appareil NotSupported: WebAuthN n'est pas pris en charge par votre navigateur. Veuillez vous assurer qu'il est à jour ou utiliser un autre navigateur (par exemple Chrome, Safari, Firefox). - RegisterTokenButtonText: Enregistrement sans mot de passe - ErrorRetry: Réessayer, créer un nouveau défi ou choisir une autre méthode. + RegisterTokenButtonText: Enregistrer la connexion sans mot de passe + ErrorRetry: Réessayez, créez un nouveau défi ou choisissez une autre méthode. PasswordlessRegistrationDone: - Title: Configuration sans mot de passe - Description: Le dispositif sans mot de passe a été ajouté avec succès. + Title: Configuration connexion sans mot de passe + Description: Le dispositif de connexion sans mot de passe a été ajouté avec succès. DescriptionClose: Vous pouvez maintenant fermer cette fenêtre. - NextButtonText: suivant - CancelButtonText: annuler + NextButtonText: Suivant + CancelButtonText: Annuler PasswordChange: Title: Changer le mot de passe @@ -191,46 +191,46 @@ PasswordChange: OldPasswordLabel: Ancien mot de passe NewPasswordLabel: Nouveau mot de passe NewPasswordConfirmLabel: Confirmation du mot de passe - CancelButtonText: annuler - NextButtonText: suivant + CancelButtonText: Annuler + NextButtonText: Suivant Footer: Bas de page PasswordChangeDone: Title: Changer le mot de passe Description: Votre mot de passe a été modifié avec succès. - NextButtonText: suivant + NextButtonText: Suivant PasswordResetDone: Title: Lien de réinitialisation du mot de passe envoyé Description: Vérifiez votre e-mail pour réinitialiser votre mot de passe. - NextButtonText: suivant + NextButtonText: Suivant EmailVerification: - Title: Vérification de l'email + Title: Vérification de l'e-mail Description: Nous vous avons envoyé un e-mail pour vérifier votre adresse. Veuillez saisir le code dans le formulaire ci-dessous. CodeLabel: Code - NextButtonText: suivant - ResendButtonText: renvoyer le code + NextButtonText: Suivant + ResendButtonText: Renvoyer le code EmailVerificationDone: - Title: E-Mail Verification + Title: E-mail Verification Description: Votre adresse électronique a été vérifiée avec succès. - NextButtonText: suivant - CancelButtonText: annuler - LoginButtonText: connexion + NextButtonText: Suivant + CancelButtonText: Annuler + LoginButtonText: Connexion RegisterOption: Title: Options d'enregistrement - Description: Choisissez comment vous souhaitez vous enregistrer + Description: Choisissez comment vous souhaitez vous enregistrer. RegisterUsernamePasswordButtonText: Avec nom d'utilisateur et mot de passe - ExternalLoginDescription: ou s'enregistrer avec un utilisateur externe - LoginButtonText: connexion + ExternalLoginDescription: Ou s'enregistrer avec un utilisateur externe + LoginButtonText: Connexion RegistrationUser: Title: Inscription Description: Entrez vos données d'utilisateur. Votre adresse e-mail sera utilisée comme nom de connexion. DescriptionOrgRegister: Entrez vos données d'utilisateur. - EmailLabel: E-Mail + EmailLabel: Email UsernameLabel: Identifiant FirstnameLabel: Prénom LastnameLabel: Nom de famille @@ -252,22 +252,22 @@ RegistrationUser: GenderLabel: Genre Female: Femme Male: Homme - Diverse: divers / X + Diverse: Divers / X PasswordLabel: Mot de passe PasswordConfirmLabel: Confirmation du mot de passe TosAndPrivacyLabel: Termes et conditions TosConfirm: J'accepte les TosLinkText: TOS PrivacyConfirm: J'accepte les - PrivacyLinkText: politique de confidentialité - ExternalLogin: ou m'inscrire avec un utilisateur externe - BackButtonText: connexion - NextButtonText: suivant + PrivacyLinkText: Politique de confidentialité + ExternalLogin: Ou m'inscrire avec un utilisateur externe + BackButtonText: Connexion + NextButtonText: Suivant ExternalRegistrationUserOverview: Title: Enregistrement des utilisateurs externes - Description: Nous avons pris vos coordonnées d'utilisateur auprès du fournisseur sélectionné. Vous pouvez maintenant les modifier ou les compléter. - EmailLabel: E-Mail + Description: Nous avons récupéré vos coordonnées d'utilisateur auprès du fournisseur sélectionné. Vous pouvez maintenant les modifier ou les compléter. + EmailLabel: E-mail UsernameLabel: Identifiant FirstnameLabel: Prénom LastnameLabel: Nom de famille @@ -292,16 +292,16 @@ ExternalRegistrationUserOverview: TosConfirm: J'accepte les TosLinkText: TOS PrivacyConfirm: J'accepte les - PrivacyLinkText: politique de confidentialité - ExternalLogin: ou m'inscrire avec un utilisateur externe - BackButtonText: retour - NextButtonText: enregistrer + PrivacyLinkText: Politique de confidentialité + ExternalLogin: Ou m'inscrire avec un utilisateur externe + BackButtonText: Retour + NextButtonText: Enregistrer RegistrationOrg: Title: Enregistrement de l'organisation Description: Entrez le nom de votre organisation et vos données d'utilisateur. OrgNameLabel: Nom de l'organisation - EmailLabel: E-Mail + EmailLabel: E-mail UsernameLabel: Nom d'utilisateur FirstnameLabel: Prénom LastnameLabel: Nom de famille @@ -311,42 +311,42 @@ RegistrationOrg: TosConfirm: J'accepte les TosLinkText: TOS PrivacyConfirm: J'accepte les - PrivacyLinkText: politique de confidentialité + PrivacyLinkText: Politique de confidentialité SaveButtonText: Créer une organisation LoginSuccess: Title: Connexion réussie AutoRedirectDescription: Vous serez automatiquement redirigé vers votre application. Si ce n'est pas le cas, cliquez sur le bouton ci-dessous. Vous pouvez ensuite fermer la fenêtre. RedirectedDescription: Vous pouvez maintenant fermer cette fenêtre. - NextButtonText: suivant + NextButtonText: Suivant LogoutDone: Title: Déconnecté Description: Vous vous êtes déconnecté avec succès. - LoginButtonText: connexion + LoginButtonText: Connexion LinkingUserPrompt: Title: Utilisateur existant trouvé - Description: "Souhaitez-vous associer votre compte existant:" + Description: "Souhaitez-vous associer votre compte existant :" LinkButtonText: Lier OtherButtonText: Autres options LinkingUsersDone: - Title: Userlinking + Title: Lier utilisateur Description: Le lien avec l'utilisateur est terminé. - CancelButtonText: annuler - NextButtonText: suivant + CancelButtonText: Annuler + NextButtonText: Suivant ExternalNotFound: Title: Utilisateur externe introuvable - Description: Utilisateur externe non trouvé. Voulez-vous lier votre utilisateur ou enregistrer automatiquement un nouvel utilisateur. + Description: Utilisateur externe non trouvé. Voulez-vous lier votre utilisateur ou enregistrer automatiquement un nouvel utilisateur ? LinkButtonText: Lier - AutoRegisterButtonText: enregistrer + AutoRegisterButtonText: Enregistrer TosAndPrivacyLabel: Termes et conditions TosConfirm: J'accepte les TosLinkText: TOS PrivacyConfirm: J'accepte les - PrivacyLinkText: politique de confidentialité + PrivacyLinkText: Politique de confidentialité German: Deutsch English: English Italian: Italiano @@ -367,14 +367,14 @@ DeviceAuth: UserCode: Label: Code d'utilisateur Description: Saisissez le code utilisateur présenté sur l'appareil. - ButtonNext: suivant + ButtonNext: Suivant Action: Description: Accordez l'accès à l'appareil. GrantDevice: vous êtes sur le point d'accorder un appareil AccessToScopes: accès aux périmètres suivants Button: - Allow: permettre - Deny: refuser + Allow: Autoriser + Deny: Refuser Done: Description: Fait. Approved: Autorisation de l'appareil approuvée. Vous pouvez maintenant retourner à l'appareil. @@ -392,7 +392,7 @@ SignIn: Connexion avec {{.Provider}} Errors: Internal: Une erreur interne s'est produite AuthRequest: - NotFound: Impossible de trouver l'authrequest + NotFound: Impossible de trouver la requête d'authentification UserAgentNotCorresponding: L'agent utilisateur ne correspond pas UserAgentNotFound: L'ID de l'agent utilisateur n'a pas été trouvé TokenNotFound: Token non trouvé @@ -404,7 +404,7 @@ Errors: Inactive: L'utilisateur est inactif NotFoundOnOrg: L'utilisateur n'a pas été trouvé dans l'organisation choisie NotAllowedOrg: L'utilisateur n'est pas membre de l'organisation requise - NotMatchingUserID: L'utilisateur et l'utilisateur dans l'authrequest ne correspondent pas. + NotMatchingUserID: L'utilisateur et l'utilisateur dans la requête d'authentification ne correspondent pas. UserIDMissing: UserID est vide Invalid: Données utilisateur non valides DomainNotAllowedAsUsername: Le domaine est déjà réservé et ne peut pas être utilisé. @@ -418,7 +418,7 @@ Errors: IDMissing: Profil ID manquant Email: NotFound: Email non trouvé - Invalid: L'email n'est pas valide + Invalid: L'e-mail n'est pas valide AlreadyVerified: L'adresse électronique est déjà vérifiée NotChanged: L'adresse électronique n'a pas changé Empty: Email est vide @@ -445,7 +445,7 @@ Errors: UsernameOrPassword: Invalid: Le nom d'utilisateur ou le mot de passe n'est pas valide PasswordComplexityPolicy: - NotFound: Politique de mot de passe non trouvée + NotFound: Politique des mots de passe non trouvée MinLength: Le mot de passe est trop court HasLower: Le mot de passe doit contenir une lettre minuscule HasUpper: Le mot de passe doit contenir une lettre majuscule diff --git a/internal/notification/static/i18n/fr.yaml b/internal/notification/static/i18n/fr.yaml index 42c4b837eb..a313343ba5 100644 --- a/internal/notification/static/i18n/fr.yaml +++ b/internal/notification/static/i18n/fr.yaml @@ -27,15 +27,15 @@ VerifyPhone: Text: Un nouveau numéro de téléphone a été ajouté. Veuillez utiliser le code suivant pour le vérifier {{.Code}} ButtonText: Vérifier le téléphone VerifyEmailOTP: - Title: ZITADEL - Vérifie le mot de passe à usage unique - PreHeader: Vérifie le mot de passe à usage unique - Subject: Vérifie le mot de passe à usage unique + Title: ZITADEL - Vérifier le mot de passe à usage unique + PreHeader: Vérifier le mot de passe à usage unique + Subject: Vérifier le mot de passe à usage unique Greeting: Bonjour {{.DisplayName}}, - Text: Utilise le bouton 'Authentifier' ou copie le mot de passe à usage unique {{.OTP}} et colle-le à l'écran d'authentification pour t'authentifier sur ZITADEL dans les cinq prochaines minutes. + Text: Utilisez le bouton 'Authentifier' ou copiez le mot de passe à usage unique {{.OTP}} et collez-le à l'écran d'authentification pour vous authentifier sur ZITADEL dans les cinq prochaines minutes. ButtonText: Authentifier VerifySMSOTP: Text: >- - {{.OTP}} est votre mot de passe à usage unique pour {{ .Domain }}. Utilisez-le dans le prochain {{.Expiry}}. + {{.OTP}} est votre mot de passe à usage unique pour {{ .Domain }}. Utilisez-le dans les prochaines {{.Expiry}}. @{{.Domain}} #{{.OTP}} DomainClaimed: diff --git a/internal/static/i18n/fr.yaml b/internal/static/i18n/fr.yaml index 55bff2a7ae..6d0592111f 100644 --- a/internal/static/i18n/fr.yaml +++ b/internal/static/i18n/fr.yaml @@ -66,9 +66,9 @@ Errors: NotFoundOnOrg: L'utilisateur n'a pas été trouvé dans l'organisation choisie NotAllowedOrg: L'utilisateur n'est pas membre de l'organisation requise UserIDMissing: L'ID de l'utilisateur est manquant - UserIDWrong: "L'utilisateur de la demande n'est pas égal à l'utilisateur authentifié" + UserIDWrong: L'utilisateur de la demande n'est pas égal à l'utilisateur authentifié DomainPolicyNil: La politique de l'organisation est vide - EmailAsUsernameNotAllowed: L'email n'est pas autorisé comme nom d'utilisateur + EmailAsUsernameNotAllowed: L'e-mail n'est pas autorisé comme nom d'utilisateur Invalid: Les données de l'utilisateur ne sont pas valides DomainNotAllowedAsUsername: Le domaine est déjà réservé et ne peut être utilisé. AlreadyInactive: L'utilisateur est déjà inactif @@ -90,12 +90,12 @@ Errors: LastNameEmpty: Le nom de famille dans le profil est vide IDMissing: Profil ID manquant Email: - NotFound: Email non trouvé - Invalid: L'email n'est pas valide + NotFound: E-mail non trouvé + Invalid: L'e-mail n'est pas valide AlreadyVerified: L'adresse électronique est déjà vérifiée NotChanged: L'adresse électronique n'a pas changé - Empty: Email est vide - IDMissing: Email ID manquant + Empty: L'e-mail est vide + IDMissing: E-mail ID manquant Phone: Notfound: Téléphone non trouvé Invalid: Le téléphone n'est pas valide @@ -621,7 +621,7 @@ EventTypes: released: Nom d'utilisateur libéré email: reserved: Adresse e-mail réservée - released: Adresse email libérée + released: Adresse e-mail libérée changed: Adresse e-mail modifiée verified: Adresse e-mail vérifiée verification: From f482231f79b4ccb42aeddfb9712c8c04e13a0d3b Mon Sep 17 00:00:00 2001 From: Max Peintner Date: Fri, 17 May 2024 19:28:29 +0200 Subject: [PATCH 13/35] fix(console): infinite scrolling for org context (#7965) * add scroll directive, iterative loading * sorting column * fix: filter * batch of 100, max height 350px * cleanup --- .../scrollable/scrollable.directive.ts | 2 +- .../scrollable/scrollable.module.ts | 11 -- .../src/app/modules/changes/changes.module.ts | 4 +- .../org-context/org-context.component.html | 2 +- .../org-context/org-context.component.ts | 122 ++++++++++++++---- .../modules/org-context/org-context.module.ts | 2 + .../org-table/org-table.component.html | 2 +- console/src/app/services/grpc-auth.service.ts | 9 +- 8 files changed, 107 insertions(+), 47 deletions(-) delete mode 100644 console/src/app/directives/scrollable/scrollable.module.ts diff --git a/console/src/app/directives/scrollable/scrollable.directive.ts b/console/src/app/directives/scrollable/scrollable.directive.ts index 0ee83a6f8e..a8cda5fae6 100644 --- a/console/src/app/directives/scrollable/scrollable.directive.ts +++ b/console/src/app/directives/scrollable/scrollable.directive.ts @@ -1,6 +1,7 @@ import { Directive, ElementRef, EventEmitter, HostListener, Output } from '@angular/core'; @Directive({ + standalone: true, selector: '[cnslScrollable]', }) export class ScrollableDirective { @@ -15,7 +16,6 @@ export class ScrollableDirective { const top = event.target.scrollTop; const height = this.el.nativeElement.scrollHeight; const offset = this.el.nativeElement.offsetHeight; - // emit bottom event if (top > height - offset - 1) { this.scrollPosition.emit('bottom'); diff --git a/console/src/app/directives/scrollable/scrollable.module.ts b/console/src/app/directives/scrollable/scrollable.module.ts deleted file mode 100644 index 89bcbfabc1..0000000000 --- a/console/src/app/directives/scrollable/scrollable.module.ts +++ /dev/null @@ -1,11 +0,0 @@ -import { CommonModule } from '@angular/common'; -import { NgModule } from '@angular/core'; - -import { ScrollableDirective } from './scrollable.directive'; - -@NgModule({ - declarations: [ScrollableDirective], - imports: [CommonModule], - exports: [ScrollableDirective], -}) -export class ScrollableModule {} diff --git a/console/src/app/modules/changes/changes.module.ts b/console/src/app/modules/changes/changes.module.ts index 9c087e6383..c19500ffa9 100644 --- a/console/src/app/modules/changes/changes.module.ts +++ b/console/src/app/modules/changes/changes.module.ts @@ -6,7 +6,6 @@ import { MatIconModule } from '@angular/material/icon'; import { MatProgressSpinnerModule } from '@angular/material/progress-spinner'; import { MatTooltipModule } from '@angular/material/tooltip'; import { TranslateModule } from '@ngx-translate/core'; -import { ScrollableModule } from 'src/app/directives/scrollable/scrollable.module'; import { HasRolePipeModule } from 'src/app/pipes/has-role-pipe/has-role-pipe.module'; import { LocalizedDatePipeModule } from 'src/app/pipes/localized-date-pipe/localized-date-pipe.module'; import { TimestampToDatePipeModule } from 'src/app/pipes/timestamp-to-date-pipe/timestamp-to-date-pipe.module'; @@ -18,7 +17,6 @@ import { ChangesComponent } from './changes.component'; declarations: [ChangesComponent], imports: [ CommonModule, - ScrollableModule, MatProgressSpinnerModule, TranslateModule, MatIconModule, @@ -30,6 +28,6 @@ import { ChangesComponent } from './changes.component'; MatTooltipModule, AvatarModule, ], - exports: [ChangesComponent, ScrollableModule], + exports: [ChangesComponent], }) export class ChangesModule {} diff --git a/console/src/app/modules/org-context/org-context.component.html b/console/src/app/modules/org-context/org-context.component.html index dc1a0f1d64..154cb0dbd7 100644 --- a/console/src/app/modules/org-context/org-context.component.html +++ b/console/src/app/modules/org-context/org-context.component.html @@ -15,7 +15,7 @@ />
-
+
+ +
+ {{ 'SMTP.CREATE.STEPS.NEXT_STEPS' | translate }} + +
+
+

{{ 'SMTP.CREATE.STEPS.ACTIVATE.TITLE' | translate }}

+ +
+
+ +
+
+

{{ 'SMTP.CREATE.STEPS.ACTIVATE.DESCRIPTION' | translate }}

+ + + +
+
+

{{ 'SMTP.CREATE.STEPS.DEACTIVATE.TITLE' | translate }}

+ +
+
+ +
+
+

{{ 'SMTP.CREATE.STEPS.DEACTIVATE.DESCRIPTION' | translate }}

+ + +
+ + +
+
+ + check diff --git a/console/src/app/modules/smtp-provider/smtp-provider.component.ts b/console/src/app/modules/smtp-provider/smtp-provider.component.ts index 5a60e2e1a4..439ec60339 100644 --- a/console/src/app/modules/smtp-provider/smtp-provider.component.ts +++ b/console/src/app/modules/smtp-provider/smtp-provider.component.ts @@ -31,6 +31,8 @@ import { OutlookDefaultSettings, SendgridDefaultSettings, } from './known-smtp-providers-settings'; +import { MatStepper } from '@angular/material/stepper'; +import { SMTPConfigState } from 'src/app/proto/generated/zitadel/settings_pb'; @Component({ selector: 'cnsl-smtp-provider', @@ -48,7 +50,7 @@ export class SMTPProviderComponent { public smtpLoading: boolean = false; public hasSMTPConfig: boolean = false; - + public isActive: boolean = false; public updateClientSecret: boolean = false; // stepper @@ -166,6 +168,7 @@ export class SMTPProviderComponent { .then((data) => { this.smtpLoading = false; if (data.smtpConfig) { + this.isActive = data.smtpConfig.state === SMTPConfigState.SMTP_CONFIG_ACTIVE; this.hasSMTPConfig = true; this.firstFormGroup.patchValue({ ['description']: data.smtpConfig.description, @@ -188,7 +191,7 @@ export class SMTPProviderComponent { }); } - private updateData(): Promise { + private updateData(): Promise { if (this.hasSMTPConfig) { const req = new UpdateSMTPConfigRequest(); req.setId(this.id); @@ -228,19 +231,49 @@ export class SMTPProviderComponent { } } - public savePolicy(): void { - this.updateData() + public activateSMTPConfig() { + this.service + .activateSMTPConfig(this.id) .then(() => { + this.toast.showInfo('SMTP.LIST.DIALOG.ACTIVATED', true); + this.isActive = true; + }) + .catch((error) => { + this.toast.showError(error); + }); + } + + public deactivateSMTPConfig() { + this.service + .deactivateSMTPConfig(this.id) + .then(() => { + this.toast.showInfo('SMTP.LIST.DIALOG.DEACTIVATED', true); + this.isActive = false; + }) + .catch((error) => { + this.toast.showError(error); + }); + } + + public savePolicy(stepper: MatStepper): void { + this.updateData() + .then((resp) => { + if (!this.id) { + // This is a new SMTP provider let's get the ID from the addSMTPConfig response + let createResponse = resp as AddSMTPConfigResponse.AsObject; + this.id = createResponse.id; + } + this.toast.showInfo('SETTING.SMTP.SAVED', true); setTimeout(() => { - this.close(); + stepper.next(); }, 2000); }) .catch((error: unknown) => { if (`${error}`.includes('No changes')) { this.toast.showInfo('SETTING.SMTP.NOCHANGES', true); setTimeout(() => { - this.close(); + stepper.next(); }, 2000); } else { this.toast.showError(error); diff --git a/console/src/app/modules/smtp-provider/smtp-provider.scss b/console/src/app/modules/smtp-provider/smtp-provider.scss index 06fdcefe6e..2bb7bca332 100644 --- a/console/src/app/modules/smtp-provider/smtp-provider.scss +++ b/console/src/app/modules/smtp-provider/smtp-provider.scss @@ -68,4 +68,32 @@ font-size: 14px; } } + + .title-row { + display: flex; + flex-direction: row; + justify-content: space-between; + align-items: center; + + .left { + display: flex; + flex-direction: row; + justify-content: space-between; + align-items: center; + } + + .right { + flex-shrink: 0; + } + + .title { + margin: 1.2rem 0; + } + + .next-icon { + font-size: 1.2rem; + height: 1.2rem; + width: 1.2rem; + } + } } diff --git a/console/src/assets/i18n/bg.json b/console/src/assets/i18n/bg.json index 8cbc3ba790..7da4e58dca 100644 --- a/console/src/assets/i18n/bg.json +++ b/console/src/assets/i18n/bg.json @@ -2218,7 +2218,7 @@ "SMTP": { "LIST": { "TITLE": "SMTP доставчик", - "DESCRIPTION": "Това са SMTP доставчиците за вашето копие на Zitadel. Активирайте този, който искате да използвате, за да изпращате известия до вашите потребители.", + "DESCRIPTION": "Това са SMTP доставчиците за вашето копие на ZITADEL. Активирайте този, който искате да използвате, за да изпращате известия до вашите потребители.", "EMPTY": "Няма наличен SMTP доставчик", "ACTIVATED": "Активиран", "ACTIVATE": "Активирайте доставчика", @@ -2246,7 +2246,16 @@ "CURRENT_DESC_TITLE": "Това са вашите SMTP настройки", "PROVIDER_SETTINGS": "Настройки на SMTP доставчик", "SENDER_SETTINGS": "Настройки на изпращача", - "TEST_SETTINGS": "Тествайте настройките на SMTP" + "TEST_SETTINGS": "Тествайте настройките на SMTP", + "NEXT_STEPS": "Следващи стъпки", + "ACTIVATE": { + "TITLE": "Активирайте вашия SMTP доставчик", + "DESCRIPTION": "ZITADEL не може да използва този SMTP доставчик за изпращане на известия, докато не го активирате. Ако активирате този доставчик, всеки друг доставчик, който е бил активен, сега ще бъде деактивиран." + }, + "DEACTIVATE": { + "TITLE": "Деактивирайте вашия SMTP доставчик", + "DESCRIPTION": "Ако деактивирате този SMTP доставчик, ZITADEL не може да го използва за изпращане на известия, докато не го активирате отново." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/cs.json b/console/src/assets/i18n/cs.json index 197d821b41..3e3f4e3ff5 100644 --- a/console/src/assets/i18n/cs.json +++ b/console/src/assets/i18n/cs.json @@ -2237,7 +2237,7 @@ "SMTP": { "LIST": { "TITLE": "Poskytovatel SMTP", - "DESCRIPTION": "Toto jsou poskytovatelé SMTP pro vaši instanci Zitadel. Aktivujte ten, který chcete používat k odesílání upozornění svým uživatelům.", + "DESCRIPTION": "Toto jsou poskytovatelé SMTP pro vaši instanci ZITADEL. Aktivujte ten, který chcete používat k odesílání upozornění svým uživatelům.", "EMPTY": "Není k dispozici žádný poskytovatel SMTP", "ACTIVATED": "Aktivováno", "ACTIVATE": "Aktivujte poskytovatele", @@ -2265,7 +2265,16 @@ "CURRENT_DESC_TITLE": "Toto jsou vaše nastavení SMTP", "PROVIDER_SETTINGS": "Nastavení poskytovatele SMTP", "SENDER_SETTINGS": "Nastavení odesílatele", - "TEST_SETTINGS": "Otestujte nastavení SMTP" + "TEST_SETTINGS": "Otestujte nastavení SMTP", + "NEXT_STEPS": "Další kroky", + "ACTIVATE": { + "TITLE": "Aktivujte svého poskytovatele SMTP", + "DESCRIPTION": "ZITADEL nemůže používat tohoto poskytovatele SMTP k odesílání upozornění, dokud jej neaktivujete. Pokud aktivujete tohoto poskytovatele, jakýkoli jiný aktivní poskytovatel bude nyní deaktivován." + }, + "DEACTIVATE": { + "TITLE": "Deaktivujte svého poskytovatele SMTP", + "DESCRIPTION": "Pokud deaktivujete tohoto poskytovatele SMTP, ZITADEL jej nebude moci používat k odesílání upozornění, dokud jej znovu neaktivujete." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/de.json b/console/src/assets/i18n/de.json index ff8140f414..a49819c241 100644 --- a/console/src/assets/i18n/de.json +++ b/console/src/assets/i18n/de.json @@ -2227,7 +2227,7 @@ "SMTP": { "LIST": { "TITLE": "SMTP-Anbieter", - "DESCRIPTION": "Dies sind die SMTP-Anbieter für Ihre Zitadel-Instanz. Aktivieren Sie diejenige, die Sie zum Senden von Benachrichtigungen an Ihre Benutzer verwenden möchten.", + "DESCRIPTION": "Dies sind die SMTP-Anbieter für Ihre ZITADEL-Instanz. Aktivieren Sie diejenige, die Sie zum Senden von Benachrichtigungen an Ihre Benutzer verwenden möchten.", "EMPTY": "Kein SMTP-Anbieter verfügbar", "ACTIVATED": "Aktiviert", "ACTIVATE": "Anbieter aktivieren", @@ -2255,7 +2255,16 @@ "CURRENT_DESC_TITLE": "Dies sind Ihre SMTP-Einstellungen", "PROVIDER_SETTINGS": "SMTP-Anbietereinstellungen", "SENDER_SETTINGS": "Absendereinstellungen", - "TEST_SETTINGS": "Testen Sie die SMTP-Einstellungen" + "TEST_SETTINGS": "Testen Sie die SMTP-Einstellungen", + "NEXT_STEPS": "Nächste Schritte", + "ACTIVATE": { + "TITLE": "Aktivieren Sie Ihren SMTP-Anbieter", + "DESCRIPTION": "ZITADEL kann diesen SMTP-Anbieter nicht zum Senden von Benachrichtigungen verwenden, bis Sie ihn aktivieren. Wenn Sie diesen Anbieter aktivieren, werden alle anderen aktiven Anbieter nun deaktiviert." + }, + "DEACTIVATE": { + "TITLE": "Deaktivieren Sie Ihren SMTP-Anbieter", + "DESCRIPTION": "Wenn Sie diesen SMTP-Anbieter deaktivieren, kann ZITADEL ihn nicht zum Versenden von Benachrichtigungen verwenden, bis Sie ihn erneut aktivieren." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json index f779856b61..d85616fe5e 100644 --- a/console/src/assets/i18n/en.json +++ b/console/src/assets/i18n/en.json @@ -2246,7 +2246,7 @@ "SMTP": { "LIST": { "TITLE": "SMTP Provider", - "DESCRIPTION": "These are the SMTP providers for your Zitadel instance. Activate the one you want to use to send notifications to your users.", + "DESCRIPTION": "These are the SMTP providers for your ZITADEL instance. Activate the one you want to use to send notifications to your users.", "EMPTY": "No SMTP Provider available", "ACTIVATED": "Activated", "ACTIVATE": "Activate provider", @@ -2274,7 +2274,16 @@ "CURRENT_DESC_TITLE": "These are your SMTP settings", "PROVIDER_SETTINGS": "SMTP Provider Settings", "SENDER_SETTINGS": "Sender Settings", - "TEST_SETTINGS": "Test SMTP Settings" + "TEST_SETTINGS": "Test SMTP Settings", + "NEXT_STEPS": "Next Steps", + "ACTIVATE": { + "TITLE": "Activate your SMTP Provider", + "DESCRIPTION": "ZITADEL cannot use this SMTP Provider to send notifications until you activate it. If you activate this provider any other provider that was active will now be deactivated." + }, + "DEACTIVATE": { + "TITLE": "Deactivate your SMTP Provider", + "DESCRIPTION": "If you deactivate this SMTP Provider, ZITADEL cannot use it to send notifications until you activate it again." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/es.json b/console/src/assets/i18n/es.json index e85c698348..e07c0d978c 100644 --- a/console/src/assets/i18n/es.json +++ b/console/src/assets/i18n/es.json @@ -2225,7 +2225,7 @@ "SMTP": { "LIST": { "TITLE": "Proveedor SMTP", - "DESCRIPTION": "Estos son los proveedores SMTP para tu instancia de Zitadel. Activa el que quieras utilizar para enviar notificaciones a tus usuarios.", + "DESCRIPTION": "Estos son los proveedores SMTP para tu instancia de ZITADEL. Activa el que quieras utilizar para enviar notificaciones a tus usuarios.", "EMPTY": "No hay ningún proveedor SMTP disponible", "ACTIVATED": "Activado", "ACTIVATE": "Activar proveedor", @@ -2253,7 +2253,16 @@ "CURRENT_DESC_TITLE": "Estas son tus configuraciones SMTP", "PROVIDER_SETTINGS": "Configuración del proveedor SMTP", "SENDER_SETTINGS": "Configuración del remitente", - "TEST_SETTINGS": "Probar la configuración SMTP" + "TEST_SETTINGS": "Probar la configuración SMTP", + "NEXT_STEPS": "Pŕoximos pasos", + "ACTIVATE": { + "TITLE": "Activa tu proveedor SMTP", + "DESCRIPTION": "ZITADEL no puede usar este proveedor SMTP para enviar notificaciones hasta que lo actives. Si activas este proveedor cualquier otro proveedor que estuviera activado será desactivado ahora." + }, + "DEACTIVATE": { + "TITLE": "Desactiva tu proveedor SMTP", + "DESCRIPTION": "Si desactivas este proveedor SMTP, ZITADEL no puede utilizarlo para enviar notificationes hasta que lo actives otra vez." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/fr.json b/console/src/assets/i18n/fr.json index 92d18bffce..d5fbfd9c08 100644 --- a/console/src/assets/i18n/fr.json +++ b/console/src/assets/i18n/fr.json @@ -2228,7 +2228,7 @@ "SMTP": { "LIST": { "TITLE": "Fournisseur SMTP", - "DESCRIPTION": "Ce sont les fournisseurs SMTP de votre instance Zitadel. Activez celui que vous souhaitez utiliser pour envoyer des notifications à vos utilisateurs.", + "DESCRIPTION": "Ce sont les fournisseurs SMTP de votre instance ZITADEL. Activez celui que vous souhaitez utiliser pour envoyer des notifications à vos utilisateurs.", "EMPTY": "Aucun fournisseur SMTP disponible", "ACTIVATED": "Activé", "ACTIVATE": "Activer le fournisseur", @@ -2256,7 +2256,16 @@ "CURRENT_DESC_TITLE": "Ce sont vos paramètres SMTP", "PROVIDER_SETTINGS": "Paramètres du fournisseur SMTP", "SENDER_SETTINGS": "Paramètres de l'expéditeur", - "TEST_SETTINGS": "Tester les paramètres SMTP" + "TEST_SETTINGS": "Tester les paramètres SMTP", + "NEXT_STEPS": "Prochaines étapes", + "ACTIVATE": { + "TITLE": "Activez votre fournisseur SMTP", + "DESCRIPTION": "ZITADEL ne peut pas utiliser ce fournisseur SMTP pour envoyer des notifications tant que vous ne l'avez pas activé. Si vous activez ce fournisseur, tout autre fournisseur qui était actif sera désormais désactivé." + }, + "DEACTIVATE": { + "TITLE": "Désactivez votre fournisseur SMTP", + "DESCRIPTION": "Si vous désactivez l'option SMTP, vous ne pourrez pas vous connecter à l'application, le dossier sera alors désactivé." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/it.json b/console/src/assets/i18n/it.json index 2fe90b412c..3d986999eb 100644 --- a/console/src/assets/i18n/it.json +++ b/console/src/assets/i18n/it.json @@ -2228,7 +2228,7 @@ "SMTP": { "LIST": { "TITLE": "Fornitore SMTP", - "DESCRIPTION": "Questi sono i provider SMTP per la tua istanza Zitadel. Attiva quello che desideri utilizzare per inviare notifiche ai tuoi utenti.", + "DESCRIPTION": "Questi sono i provider SMTP per la tua istanza ZITADEL. Attiva quello che desideri utilizzare per inviare notifiche ai tuoi utenti.", "EMPTY": "Nessun provider SMTP disponibile", "ACTIVATED": "Attivato", "ACTIVATE": "Attiva fornitore", @@ -2256,7 +2256,16 @@ "CURRENT_DESC_TITLE": "Queste sono le tue impostazioni SMTP", "PROVIDER_SETTINGS": "Impostazioni del provider SMTP", "SENDER_SETTINGS": "Impostazioni mittente", - "TEST_SETTINGS": "Testare le impostazioni SMTP" + "TEST_SETTINGS": "Testare le impostazioni SMTP", + "NEXT_STEPS": "Prossimi passi", + "ACTIVATE": { + "TITLE": "Attiva il tuo provider SMTP", + "DESCRIPTION": "ZITADEL non può utilizzare questo provider SMTP per inviare notifiche finché non lo attivi. Se attivi questo fornitore, qualsiasi altro fornitore che era attivo verrà ora disattivato." + }, + "DEACTIVATE": { + "TITLE": "Disattiva il tuo provider SMTP", + "DESCRIPTION": "Dopo aver disattivato l'archivio SMTP, la schermata non è disponibile per l'utente, il documento è nuovo e non è attivo." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/ja.json b/console/src/assets/i18n/ja.json index d6ea29dca4..82f36fa7bf 100644 --- a/console/src/assets/i18n/ja.json +++ b/console/src/assets/i18n/ja.json @@ -2220,7 +2220,7 @@ "SMTP": { "LIST": { "TITLE": "SMTPプロバイダー", - "DESCRIPTION": "これらは、Zitadel インスタンスの SMTP プロバイダーです。ユーザーに通知を送信するために使用するものをアクティブにします。", + "DESCRIPTION": "これらは、ZITADEL インスタンスの SMTP プロバイダーです。ユーザーに通知を送信するために使用するものをアクティブにします。", "EMPTY": "使用可能な SMTP プロバイダーがありません", "ACTIVATED": "アクティブ化された", "ACTIVATE": "プロバイダーをアクティブ化する", @@ -2248,7 +2248,16 @@ "CURRENT_DESC_TITLE": "これらは SMTP 設定です", "PROVIDER_SETTINGS": "SMTPプロバイダーの設定", "SENDER_SETTINGS": "送信者の設定", - "TEST_SETTINGS": "SMTP設定をテストする" + "TEST_SETTINGS": "SMTP設定をテストする", + "NEXT_STEPS": "次のステップ", + "ACTIVATE": { + "TITLE": "SMTP プロバイダーをアクティブ化する", + "DESCRIPTION": "ZITADEL は、アクティブ化するまで、この SMTP プロバイダーを使用して通知を送信できません。このプロバイダーをアクティブ化すると、アクティブだった他のプロバイダーは非アクティブ化されます。" + }, + "DEACTIVATE": { + "TITLE": "SMTPプロバイダーを非アクティブ化します", + "DESCRIPTION": "この SMTP プロバイダーを非アクティブ化すると、再度アクティブ化するまで、Zitadel はそれを使用して通知を送信できなくなります。" + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/mk.json b/console/src/assets/i18n/mk.json index 8e2d5376cd..7b0095bf5e 100644 --- a/console/src/assets/i18n/mk.json +++ b/console/src/assets/i18n/mk.json @@ -2225,7 +2225,7 @@ "SMTP": { "LIST": { "TITLE": "SMTP провајдер", - "DESCRIPTION": "Ова се давателите на SMTP за вашиот пример Zitadel. Активирајте го оној што сакате да го користите за испраќање известувања до вашите корисници.", + "DESCRIPTION": "Ова се давателите на SMTP за вашиот пример ZITADEL. Активирајте го оној што сакате да го користите за испраќање известувања до вашите корисници.", "EMPTY": "Нема достапен SMTP провајдер", "ACTIVATED": "Активиран", "ACTIVATE": "Активирајте го провајдерот", @@ -2253,7 +2253,16 @@ "CURRENT_DESC_TITLE": "Ова се вашите поставки за SMTP", "PROVIDER_SETTINGS": "Поставки на провајдерот SMTP", "SENDER_SETTINGS": "Поставки на испраќачот", - "TEST_SETTINGS": "Тестирајте ги поставките за SMTP" + "TEST_SETTINGS": "Тестирајте ги поставките за SMTP", + "NEXT_STEPS": "Следните чекори", + "ACTIVATE": { + "TITLE": "Активирајте го вашиот SMTP провајдер", + "DESCRIPTION": "ZITADEL не може да го користи овој SMTP провајдер за да испраќа известувања додека не го активирате. Ако го активирате овој добавувач, секој друг провајдер што бил активен сега ќе се деактивира." + }, + "DEACTIVATE": { + "TITLE": "Деактивирајте го вашиот SMTP провајдер", + "DESCRIPTION": "Ако го деактивирате овој SMTP провајдер, ZITADEL не може да го користи за испраќање известувања додека не го активирате повторно." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/nl.json b/console/src/assets/i18n/nl.json index 2fecd6c057..296ddb3b3c 100644 --- a/console/src/assets/i18n/nl.json +++ b/console/src/assets/i18n/nl.json @@ -2246,7 +2246,7 @@ "SMTP": { "LIST": { "TITLE": "SMTP-provider", - "DESCRIPTION": "Dit zijn de SMTP-providers voor uw Zitadel-instantie. Activeer degene die u wilt gebruiken om meldingen naar uw gebruikers te sturen.", + "DESCRIPTION": "Dit zijn de SMTP-providers voor uw ZITADEL-instantie. Activeer degene die u wilt gebruiken om meldingen naar uw gebruikers te sturen.", "EMPTY": "Geen SMTP-provider beschikbaar", "ACTIVATED": "Geactiveerd", "ACTIVATE": "Aanbieder activeren", @@ -2274,7 +2274,16 @@ "CURRENT_DESC_TITLE": "Dit zijn uw SMTP-instellingen", "PROVIDER_SETTINGS": "SMTP-providerinstellingen", "SENDER_SETTINGS": "Afzenderinstellingen", - "TEST_SETTINGS": "SMTP-instellingen testen" + "TEST_SETTINGS": "SMTP-instellingen testen", + "NEXT_STEPS": "Volgende stappen", + "ACTIVATE": { + "TITLE": "Activeer uw SMTP-provider", + "DESCRIPTION": "ZITADEL kan deze SMTP-provider niet gebruiken om meldingen te verzenden totdat u deze activeert. Als u deze provider activeert, worden alle andere actieve providers nu gedeactiveerd." + }, + "DEACTIVATE": { + "TITLE": "Deactiveer uw SMTP-provider", + "DESCRIPTION": "Als u deze SMTP-provider deactiveert, kan ZITADEL deze niet gebruiken om meldingen te verzenden totdat u deze opnieuw activeert." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/pl.json b/console/src/assets/i18n/pl.json index 40b772d3af..cab3498076 100644 --- a/console/src/assets/i18n/pl.json +++ b/console/src/assets/i18n/pl.json @@ -2228,7 +2228,7 @@ "SMTP": { "LIST": { "TITLE": "Dostawca SMTP", - "DESCRIPTION": "To są dostawcy SMTP dla Twojej instancji Zitadel. Aktywuj ten, którego chcesz używać do wysyłania powiadomień do użytkowników.", + "DESCRIPTION": "To są dostawcy SMTP dla Twojej instancji ZITADEL. Aktywuj ten, którego chcesz używać do wysyłania powiadomień do użytkowników.", "EMPTY": "Brak dostępnego dostawcy SMTP", "ACTIVATED": "Aktywowany", "ACTIVATE": "Aktywuj dostawcę", @@ -2256,7 +2256,16 @@ "CURRENT_DESC_TITLE": "To są Twoje ustawienia SMTP", "PROVIDER_SETTINGS": "Ustawienia dostawcy SMTP", "SENDER_SETTINGS": "Ustawienia nadawcy", - "TEST_SETTINGS": "Przetestuj ustawienia SMTP" + "TEST_SETTINGS": "Przetestuj ustawienia SMTP", + "NEXT_STEPS": "Następne kroki", + "ACTIVATE": { + "TITLE": "Aktywuj swojego dostawcę SMTP", + "DESCRIPTION": "ZITADEL nie może używać tego dostawcy SMTP do wysyłania powiadomień, dopóki go nie aktywujesz. Jeśli aktywujesz tego dostawcę, każdy inny aktywny dostawca zostanie teraz dezaktywowany." + }, + "DEACTIVATE": { + "TITLE": "Dezaktywuj swojego dostawcę SMTP", + "DESCRIPTION": "Jeśli dezaktywujesz tego dostawcę SMTP, ZITADEL nie będzie mógł go używać do wysyłania powiadomień, dopóki nie aktywujesz go ponownie." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/pt.json b/console/src/assets/i18n/pt.json index 17263c72f5..1c9d5a3c36 100644 --- a/console/src/assets/i18n/pt.json +++ b/console/src/assets/i18n/pt.json @@ -2223,7 +2223,7 @@ "SMTP": { "LIST": { "TITLE": "Provedor SMTP", - "DESCRIPTION": "Estes são os provedores SMTP para sua instância Zitadel. Ative aquele que deseja usar para enviar notificações aos seus usuários.", + "DESCRIPTION": "Estes são os provedores SMTP para sua instância ZITADEL. Ative aquele que deseja usar para enviar notificações aos seus usuários.", "EMPTY": "Nenhum provedor SMTP disponível", "ACTIVATED": "Ativado", "ACTIVATE": "Ativar provedor", @@ -2251,7 +2251,16 @@ "CURRENT_DESC_TITLE": "Estas são suas configurações de SMTP", "PROVIDER_SETTINGS": "Configurações do provedor SMTP", "SENDER_SETTINGS": "Configurações do remetente", - "TEST_SETTINGS": "Testar configurações de SMTP" + "TEST_SETTINGS": "Testar configurações de SMTP", + "NEXT_STEPS": "Próximos passos", + "ACTIVATE": { + "TITLE": "Ative seu provedor SMTP", + "DESCRIPTION": "ZITADEL não pode usar este provedor SMTP para enviar notificações até que você o ative. Se você ativar este provedor, qualquer outro provedor que estava ativo será desativado." + }, + "DEACTIVATE": { + "TITLE": "Desative seu provedor SMTP", + "DESCRIPTION": "Se você desativar este provedor SMTP, a ZITADEL não poderá usá-lo para enviar notificações até que você o ative novamente." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/ru.json b/console/src/assets/i18n/ru.json index e408d47930..4363ee1ae7 100644 --- a/console/src/assets/i18n/ru.json +++ b/console/src/assets/i18n/ru.json @@ -2340,7 +2340,7 @@ "SMTP": { "LIST": { "TITLE": "SMTP-провайдер", - "DESCRIPTION": "Это поставщики SMTP для вашего экземпляра Zitadel. Активируйте тот, который вы хотите использовать для отправки уведомлений вашим пользователям.", + "DESCRIPTION": "Это поставщики SMTP для вашего экземпляра ZITADEL. Активируйте тот, который вы хотите использовать для отправки уведомлений вашим пользователям.", "EMPTY": "SMTP-провайдер не доступен", "ACTIVATED": "Активировано", "ACTIVATE": "Активировать провайдера", @@ -2368,7 +2368,16 @@ "CURRENT_DESC_TITLE": "Это ваши настройки SMTP", "PROVIDER_SETTINGS": "Настройки SMTP-провайдера", "SENDER_SETTINGS": "Настройки отправителя", - "TEST_SETTINGS": "Проверка настроек SMTP" + "TEST_SETTINGS": "Проверка настроек SMTP", + "NEXT_STEPS": "Следующие шаги", + "ACTIVATE": { + "TITLE": "Активируйте своего SMTP-провайдера", + "DESCRIPTION": "ZITADEL не может использовать этого поставщика SMTP для отправки уведомлений, пока вы его не активируете. Если вы активируете этого провайдера, любой другой провайдер, который был активен, теперь будет деактивирован." + }, + "DEACTIVATE": { + "TITLE": "Деактивируйте своего SMTP-провайдера", + "DESCRIPTION": "Если вы деактивируете этого поставщика SMTP, ZITADEL не сможет использовать его для отправки уведомлений, пока вы не активируете его снова." + } } }, "DETAIL": { diff --git a/console/src/assets/i18n/zh.json b/console/src/assets/i18n/zh.json index 9b9b820bb7..f983fcf138 100644 --- a/console/src/assets/i18n/zh.json +++ b/console/src/assets/i18n/zh.json @@ -2227,7 +2227,7 @@ "SMTP": { "LIST": { "TITLE": "SMTP 提供商", - "DESCRIPTION": "这些是您的 Zitadel 实例的 SMTP 提供商。激活您想要用来向用户发送通知的通知。", + "DESCRIPTION": "这些是您的 ZITADEL 实例的 SMTP 提供商。激活您想要用来向用户发送通知的通知。", "EMPTY": "没有可用的 SMTP 提供商", "ACTIVATED": "活性", "ACTIVATE": "激活提供商", @@ -2255,7 +2255,16 @@ "CURRENT_DESC_TITLE": "这些是您的 SMTP 设置", "PROVIDER_SETTINGS": "SMTP 提供商设置", "SENDER_SETTINGS": "发件人设置", - "TEST_SETTINGS": "测试 SMTP 设置" + "TEST_SETTINGS": "测试 SMTP 设置", + "NEXT_STEPS": "下一步", + "ACTIVATE": { + "TITLE": "激活您的 SMTP 提供商", + "DESCRIPTION": "在您激活此 SMTP 提供程序之前，Zitadel 无法使用它来发送通知。如果您激活此提供程序，任何其他处于活动状态的提供程序现在都将被停用。" + }, + "DEACTIVATE": { + "TITLE": "停用您的 SMTP 提供商", + "DESCRIPTION": "如果您停用此 SMTP 提供程序，Zitadel 将无法使用它发送通知，直到您再次激活它。" + } } }, "DETAIL": { diff --git a/e2e/cypress/e2e/instance/settings/notifications.cy.ts b/e2e/cypress/e2e/instance/settings/notifications.cy.ts index 24ac3488c6..ce500fc92e 100644 --- a/e2e/cypress/e2e/instance/settings/notifications.cy.ts +++ b/e2e/cypress/e2e/instance/settings/notifications.cy.ts @@ -32,6 +32,7 @@ describe('instance notifications', () => { cy.get('[formcontrolname="replyToAddress"]').clear().type('replyto1@example.com'); cy.get('[data-e2e="create-button"]').click(); cy.shouldConfirmSuccess(); + cy.get('[data-e2e="close-button"]').click(); cy.get('tr').contains('mailgun'); cy.get('tr').contains('smtp.mailgun.org:587'); cy.get('tr').contains('sender1@example.com'); @@ -51,6 +52,7 @@ describe('instance notifications', () => { cy.get('[formcontrolname="senderName"]').clear().type('Change1'); cy.get('[data-e2e="create-button"]').click(); cy.shouldConfirmSuccess(); + cy.get('[data-e2e="close-button"]').click(); rowSelector = `tr:contains('mailgun')`; cy.get(rowSelector).contains('mailgun'); cy.get(rowSelector).contains('smtp.mailgun.org:587'); @@ -81,6 +83,7 @@ describe('instance notifications', () => { cy.get('[formcontrolname="replyToAddress"]').clear().type('replyto2@example.com'); cy.get('[data-e2e="create-button"]').click(); cy.shouldConfirmSuccess(); + cy.get('[data-e2e="close-button"]').click(); rowSelector = `tr:contains('mailjet')`; cy.get(rowSelector).contains('mailjet'); cy.get(rowSelector).contains('in-v3.mailjet.com:587'); @@ -130,6 +133,51 @@ describe('instance notifications', () => { rowSelector = `tr:contains('mailgun')`; cy.get(rowSelector).should('not.exist'); }); + it(`should add Mailgun SMTP provider settings and activate it using wizard`, () => { + let rowSelector = `a:contains('Mailgun')`; + cy.visit(smtpPath); + cy.get(rowSelector).click(); + cy.get('[formcontrolname="hostAndPort"]').should('have.value', 'smtp.mailgun.org:587'); + cy.get('[formcontrolname="user"]').clear().type('user@example.com'); + cy.get('[formcontrolname="password"]').clear().type('password'); + cy.get('[data-e2e="continue-button"]').click(); + cy.get('[formcontrolname="senderAddress"]').clear().type('sender1@example.com'); + cy.get('[formcontrolname="senderName"]').clear().type('Test1'); + cy.get('[formcontrolname="replyToAddress"]').clear().type('replyto1@example.com'); + cy.get('[data-e2e="create-button"]').click(); + cy.shouldConfirmSuccess(); + cy.get('[data-e2e="activate-button"]').click(); + cy.shouldConfirmSuccess(); + cy.get('[data-e2e="close-button"]').click(); + rowSelector = `tr:contains('smtp.mailgun.org:587')`; + cy.get(rowSelector).find('[data-e2e="active-provider"]'); + cy.get(rowSelector).contains('mailgun'); + cy.get(rowSelector).contains('smtp.mailgun.org:587'); + cy.get(rowSelector).contains('sender1@example.com'); + }); + it(`should add Mailgun SMTP provider settings and deactivate it using wizard`, () => { + let rowSelector = `tr:contains('mailgun')`; + cy.visit(smtpPath); + cy.get(rowSelector).click(); + cy.get('[data-e2e="continue-button"]').click(); + cy.get('[data-e2e="create-button"]').click(); + cy.shouldConfirmSuccess(); + cy.get('[data-e2e="deactivate-button"]').click(); + cy.shouldConfirmSuccess(); + cy.get('[data-e2e="close-button"]').click(); + rowSelector = `tr:contains('mailgun')`; + cy.get(rowSelector).find('[data-e2e="active-provider"]').should('not.exist'); + }); + it(`should delete Mailgun SMTP provider`, () => { + let rowSelector = `tr:contains('mailgun')`; + cy.visit(smtpPath); + cy.get(rowSelector).find('[data-e2e="delete-provider-button"]').click({ force: true }); + cy.get('[data-e2e="confirm-dialog-input"]').focus().type('Test1'); + cy.get('[data-e2e="confirm-dialog-button"]').click(); + cy.shouldConfirmSuccess(); + rowSelector = `tr:contains('mailgun')`; + cy.get(rowSelector).should('not.exist'); + }); }); describe('sms settings', () => { diff --git a/e2e/cypress/e2e/organization/organizations.cy.ts b/e2e/cypress/e2e/organization/organizations.cy.ts index b0e1f515e9..37e29e7f48 100644 --- a/e2e/cypress/e2e/organization/organizations.cy.ts +++ b/e2e/cypress/e2e/organization/organizations.cy.ts @@ -26,8 +26,9 @@ describe('organizations', () => { it('should delete an org', () => { cy.visit(orgsPath); cy.contains('tr', newOrg).click(); + cy.wait(3000); cy.get('[data-e2e="actions"]').click(); - cy.get('[data-e2e="delete"]', { timeout: 3000 }).should('be.visible').click(); + cy.get('[data-e2e="delete"]', { timeout: 1000 }).should('be.visible').click(); cy.get('[data-e2e="confirm-dialog-input"]').focus().clear().type(newOrg); cy.get('[data-e2e="confirm-dialog-button"]').click(); cy.shouldConfirmSuccess(); diff --git a/internal/api/grpc/admin/iam_settings_converter.go b/internal/api/grpc/admin/iam_settings_converter.go index 66e0dd3653..b967faf4c5 100644 --- a/internal/api/grpc/admin/iam_settings_converter.go +++ b/internal/api/grpc/admin/iam_settings_converter.go @@ -172,6 +172,7 @@ func SMTPConfigToPb(smtp *query.SMTPConfig) *settings_pb.SMTPConfig { User: smtp.User, Details: obj_grpc.ToViewDetailsPb(smtp.Sequence, smtp.CreationDate, smtp.ChangeDate, smtp.ResourceOwner), Id: smtp.ID, + State: settings_pb.SMTPConfigState(smtp.State), } return mapped } From fb162a7d754f20f6ab6b4c403dbd0d962b710c1b Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Wed, 22 May 2024 17:26:02 +0200 Subject: [PATCH 18/35] fix(login): improve auth handlers (#7969) # Which Problems Are Solved During the implementation of #7486 it was noticed, that projections in the `auth` database schema could be blocked. Investigations suggested, that this is due to the use of [GORM](https://gorm.io/index.html) and it's inability to use an existing (sql) transaction. With the improved / simplified handling (see below) there should also be a minimal improvement in performance, resp. reduced database update statements. # How the Problems Are Solved The handlers in `auth` are exchanged to proper (sql) statements and gorm usage is removed for any writing part. To further improve / simplify the handling of the users, a new `auth.users3` table is created, where only attributes are handled, which are not yet available from the `projections.users`, `projections.login_name` and `projections.user_auth_methods` do not provide. This reduces the events handled in that specific handler by a lot. # Additional Changes None # Additional Context relates to #7486 --- cmd/setup/26.go | 27 + cmd/setup/26.sql | 16 + cmd/setup/config.go | 1 + cmd/setup/setup.go | 2 + .../eventsourcing/eventstore/auth_request.go | 4 +- .../eventstore/auth_request_test.go | 13 +- .../eventsourcing/handler/refresh_token.go | 126 +++-- .../repository/eventsourcing/handler/token.go | 293 ++++++---- .../repository/eventsourcing/handler/user.go | 503 +++++------------- .../eventsourcing/handler/user_session.go | 321 +++++++---- .../eventsourcing/view/refresh_token.go | 51 -- .../repository/eventsourcing/view/token.go | 66 --- .../repository/eventsourcing/view/user.go | 39 +- .../eventsourcing/view/user_session.go | 30 -- internal/eventstore/handler/v2/statement.go | 7 + .../repository/view/model/refresh_token.go | 31 +- internal/user/repository/view/model/token.go | 70 +-- internal/user/repository/view/model/user.go | 48 +- .../repository/view/model/user_session.go | 137 ++--- .../view/model/user_session_test.go | 81 ++- .../repository/view/refresh_token_view.go | 65 --- internal/user/repository/view/token_view.go | 71 --- internal/user/repository/view/user_by_id.sql | 93 ++++ .../user/repository/view/user_session_view.go | 59 +- internal/user/repository/view/user_view.go | 112 +--- 25 files changed, 987 insertions(+), 1279 deletions(-) create mode 100644 cmd/setup/26.go create mode 100644 cmd/setup/26.sql create mode 100644 internal/user/repository/view/user_by_id.sql diff --git a/cmd/setup/26.go b/cmd/setup/26.go new file mode 100644 index 0000000000..860198a75c --- /dev/null +++ b/cmd/setup/26.go @@ -0,0 +1,27 @@ +package setup + +import ( + "context" + _ "embed" + + "github.com/zitadel/zitadel/internal/database" + "github.com/zitadel/zitadel/internal/eventstore" +) + +var ( + //go:embed 26.sql + authUsers3 string +) + +type AuthUsers3 struct { + dbClient *database.DB +} + +func (mig *AuthUsers3) Execute(ctx context.Context, _ eventstore.Event) error { + _, err := mig.dbClient.ExecContext(ctx, authUsers3) + return err +} + +func (mig *AuthUsers3) String() string { + return "26_auth_users3" +} diff --git a/cmd/setup/26.sql b/cmd/setup/26.sql new file mode 100644 index 0000000000..fa709d667d --- /dev/null +++ b/cmd/setup/26.sql @@ -0,0 +1,16 @@ +CREATE TABLE IF NOT EXISTS auth.users3 ( + instance_id TEXT NOT NULL, + id TEXT NOT NULL, + resource_owner TEXT NOT NULL, + change_date TIMESTAMPTZ NULL, + password_set BOOL NULL, + password_change TIMESTAMPTZ NULL, + last_login TIMESTAMPTZ NULL, + init_required BOOL NULL, + mfa_init_skipped TIMESTAMPTZ NULL, + username_change_required BOOL NULL, + passwordless_init_required BOOL NULL, + password_init_required BOOL NULL, + + PRIMARY KEY (instance_id, id) +) diff --git a/cmd/setup/config.go b/cmd/setup/config.go index bb96e9912b..c66edb4db3 100644 --- a/cmd/setup/config.go +++ b/cmd/setup/config.go @@ -108,6 +108,7 @@ type Steps struct { s23CorrectGlobalUniqueConstraints *CorrectGlobalUniqueConstraints s24AddActorToAuthTokens *AddActorToAuthTokens s25User11AddLowerFieldsToVerifiedEmail *User11AddLowerFieldsToVerifiedEmail + s26AuthUsers3 *AuthUsers3 } func MustNewSteps(v *viper.Viper) *Steps { diff --git a/cmd/setup/setup.go b/cmd/setup/setup.go index 693ec81e32..96d0f05bc9 100644 --- a/cmd/setup/setup.go +++ b/cmd/setup/setup.go @@ -138,6 +138,7 @@ func Setup(config *Config, steps *Steps, masterKey string) { steps.s23CorrectGlobalUniqueConstraints = &CorrectGlobalUniqueConstraints{dbClient: esPusherDBClient} steps.s24AddActorToAuthTokens = &AddActorToAuthTokens{dbClient: queryDBClient} steps.s25User11AddLowerFieldsToVerifiedEmail = &User11AddLowerFieldsToVerifiedEmail{dbClient: esPusherDBClient} + steps.s26AuthUsers3 = &AuthUsers3{dbClient: esPusherDBClient} err = projection.Create(ctx, projectionDBClient, eventstoreClient, config.Projections, nil, nil, nil) logging.OnError(err).Fatal("unable to start projections") @@ -175,6 +176,7 @@ func Setup(config *Config, steps *Steps, masterKey string) { steps.s22ActiveInstancesIndex, steps.s23CorrectGlobalUniqueConstraints, steps.s24AddActorToAuthTokens, + steps.s26AuthUsers3, } { mustExecuteMigration(ctx, eventstoreClient, step, "migration failed") } diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request.go b/internal/auth/repository/eventsourcing/eventstore/auth_request.go index 80dc085e44..76102a916e 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request.go @@ -1517,12 +1517,12 @@ func userSessionByIDs(ctx context.Context, provider userSessionViewProvider, eve user_repo.HumanPasswordlessTokenCheckFailedType, user_repo.HumanU2FTokenCheckSucceededType, user_repo.HumanU2FTokenCheckFailedType: - eventData, err := user_view_model.UserSessionFromEvent(event) + userAgentID, err := user_view_model.UserAgentIDFromEvent(event) if err != nil { logging.WithFields("traceID", tracing.TraceIDFromCtx(ctx)).WithError(err).Debug("error getting event data") return user_view_model.UserSessionToModel(session), nil } - if eventData.UserAgentID != agentID { + if userAgentID != agentID { continue } case user_repo.UserRemovedType: diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go b/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go index f1f762e525..324039a765 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go @@ -2,6 +2,7 @@ package eventstore import ( "context" + "database/sql" "encoding/json" "testing" "time" @@ -75,11 +76,11 @@ type mockUser struct { func (m *mockViewUserSession) UserSessionByIDs(string, string, string) (*user_view_model.UserSessionView, error) { return &user_view_model.UserSessionView{ - ExternalLoginVerification: m.ExternalLoginVerification, - PasswordlessVerification: m.PasswordlessVerification, - PasswordVerification: m.PasswordVerification, - SecondFactorVerification: m.SecondFactorVerification, - MultiFactorVerification: m.MultiFactorVerification, + ExternalLoginVerification: sql.NullTime{Time: m.ExternalLoginVerification}, + PasswordlessVerification: sql.NullTime{Time: m.PasswordlessVerification}, + PasswordVerification: sql.NullTime{Time: m.PasswordVerification}, + SecondFactorVerification: sql.NullTime{Time: m.SecondFactorVerification}, + MultiFactorVerification: sql.NullTime{Time: m.MultiFactorVerification}, }, nil } @@ -90,7 +91,7 @@ func (m *mockViewUserSession) UserSessionsByAgentID(string, string) ([]*user_vie ResourceOwner: user.ResourceOwner, State: int32(user.SessionState), UserID: user.UserID, - LoginName: user.LoginName, + LoginName: sql.NullString{String: user.LoginName}, } } return sessions, nil diff --git a/internal/auth/repository/eventsourcing/handler/refresh_token.go b/internal/auth/repository/eventsourcing/handler/refresh_token.go index 4dac7eab6f..c63f581237 100644 --- a/internal/auth/repository/eventsourcing/handler/refresh_token.go +++ b/internal/auth/repository/eventsourcing/handler/refresh_token.go @@ -3,8 +3,6 @@ package handler import ( "context" - "github.com/zitadel/logging" - auth_view "github.com/zitadel/zitadel/internal/auth/repository/eventsourcing/view" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/eventstore/handler/v2" @@ -98,50 +96,84 @@ func (t *RefreshToken) Reducers() []handler.AggregateReducer { } func (t *RefreshToken) Reduce(event eventstore.Event) (_ *handler.Statement, err error) { - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - switch event.Type() { - case user.HumanRefreshTokenAddedType: - token := new(view_model.RefreshTokenView) - err := token.AppendEvent(event) - if err != nil { - return err - } - - return t.view.PutRefreshToken(token) - case user.HumanRefreshTokenRenewedType: - e := new(user.HumanRefreshTokenRenewedEvent) - if err := event.Unmarshal(e); err != nil { - logging.WithError(err).Error("could not unmarshal event data") - return zerrors.ThrowInternal(nil, "MODEL-BHn75", "could not unmarshal data") - } - token, err := t.view.RefreshTokenByID(e.TokenID, event.Aggregate().InstanceID) - if err != nil { - return err - } - err = token.AppendEvent(event) - if err != nil { - return err - } - return t.view.PutRefreshToken(token) - case user.HumanRefreshTokenRemovedType: - e := new(user.HumanRefreshTokenRemovedEvent) - if err := event.Unmarshal(e); err != nil { - logging.WithError(err).Error("could not unmarshal event data") - return zerrors.ThrowInternal(nil, "MODEL-Bz653", "could not unmarshal data") - } - return t.view.DeleteRefreshToken(e.TokenID, event.Aggregate().InstanceID) - case user.UserLockedType, - user.UserDeactivatedType, - user.UserRemovedType: - - return t.view.DeleteUserRefreshTokens(event.Aggregate().ID, event.Aggregate().InstanceID) - case instance.InstanceRemovedEventType: - - return t.view.DeleteInstanceRefreshTokens(event.Aggregate().InstanceID) - case org.OrgRemovedEventType: - return t.view.DeleteOrgRefreshTokens(event) - default: - return nil + // in case anything needs to be change here check if appendEvent function needs the change as well + switch event.Type() { + case user.HumanRefreshTokenAddedType: + e, ok := event.(*user.HumanRefreshTokenAddedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-IoF6j", "reduce.wrong.event.type %s", user.HumanRefreshTokenAddedType) } - }), nil + columns := []handler.Column{ + handler.NewCol(view_model.RefreshTokenKeyClientID, e.ClientID), + handler.NewCol(view_model.RefreshTokenKeyUserAgentID, e.UserAgentID), + handler.NewCol(view_model.RefreshTokenKeyUserID, e.Aggregate().ID), + handler.NewCol(view_model.RefreshTokenKeyInstanceID, e.Aggregate().InstanceID), + handler.NewCol(view_model.RefreshTokenKeyTokenID, e.TokenID), + handler.NewCol(view_model.RefreshTokenKeyResourceOwner, e.Aggregate().ResourceOwner), + handler.NewCol(view_model.RefreshTokenKeyCreationDate, event.CreatedAt()), + handler.NewCol(view_model.RefreshTokenKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.RefreshTokenKeySequence, event.Sequence()), + handler.NewCol(view_model.RefreshTokenKeyAMR, e.AuthMethodsReferences), + handler.NewCol(view_model.RefreshTokenKeyAuthTime, e.AuthTime), + handler.NewCol(view_model.RefreshTokenKeyAudience, e.Audience), + handler.NewCol(view_model.RefreshTokenKeyExpiration, event.CreatedAt().Add(e.Expiration)), + handler.NewCol(view_model.RefreshTokenKeyIdleExpiration, event.CreatedAt().Add(e.IdleExpiration)), + handler.NewCol(view_model.RefreshTokenKeyScopes, e.Scopes), + handler.NewCol(view_model.RefreshTokenKeyToken, e.TokenID), + handler.NewCol(view_model.RefreshTokenKeyActor, view_model.TokenActor{TokenActor: e.Actor}), + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.HumanRefreshTokenRenewedType: + e, ok := event.(*user.HumanRefreshTokenRenewedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-AG43hq", "reduce.wrong.event.type %s", user.HumanRefreshTokenRenewedType) + } + return handler.NewUpdateStatement(event, + []handler.Column{ + handler.NewCol(view_model.RefreshTokenKeyIdleExpiration, event.CreatedAt().Add(e.IdleExpiration)), + handler.NewCol(view_model.RefreshTokenKeyToken, e.RefreshToken), + handler.NewCol(view_model.RefreshTokenKeyChangeDate, e.CreatedAt()), + handler.NewCol(view_model.RefreshTokenKeySequence, event.Sequence()), + }, + []handler.Condition{ + handler.NewCond(view_model.RefreshTokenKeyTokenID, e.TokenID), + handler.NewCond(view_model.RefreshTokenKeyInstanceID, e.Aggregate().InstanceID), + }, + ), nil + case user.HumanRefreshTokenRemovedType: + e, ok := event.(*user.HumanRefreshTokenRemovedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-SFF3t", "reduce.wrong.event.type %s", user.HumanRefreshTokenRemovedType) + } + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.RefreshTokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.RefreshTokenKeyTokenID, e.TokenID), + }, + ), nil + case user.UserLockedType, + user.UserDeactivatedType, + user.UserRemovedType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.RefreshTokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.RefreshTokenKeyUserID, event.Aggregate().ID), + }, + ), nil + case instance.InstanceRemovedEventType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.RefreshTokenKeyInstanceID, event.Aggregate().InstanceID), + }, + ), nil + case org.OrgRemovedEventType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.RefreshTokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.RefreshTokenKeyResourceOwner, event.Aggregate().ResourceOwner), + }, + ), nil + default: + return handler.NewNoOpStatement(event), nil + } } diff --git a/internal/auth/repository/eventsourcing/handler/token.go b/internal/auth/repository/eventsourcing/handler/token.go index 4b0a7194de..d915037cb7 100644 --- a/internal/auth/repository/eventsourcing/handler/token.go +++ b/internal/auth/repository/eventsourcing/handler/token.go @@ -3,6 +3,7 @@ package handler import ( "context" + "github.com/muhlemmer/gu" "github.com/zitadel/logging" auth_view "github.com/zitadel/zitadel/internal/auth/repository/eventsourcing/view" @@ -150,129 +151,189 @@ func (t *Token) Reducers() []handler.AggregateReducer { } func (t *Token) Reduce(event eventstore.Event) (_ *handler.Statement, err error) { //nolint:gocognit - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - switch event.Type() { - case user.UserTokenAddedType, - user.PersonalAccessTokenAddedType: - token := new(view_model.TokenView) - err := token.AppendEvent(event) - if err != nil { - return err - } - return t.view.PutToken(token) - case user.UserV1ProfileChangedType, - user.HumanProfileChangedType: - user := new(view_model.UserView) - err := user.AppendEvent(event) - if err != nil { - return err - } - tokens, err := t.view.TokensByUserID(event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil { - return err - } - for _, token := range tokens { - token.PreferredLanguage = user.PreferredLanguage - } - return t.view.PutTokens(tokens) - case user.UserV1SignedOutType, - user.HumanSignedOutType: - id, err := agentIDFromSession(event) - if err != nil { - return err - } - - return t.view.DeleteSessionTokens(id, event) - case user.UserLockedType, - user.UserDeactivatedType, - user.UserRemovedType: - - return t.view.DeleteUserTokens(event) - case user.UserTokenRemovedType, - user.PersonalAccessTokenRemovedType: - id, err := tokenIDFromRemovedEvent(event) - if err != nil { - return err - } - - return t.view.DeleteToken(id, event.Aggregate().InstanceID) - case user.HumanRefreshTokenRemovedType: - id, err := refreshTokenIDFromRemovedEvent(event) - if err != nil { - return err - } - - return t.view.DeleteTokensFromRefreshToken(id, event.Aggregate().InstanceID) - case project.ApplicationDeactivatedType, - project.ApplicationRemovedType: - application, err := applicationFromSession(event) - if err != nil { - return err - } - - return t.view.DeleteApplicationTokens(event, application.AppID) - case project.ProjectDeactivatedType, - project.ProjectRemovedType: - project, err := t.getProjectByID(context.Background(), event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil { - return err - } - applicationIDs := make([]string, 0, len(project.Applications)) - for _, app := range project.Applications { - if app.OIDCConfig != nil && app.OIDCConfig.ClientID != "" { - applicationIDs = append(applicationIDs, app.OIDCConfig.ClientID) - } - } - - return t.view.DeleteApplicationTokens(event, applicationIDs...) - case instance.InstanceRemovedEventType: - return t.view.DeleteInstanceTokens(event) - case org.OrgRemovedEventType: - // deletes all tokens including PATs, which is expected for now - // if there is an undo of the org deletion in the future, - // we will need to have a look on how to handle the deleted PATs - return t.view.DeleteOrgTokens(event) - default: - return nil + // in case anything needs to be change here check if appendEvent function needs the change as well + switch event.Type() { + case user.UserTokenAddedType: + e, ok := event.(*user.UserTokenAddedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-W4tnq", "reduce.wrong.event.type %s", user.UserTokenAddedType) } - }), nil + return handler.NewCreateStatement(event, + []handler.Column{ + handler.NewCol(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCol(view_model.TokenKeyUserID, event.Aggregate().ID), + handler.NewCol(view_model.TokenKeyResourceOwner, event.Aggregate().ResourceOwner), + handler.NewCol(view_model.TokenKeyID, e.TokenID), + handler.NewCol(view_model.TokenKeyCreationDate, event.CreatedAt()), + handler.NewCol(view_model.TokenKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.TokenKeySequence, event.Sequence()), + handler.NewCol(view_model.TokenKeyApplicationID, e.ApplicationID), + handler.NewCol(view_model.TokenKeyUserAgentID, e.UserAgentID), + handler.NewCol(view_model.TokenKeyAudience, e.Audience), + handler.NewCol(view_model.TokenKeyScopes, e.Scopes), + handler.NewCol(view_model.TokenKeyExpiration, e.Expiration), + handler.NewCol(view_model.TokenKeyPreferredLanguage, e.PreferredLanguage), + handler.NewCol(view_model.TokenKeyRefreshTokenID, e.RefreshTokenID), + handler.NewCol(view_model.TokenKeyActor, view_model.TokenActor{TokenActor: e.Actor}), + handler.NewCol(view_model.TokenKeyIsPat, false), + }, + ), nil + case user.PersonalAccessTokenAddedType: + e, ok := event.(*user.PersonalAccessTokenAddedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-zF3rb", "reduce.wrong.event.type %s", user.PersonalAccessTokenAddedType) + } + return handler.NewCreateStatement(event, + []handler.Column{ + handler.NewCol(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCol(view_model.TokenKeyUserID, event.Aggregate().ID), + handler.NewCol(view_model.TokenKeyResourceOwner, event.Aggregate().ResourceOwner), + handler.NewCol(view_model.TokenKeyID, e.TokenID), + handler.NewCol(view_model.TokenKeyCreationDate, event.CreatedAt()), + handler.NewCol(view_model.TokenKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.TokenKeySequence, event.Sequence()), + handler.NewCol(view_model.TokenKeyScopes, e.Scopes), + handler.NewCol(view_model.TokenKeyExpiration, e.Expiration), + handler.NewCol(view_model.TokenKeyIsPat, true), + }, + ), nil + case user.UserV1ProfileChangedType, + user.HumanProfileChangedType: + e, ok := event.(*user.HumanProfileChangedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-ASF2t", "reduce.wrong.event.type %s", user.HumanProfileChangedType) + } + if e.PreferredLanguage == nil { + return handler.NewNoOpStatement(event), nil + } + return handler.NewUpdateStatement(event, + []handler.Column{ + handler.NewCol(view_model.TokenKeyPreferredLanguage, gu.Value(e.PreferredLanguage).String()), + handler.NewCol(view_model.TokenKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.TokenKeySequence, event.Sequence()), + }, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, e.Aggregate().InstanceID), + handler.NewCond(view_model.TokenKeyUserID, e.Aggregate().ID), + }, + ), nil + case user.UserV1SignedOutType, + user.HumanSignedOutType: + e, ok := event.(*user.HumanSignedOutEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-Wtn2q", "reduce.wrong.event.type %s", user.HumanSignedOutType) + } + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.TokenKeyUserID, event.Aggregate().ID), + handler.NewCond(view_model.TokenKeyUserAgentID, e.UserAgentID), + }, + ), nil + case user.UserLockedType, + user.UserDeactivatedType, + user.UserRemovedType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.TokenKeyUserID, event.Aggregate().ID), + }, + ), nil + case user.UserTokenRemovedType, + user.PersonalAccessTokenRemovedType: + var tokenID string + switch e := event.(type) { + case *user.UserTokenRemovedEvent: + tokenID = e.TokenID + case *user.PersonalAccessTokenRemovedEvent: + tokenID = e.TokenID + default: + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-SF3ga", "reduce.wrong.event.type %s", user.UserTokenRemovedType) + } + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.TokenKeyID, tokenID), + }, + ), nil + case user.HumanRefreshTokenRemovedType: + e, ok := event.(*user.HumanRefreshTokenRemovedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-Sfe11", "reduce.wrong.event.type %s", user.HumanRefreshTokenRemovedType) + } + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.TokenKeyRefreshTokenID, e.TokenID), + }, + ), nil + case project.ApplicationDeactivatedType, + project.ApplicationRemovedType: + var applicationID string + switch e := event.(type) { + case *project.ApplicationDeactivatedEvent: + applicationID = e.AppID + case *project.ApplicationRemovedEvent: + applicationID = e.AppID + default: + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-SF3fq", "reduce.wrong.event.type %v", []eventstore.EventType{project.ApplicationDeactivatedType, project.ApplicationRemovedType}) + } + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.TokenKeyApplicationID, applicationID), + }, + ), nil + case project.ProjectDeactivatedType, + project.ProjectRemovedType: + project, err := t.getProjectByID(context.Background(), event.Aggregate().ID, event.Aggregate().InstanceID) + if err != nil { + return nil, err + } + applicationIDs := make([]string, 0, len(project.Applications)) + for _, app := range project.Applications { + if app.OIDCConfig != nil && app.OIDCConfig.ClientID != "" { + applicationIDs = append(applicationIDs, app.OIDCConfig.ClientID) + } + } + if len(applicationIDs) == 0 { + return handler.NewNoOpStatement(event), nil + } + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewOneOfTextCond(view_model.TokenKeyApplicationID, applicationIDs), + }, + ), nil + case instance.InstanceRemovedEventType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + }, + ), nil + case org.OrgRemovedEventType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.TokenKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.TokenKeyResourceOwner, event.Aggregate().ResourceOwner), + }, + ), nil + default: + return handler.NewNoOpStatement(event), nil + } +} + +type userAgentIDPayload struct { + ID string `json:"userAgentID"` } func agentIDFromSession(event eventstore.Event) (string, error) { - session := make(map[string]interface{}) - if err := event.Unmarshal(&session); err != nil { + payload := new(userAgentIDPayload) + if err := event.Unmarshal(payload); err != nil { logging.WithError(err).Error("could not unmarshal event data") return "", zerrors.ThrowInternal(nil, "MODEL-sd325", "could not unmarshal data") } - agentID, _ := session["userAgentID"].(string) - return agentID, nil -} - -func applicationFromSession(event eventstore.Event) (*project_es_model.Application, error) { - application := new(project_es_model.Application) - if err := event.Unmarshal(application); err != nil { - logging.WithError(err).Error("could not unmarshal event data") - return nil, zerrors.ThrowInternal(nil, "MODEL-Hrw1q", "could not unmarshal data") - } - return application, nil -} - -func tokenIDFromRemovedEvent(event eventstore.Event) (string, error) { - removed := make(map[string]interface{}) - if err := event.Unmarshal(&removed); err != nil { - logging.WithError(err).Error("could not unmarshal event data") - return "", zerrors.ThrowInternal(nil, "MODEL-Sff32", "could not unmarshal data") - } - return removed["tokenId"].(string), nil -} - -func refreshTokenIDFromRemovedEvent(event eventstore.Event) (string, error) { - removed := make(map[string]interface{}) - if err := event.Unmarshal(&removed); err != nil { - logging.WithError(err).Error("could not unmarshal event data") - return "", zerrors.ThrowInternal(nil, "MODEL-Dfb3w", "could not unmarshal data") - } - return removed["tokenId"].(string), nil + return payload.ID, nil } func (t *Token) getProjectByID(ctx context.Context, projID, instanceID string) (*proj_model.Project, error) { diff --git a/internal/auth/repository/eventsourcing/handler/user.go b/internal/auth/repository/eventsourcing/handler/user.go index c93dc06477..2333d5242e 100644 --- a/internal/auth/repository/eventsourcing/handler/user.go +++ b/internal/auth/repository/eventsourcing/handler/user.go @@ -4,25 +4,20 @@ import ( "context" "time" - "github.com/zitadel/zitadel/internal/api/authz" auth_view "github.com/zitadel/zitadel/internal/auth/repository/eventsourcing/view" + "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/eventstore/handler/v2" - es_models "github.com/zitadel/zitadel/internal/eventstore/v1/models" - org_model "github.com/zitadel/zitadel/internal/org/model" - org_es_model "github.com/zitadel/zitadel/internal/org/repository/eventsourcing/model" - org_view "github.com/zitadel/zitadel/internal/org/repository/view" query2 "github.com/zitadel/zitadel/internal/query" "github.com/zitadel/zitadel/internal/repository/instance" "github.com/zitadel/zitadel/internal/repository/org" user_repo "github.com/zitadel/zitadel/internal/repository/user" - usr_view "github.com/zitadel/zitadel/internal/user/repository/view" view_model "github.com/zitadel/zitadel/internal/user/repository/view/model" "github.com/zitadel/zitadel/internal/zerrors" ) const ( - userTable = "auth.users2" + userTable = "auth.users3" ) type User struct { @@ -58,26 +53,14 @@ func (u *User) Reducers() []handler.AggregateReducer { { Aggregate: user_repo.AggregateType, EventReducers: []handler.EventReducer{ - { - Event: user_repo.HumanOTPSMSAddedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.HumanOTPSMSRemovedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.HumanOTPEmailAddedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.HumanOTPEmailRemovedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.MachineAddedEventType, - Reduce: u.ProcessUser, - }, { Event: user_repo.HumanAddedType, Reduce: u.ProcessUser, @@ -94,62 +77,14 @@ func (u *User) Reducers() []handler.AggregateReducer { Event: user_repo.HumanRegisteredType, Reduce: u.ProcessUser, }, - { - Event: user_repo.UserV1ProfileChangedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserV1EmailChangedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserV1EmailVerifiedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserV1PhoneChangedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserV1PhoneVerifiedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.UserV1PhoneRemovedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.UserV1AddressChangedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserDeactivatedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserReactivatedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserLockedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserUnlockedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserV1MFAOTPAddedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.UserV1MFAOTPVerifiedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.UserV1MFAOTPRemovedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.UserV1MFAInitSkippedType, Reduce: u.ProcessUser, @@ -158,86 +93,22 @@ func (u *User) Reducers() []handler.AggregateReducer { Event: user_repo.UserV1PasswordChangedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.HumanProfileChangedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanEmailChangedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanEmailVerifiedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanAvatarAddedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanAvatarRemovedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanPhoneChangedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanPhoneVerifiedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.HumanPhoneRemovedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.HumanAddressChangedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanMFAOTPAddedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.HumanMFAOTPVerifiedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.HumanMFAOTPRemovedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanU2FTokenAddedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.HumanU2FTokenVerifiedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.HumanU2FTokenRemovedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanPasswordlessTokenAddedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanPasswordlessTokenVerifiedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.HumanPasswordlessTokenRemovedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.HumanMFAInitSkippedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.MachineChangedEventType, - Reduce: u.ProcessUser, - }, { Event: user_repo.HumanPasswordChangedType, Reduce: u.ProcessUser, @@ -266,14 +137,6 @@ func (u *User) Reducers() []handler.AggregateReducer { Event: user_repo.HumanPasswordlessInitCodeRequestedType, Reduce: u.ProcessUser, }, - { - Event: user_repo.UserDomainClaimedType, - Reduce: u.ProcessUser, - }, - { - Event: user_repo.UserUserNameChangedType, - Reduce: u.ProcessUser, - }, { Event: user_repo.UserRemovedType, Reduce: u.ProcessUser, @@ -283,30 +146,6 @@ func (u *User) Reducers() []handler.AggregateReducer { { Aggregate: org.AggregateType, EventReducers: []handler.EventReducer{ - { - Event: org.OrgDomainVerifiedEventType, - Reduce: u.ProcessOrg, - }, - { - Event: org.OrgDomainRemovedEventType, - Reduce: u.ProcessOrg, - }, - { - Event: org.DomainPolicyAddedEventType, - Reduce: u.ProcessOrg, - }, - { - Event: org.DomainPolicyChangedEventType, - Reduce: u.ProcessOrg, - }, - { - Event: org.DomainPolicyRemovedEventType, - Reduce: u.ProcessOrg, - }, - { - Event: org.OrgDomainPrimarySetEventType, - Reduce: u.ProcessOrg, - }, { Event: org.OrgRemovedEventType, Reduce: u.ProcessOrg, @@ -327,141 +166,124 @@ func (u *User) Reducers() []handler.AggregateReducer { //nolint:gocognit func (u *User) ProcessUser(event eventstore.Event) (_ *handler.Statement, err error) { - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - user := new(view_model.UserView) - switch event.Type() { - case user_repo.UserV1AddedType, - user_repo.MachineAddedEventType, - user_repo.HumanAddedType, - user_repo.UserV1RegisteredType, - user_repo.HumanRegisteredType: - err = user.AppendEvent(event) - if err != nil { - return err - } - err = u.fillLoginNames(user) - case user_repo.UserV1ProfileChangedType, - user_repo.UserV1EmailChangedType, - user_repo.UserV1EmailVerifiedType, - user_repo.UserV1PhoneChangedType, - user_repo.UserV1PhoneVerifiedType, - user_repo.UserV1PhoneRemovedType, - user_repo.UserV1AddressChangedType, - user_repo.UserDeactivatedType, - user_repo.UserReactivatedType, - user_repo.UserLockedType, - user_repo.UserUnlockedType, - user_repo.UserV1MFAOTPAddedType, - user_repo.UserV1MFAOTPVerifiedType, - user_repo.UserV1MFAOTPRemovedType, - user_repo.UserV1MFAInitSkippedType, - user_repo.UserV1PasswordChangedType, - user_repo.HumanProfileChangedType, - user_repo.HumanEmailChangedType, - user_repo.HumanEmailVerifiedType, - user_repo.HumanAvatarAddedType, - user_repo.HumanAvatarRemovedType, - user_repo.HumanPhoneChangedType, - user_repo.HumanPhoneVerifiedType, - user_repo.HumanPhoneRemovedType, - user_repo.HumanAddressChangedType, - user_repo.HumanMFAOTPAddedType, - user_repo.HumanMFAOTPVerifiedType, - user_repo.HumanMFAOTPRemovedType, - user_repo.HumanOTPSMSAddedType, - user_repo.HumanOTPSMSRemovedType, - user_repo.HumanOTPEmailAddedType, - user_repo.HumanOTPEmailRemovedType, - user_repo.HumanU2FTokenAddedType, - user_repo.HumanU2FTokenVerifiedType, - user_repo.HumanU2FTokenRemovedType, - user_repo.HumanPasswordlessTokenAddedType, - user_repo.HumanPasswordlessTokenVerifiedType, - user_repo.HumanPasswordlessTokenRemovedType, - user_repo.HumanMFAInitSkippedType, - user_repo.MachineChangedEventType, - user_repo.HumanPasswordChangedType, - user_repo.HumanInitialCodeAddedType, - user_repo.UserV1InitialCodeAddedType, - user_repo.UserV1InitializedCheckSucceededType, - user_repo.HumanInitializedCheckSucceededType, - user_repo.HumanPasswordlessInitCodeAddedType, - user_repo.HumanPasswordlessInitCodeRequestedType: - user, err = u.view.UserByID(event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil { - if !zerrors.IsNotFound(err) { - return err - } - user, err = u.userFromEventstore(event.Aggregate(), user.EventTypes()) - if err != nil { - return err - } - } - err = user.AppendEvent(event) - case user_repo.UserDomainClaimedType, - user_repo.UserUserNameChangedType: - user, err = u.view.UserByID(event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil { - if !zerrors.IsNotFound(err) { - return err - } - user, err = u.userFromEventstore(event.Aggregate(), user.EventTypes()) - if err != nil { - return err - } - } - err = user.AppendEvent(event) - if err != nil { - return err - } - err = u.fillLoginNames(user) - case user_repo.UserRemovedType: - return u.view.DeleteUser(event.Aggregate().ID, event.Aggregate().InstanceID, event) - default: - return nil + // in case anything needs to be change here check if appendEvent function needs the change as well + switch event.Type() { + case user_repo.UserV1AddedType, + user_repo.HumanAddedType: + e, ok := event.(*user_repo.HumanAddedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-SDAGF", "reduce.wrong.event.type %s", user_repo.HumanAddedType) } - if err != nil { - return err + return u.setPasswordData(event, e.Secret, e.EncodedHash), nil + case user_repo.UserV1RegisteredType, + user_repo.HumanRegisteredType: + e, ok := event.(*user_repo.HumanRegisteredEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-AS1hz", "reduce.wrong.event.type %s", user_repo.HumanRegisteredType) } - return u.view.PutUser(user, event) - }), nil + return u.setPasswordData(event, e.Secret, e.EncodedHash), nil + case user_repo.UserV1PasswordChangedType, + user_repo.HumanPasswordChangedType: + e, ok := event.(*user_repo.HumanPasswordChangedEvent) + if !ok { + return nil, zerrors.ThrowInvalidArgumentf(nil, "MODEL-Gd31w", "reduce.wrong.event.type %s", user_repo.HumanPasswordChangedType) + } + return u.setPasswordData(event, e.Secret, e.EncodedHash), nil + case user_repo.UserV1PhoneRemovedType, + user_repo.HumanPhoneRemovedType, + user_repo.UserV1MFAOTPVerifiedType, + user_repo.HumanMFAOTPVerifiedType, + user_repo.HumanOTPSMSRemovedType, + user_repo.HumanOTPEmailRemovedType, + user_repo.HumanU2FTokenVerifiedType: + return handler.NewUpdateStatement(event, + []handler.Column{ + handler.NewCol(view_model.UserKeyMFAInitSkipped, time.Time{}), + handler.NewCol(view_model.UserKeyChangeDate, event.CreatedAt()), + }, + []handler.Condition{ + handler.NewCond(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserKeyUserID, event.Aggregate().ID), + }), nil + case user_repo.UserV1MFAInitSkippedType, + user_repo.HumanMFAInitSkippedType: + return handler.NewUpdateStatement(event, + []handler.Column{ + handler.NewCol(view_model.UserKeyMFAInitSkipped, event.CreatedAt()), + handler.NewCol(view_model.UserKeyChangeDate, event.CreatedAt()), + }, + []handler.Condition{ + handler.NewCond(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserKeyUserID, event.Aggregate().ID), + }), nil + case user_repo.UserV1InitialCodeAddedType, + user_repo.HumanInitialCodeAddedType: + return handler.NewUpdateStatement(event, + []handler.Column{ + handler.NewCol(view_model.UserKeyInitRequired, true), + handler.NewCol(view_model.UserKeyChangeDate, event.CreatedAt()), + }, + []handler.Condition{ + handler.NewCond(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserKeyUserID, event.Aggregate().ID), + }), nil + case user_repo.UserV1InitializedCheckSucceededType, + user_repo.HumanInitializedCheckSucceededType: + return handler.NewUpdateStatement(event, + []handler.Column{ + handler.NewCol(view_model.UserKeyInitRequired, false), + handler.NewCol(view_model.UserKeyChangeDate, event.CreatedAt()), + }, + []handler.Condition{ + handler.NewCond(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserKeyUserID, event.Aggregate().ID), + }), nil + case user_repo.HumanPasswordlessInitCodeAddedType, + user_repo.HumanPasswordlessInitCodeRequestedType: + return handler.NewUpdateStatement(event, + []handler.Column{ + handler.NewCol(view_model.UserKeyPasswordlessInitRequired, true), + handler.NewCol(view_model.UserKeyPasswordInitRequired, false), + handler.NewCol(view_model.UserKeyChangeDate, event.CreatedAt()), + }, + []handler.Condition{ + handler.NewCond(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserKeyUserID, event.Aggregate().ID), + handler.NewCond(view_model.UserKeyPasswordSet, false), + }), nil + case user_repo.UserRemovedType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserKeyUserID, event.Aggregate().ID), + }), nil + default: + return handler.NewNoOpStatement(event), nil + } } -func (u *User) fillLoginNames(user *view_model.UserView) (err error) { - userLoginMustBeDomain, primaryDomain, domains, err := u.loginNameInformation(context.Background(), user.ResourceOwner, user.InstanceID) - if err != nil { - return err +func (u *User) setPasswordData(event eventstore.Event, secret *crypto.CryptoValue, hash string) *handler.Statement { + set := secret != nil || hash != "" + columns := []handler.Column{ + handler.NewCol(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCol(view_model.UserKeyUserID, event.Aggregate().ID), + handler.NewCol(view_model.UserKeyResourceOwner, event.Aggregate().ResourceOwner), + handler.NewCol(view_model.UserKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.UserKeyPasswordSet, set), + handler.NewCol(view_model.UserKeyPasswordInitRequired, !set), + handler.NewCol(view_model.UserKeyPasswordChange, event.CreatedAt()), } - user.SetLoginNames(userLoginMustBeDomain, domains) - user.PreferredLoginName = user.GenerateLoginName(primaryDomain, userLoginMustBeDomain) - return nil + return handler.NewUpsertStatement(event, columns[0:2], columns) } func (u *User) ProcessOrg(event eventstore.Event) (_ *handler.Statement, err error) { - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - switch event.Type() { - case org.OrgDomainVerifiedEventType, - org.OrgDomainRemovedEventType, - org.DomainPolicyAddedEventType, - org.DomainPolicyChangedEventType, - org.DomainPolicyRemovedEventType: - return u.fillLoginNamesOnOrgUsers(event) - case org.OrgDomainPrimarySetEventType: - return u.fillPreferredLoginNamesOnOrgUsers(event) - case org.OrgRemovedEventType: - return u.view.UpdateOrgOwnerRemovedUsers(event) - default: - return nil - } - }), nil -} - -func (u *User) ProcessInstance(event eventstore.Event) (_ *handler.Statement, err error) { + // in case anything needs to be change here check if appendEvent function needs the change as well switch event.Type() { - case instance.InstanceRemovedEventType: - return handler.NewStatement(event, - func(ex handler.Executer, projectionName string) error { - return u.view.DeleteInstanceUsers(event) + case org.OrgRemovedEventType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserKeyResourceOwner, event.Aggregate().ID), }, ), nil default: @@ -469,97 +291,16 @@ func (u *User) ProcessInstance(event eventstore.Event) (_ *handler.Statement, er } } -func (u *User) fillLoginNamesOnOrgUsers(event eventstore.Event) error { - userLoginMustBeDomain, _, domains, err := u.loginNameInformation(context.Background(), event.Aggregate().ResourceOwner, event.Aggregate().InstanceID) - if err != nil { - return err +func (u *User) ProcessInstance(event eventstore.Event) (_ *handler.Statement, err error) { + // in case anything needs to be change here check if appendEvent function needs the change as well + switch event.Type() { + case instance.InstanceRemovedEventType: + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.UserKeyInstanceID, event.Aggregate().InstanceID), + }, + ), nil + default: + return handler.NewNoOpStatement(event), nil } - users, err := u.view.UsersByOrgID(event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil { - return err - } - for _, user := range users { - user.SetLoginNames(userLoginMustBeDomain, domains) - } - return u.view.PutUsers(users, event) -} - -func (u *User) fillPreferredLoginNamesOnOrgUsers(event eventstore.Event) error { - userLoginMustBeDomain, primaryDomain, _, err := u.loginNameInformation(context.Background(), event.Aggregate().ResourceOwner, event.Aggregate().InstanceID) - if err != nil { - return err - } - if !userLoginMustBeDomain { - return nil - } - users, err := u.view.UsersByOrgID(event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil { - return err - } - for _, user := range users { - user.PreferredLoginName = user.GenerateLoginName(primaryDomain, userLoginMustBeDomain) - } - return u.view.PutUsers(users, event) -} - -func (u *User) getOrgByID(ctx context.Context, orgID, instanceID string) (*org_model.Org, error) { - query, err := org_view.OrgByIDQuery(orgID, instanceID, 0) - if err != nil { - return nil, err - } - - esOrg := &org_es_model.Org{ - ObjectRoot: es_models.ObjectRoot{ - AggregateID: orgID, - }, - } - events, err := u.es.Filter(ctx, query) - if err != nil { - return nil, err - } - if err = esOrg.AppendEvents(events...); err != nil { - return nil, err - } - if esOrg.Sequence == 0 { - return nil, zerrors.ThrowNotFound(nil, "EVENT-3m9vs", "Errors.Org.NotFound") - } - - return org_es_model.OrgToModel(esOrg), nil -} - -func (u *User) loginNameInformation(ctx context.Context, orgID string, instanceID string) (userLoginMustBeDomain bool, primaryDomain string, domains []*org_model.OrgDomain, err error) { - org, err := u.getOrgByID(ctx, orgID, instanceID) - if err != nil { - return false, "", nil, err - } - primaryDomain, err = org.GetPrimaryDomain() - if err != nil { - return false, "", nil, err - } - if org.DomainPolicy != nil { - return org.DomainPolicy.UserLoginMustBeDomain, primaryDomain, org.Domains, nil - } - policy, err := u.queries.DefaultDomainPolicy(authz.WithInstanceID(ctx, org.InstanceID)) - if err != nil { - return false, "", nil, err - } - return policy.UserLoginMustBeDomain, primaryDomain, org.Domains, nil -} - -func (u *User) userFromEventstore(agg *eventstore.Aggregate, eventTypes []eventstore.EventType) (*view_model.UserView, error) { - query, err := usr_view.UserByIDQuery(agg.ID, agg.InstanceID, time.Time{}, eventTypes) - if err != nil { - return nil, err - } - events, err := u.es.Filter(context.Background(), query) - if err != nil { - return nil, err - } - user := &view_model.UserView{} - for _, e := range events { - if err = user.AppendEvent(e); err != nil { - return nil, err - } - } - return user, nil } diff --git a/internal/auth/repository/eventsourcing/handler/user_session.go b/internal/auth/repository/eventsourcing/handler/user_session.go index fc22856846..de97a2062e 100644 --- a/internal/auth/repository/eventsourcing/handler/user_session.go +++ b/internal/auth/repository/eventsourcing/handler/user_session.go @@ -12,8 +12,8 @@ import ( "github.com/zitadel/zitadel/internal/repository/instance" "github.com/zitadel/zitadel/internal/repository/org" "github.com/zitadel/zitadel/internal/repository/user" + es_model "github.com/zitadel/zitadel/internal/user/repository/eventsourcing/model" view_model "github.com/zitadel/zitadel/internal/user/repository/view/model" - "github.com/zitadel/zitadel/internal/zerrors" ) const ( @@ -187,64 +187,160 @@ func (s *UserSession) Reducers() []handler.AggregateReducer { } } +func sessionColumns(event eventstore.Event, columns ...handler.Column) ([]handler.Column, error) { + userAgent, err := agentIDFromSession(event) + if err != nil { + return nil, err + } + return append([]handler.Column{ + handler.NewCol(view_model.UserSessionKeyUserAgentID, userAgent), + handler.NewCol(view_model.UserSessionKeyUserID, event.Aggregate().ID), + handler.NewCol(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCol(view_model.UserSessionKeyCreationDate, handler.OnlySetValueOnInsert(userSessionTable, event.CreatedAt())), + handler.NewCol(view_model.UserSessionKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeyResourceOwner, event.Aggregate().ResourceOwner), + handler.NewCol(view_model.UserSessionKeySequence, event.Sequence()), + }, columns...), nil +} + func (u *UserSession) Reduce(event eventstore.Event) (_ *handler.Statement, err error) { + // in case anything needs to be change here check if appendEvent function needs the change as well switch event.Type() { case user.UserV1PasswordCheckSucceededType, - user.UserV1PasswordCheckFailedType, - user.UserV1MFAOTPCheckSucceededType, - user.UserV1MFAOTPCheckFailedType, - user.UserV1SignedOutType, - user.HumanPasswordCheckSucceededType, - user.HumanPasswordCheckFailedType, - user.UserIDPLoginCheckSucceededType, - user.HumanMFAOTPCheckSucceededType, + user.HumanPasswordCheckSucceededType: + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeyPasswordVerification, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.UserV1PasswordCheckFailedType, + user.HumanPasswordCheckFailedType: + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeyPasswordVerification, time.Time{}), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.UserV1MFAOTPCheckSucceededType, + user.HumanMFAOTPCheckSucceededType: + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeySecondFactorVerification, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySecondFactorVerificationType, domain.MFATypeTOTP), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.UserV1MFAOTPCheckFailedType, user.HumanMFAOTPCheckFailedType, - user.HumanU2FTokenCheckSucceededType, - user.HumanU2FTokenCheckFailedType, - user.HumanPasswordlessTokenCheckSucceededType, - user.HumanPasswordlessTokenCheckFailedType, + user.HumanU2FTokenCheckFailedType: + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeySecondFactorVerification, time.Time{}), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.UserV1SignedOutType, user.HumanSignedOutType: - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - var session *view_model.UserSessionView - eventData, err := view_model.UserSessionFromEvent(event) - if err != nil { - return err - } - session, err = u.view.UserSessionByIDs(eventData.UserAgentID, event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil { - if !zerrors.IsNotFound(err) { - return err - } - session = &view_model.UserSessionView{ - CreationDate: event.CreatedAt(), - ResourceOwner: event.Aggregate().ResourceOwner, - UserAgentID: eventData.UserAgentID, - UserID: event.Aggregate().ID, - State: int32(domain.UserSessionStateActive), - InstanceID: event.Aggregate().InstanceID, - } - } - return u.updateSession(session, event) - }), nil + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeyPasswordlessVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyPasswordVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeySecondFactorVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeySecondFactorVerificationType, domain.MFALevelNotSetUp), + handler.NewCol(view_model.UserSessionKeyMultiFactorVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyMultiFactorVerificationType, domain.MFALevelNotSetUp), + handler.NewCol(view_model.UserSessionKeyExternalLoginVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateTerminated), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.UserIDPLoginCheckSucceededType: + data := new(es_model.AuthRequest) + err := data.SetData(event) + if err != nil { + return nil, err + } + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeyExternalLoginVerification, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySelectedIDPConfigID, data.SelectedIDPConfigID), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.HumanU2FTokenCheckSucceededType: + data := new(es_model.AuthRequest) + err := data.SetData(event) + if err != nil { + return nil, err + } + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeySecondFactorVerification, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySecondFactorVerificationType, domain.MFATypeU2F), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.HumanPasswordlessTokenCheckSucceededType: + data := new(es_model.AuthRequest) + err := data.SetData(event) + if err != nil { + return nil, err + } + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeyPasswordlessVerification, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeyMultiFactorVerification, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeyMultiFactorVerificationType, domain.MFATypeU2FUserVerification), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil + case user.HumanPasswordlessTokenCheckFailedType: + data := new(es_model.AuthRequest) + err := data.SetData(event) + if err != nil { + return nil, err + } + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeyPasswordlessVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyMultiFactorVerification, time.Time{}), + ) + if err != nil { + return nil, err + } + return handler.NewUpsertStatement(event, columns[0:3], columns), nil case user.UserLockedType, user.UserDeactivatedType: return handler.NewUpdateStatement(event, []handler.Column{ - handler.NewCol("passwordless_verification", time.Time{}), - handler.NewCol("password_verification", time.Time{}), - handler.NewCol("second_factor_verification", time.Time{}), - handler.NewCol("second_factor_verification_type", domain.MFALevelNotSetUp), - handler.NewCol("multi_factor_verification", time.Time{}), - handler.NewCol("multi_factor_verification_type", domain.MFALevelNotSetUp), - handler.NewCol("external_login_verification", time.Time{}), - handler.NewCol("state", domain.UserSessionStateTerminated), - handler.NewCol("change_date", event.CreatedAt()), - handler.NewCol("sequence", event.Sequence()), + handler.NewCol(view_model.UserSessionKeyPasswordlessVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyPasswordVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeySecondFactorVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeySecondFactorVerificationType, domain.MFALevelNotSetUp), + handler.NewCol(view_model.UserSessionKeyMultiFactorVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyMultiFactorVerificationType, domain.MFALevelNotSetUp), + handler.NewCol(view_model.UserSessionKeyExternalLoginVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateTerminated), + handler.NewCol(view_model.UserSessionKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySequence, event.Sequence()), }, []handler.Condition{ - handler.NewCond("instance_id", event.Aggregate().InstanceID), - handler.NewCond("user_id", event.Aggregate().ID), - handler.Not(handler.NewCond("state", domain.UserSessionStateTerminated)), + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserSessionKeyUserID, event.Aggregate().ID), + handler.Not(handler.NewCond(view_model.UserSessionKeyState, domain.UserSessionStateTerminated)), }, ), nil case user.UserV1PasswordChangedType, @@ -256,26 +352,26 @@ func (u *UserSession) Reduce(event eventstore.Event) (_ *handler.Statement, err return handler.NewMultiStatement(event, handler.AddUpdateStatement( []handler.Column{ - handler.NewCol("password_verification", event.CreatedAt()), - handler.NewCol("change_date", event.CreatedAt()), - handler.NewCol("sequence", event.Sequence()), + handler.NewCol(view_model.UserSessionKeyPasswordVerification, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySequence, event.Sequence()), }, []handler.Condition{ - handler.NewCond("instance_id", event.Aggregate().InstanceID), - handler.NewCond("user_id", event.Aggregate().ID), - handler.NewCond("user_agent_id", userAgent), + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserSessionKeyUserID, event.Aggregate().ID), + handler.NewCond(view_model.UserSessionKeyUserAgentID, userAgent), }), handler.AddUpdateStatement( []handler.Column{ - handler.NewCol("password_verification", time.Time{}), - handler.NewCol("change_date", event.CreatedAt()), - handler.NewCol("sequence", event.Sequence()), + handler.NewCol(view_model.UserSessionKeyPasswordVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySequence, event.Sequence()), }, []handler.Condition{ - handler.NewCond("instance_id", event.Aggregate().InstanceID), - handler.NewCond("user_id", event.Aggregate().ID), - handler.Not(handler.NewCond("user_agent_id", userAgent)), - handler.Not(handler.NewCond("state", domain.UserSessionStateTerminated)), + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserSessionKeyUserID, event.Aggregate().ID), + handler.Not(handler.NewCond(view_model.UserSessionKeyUserAgentID, userAgent)), + handler.Not(handler.NewCond(view_model.UserSessionKeyState, domain.UserSessionStateTerminated)), }), ), nil case user.UserV1MFAOTPRemovedType, @@ -283,84 +379,77 @@ func (u *UserSession) Reduce(event eventstore.Event) (_ *handler.Statement, err user.HumanU2FTokenRemovedType: return handler.NewUpdateStatement(event, []handler.Column{ - handler.NewCol("second_factor_verification", time.Time{}), - handler.NewCol("change_date", event.CreatedAt()), - handler.NewCol("sequence", event.Sequence()), + handler.NewCol(view_model.UserSessionKeySecondFactorVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySequence, event.Sequence()), }, []handler.Condition{ - handler.NewCond("instance_id", event.Aggregate().InstanceID), - handler.NewCond("user_id", event.Aggregate().ID), - handler.Not(handler.NewCond("state", domain.UserSessionStateTerminated)), + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserSessionKeyUserID, event.Aggregate().ID), + handler.Not(handler.NewCond(view_model.UserSessionKeyState, domain.UserSessionStateTerminated)), }, ), nil case user.UserIDPLinkRemovedType, user.UserIDPLinkCascadeRemovedType: return handler.NewUpdateStatement(event, []handler.Column{ - handler.NewCol("external_login_verification", time.Time{}), - handler.NewCol("selected_idp_config_id", ""), - handler.NewCol("change_date", event.CreatedAt()), - handler.NewCol("sequence", event.Sequence()), + handler.NewCol(view_model.UserSessionKeyExternalLoginVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeySelectedIDPConfigID, ""), + handler.NewCol(view_model.UserSessionKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySequence, event.Sequence()), }, []handler.Condition{ - handler.NewCond("instance_id", event.Aggregate().InstanceID), - handler.NewCond("user_id", event.Aggregate().ID), - handler.Not(handler.NewCond("selected_idp_config_id", "")), + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserSessionKeyUserID, event.Aggregate().ID), + handler.Not(handler.NewCond(view_model.UserSessionKeySelectedIDPConfigID, "")), }, ), nil case user.HumanPasswordlessTokenRemovedType: return handler.NewUpdateStatement(event, []handler.Column{ - handler.NewCol("passwordless_verification", time.Time{}), - handler.NewCol("multi_factor_verification", time.Time{}), - handler.NewCol("change_date", event.CreatedAt()), - handler.NewCol("sequence", event.Sequence()), + handler.NewCol(view_model.UserSessionKeyPasswordlessVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyMultiFactorVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyChangeDate, event.CreatedAt()), + handler.NewCol(view_model.UserSessionKeySequence, event.Sequence()), }, []handler.Condition{ - handler.NewCond("instance_id", event.Aggregate().InstanceID), - handler.NewCond("user_id", event.Aggregate().ID), - handler.Not(handler.NewCond("state", domain.UserSessionStateTerminated)), + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserSessionKeyUserID, event.Aggregate().ID), + handler.Not(handler.NewCond(view_model.UserSessionKeyState, domain.UserSessionStateTerminated)), }, ), nil case user.UserRemovedType: - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - return u.view.DeleteUserSessions(event.Aggregate().ID, event.Aggregate().InstanceID) - }), nil + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserSessionKeyUserID, event.Aggregate().ID), + }, + ), nil case user.HumanRegisteredType: - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - eventData, err := view_model.UserSessionFromEvent(event) - if err != nil { - return err - } - session := &view_model.UserSessionView{ - CreationDate: event.CreatedAt(), - ResourceOwner: event.Aggregate().ResourceOwner, - UserAgentID: eventData.UserAgentID, - UserID: event.Aggregate().ID, - State: int32(domain.UserSessionStateActive), - InstanceID: event.Aggregate().InstanceID, - PasswordVerification: event.CreatedAt(), - } - return u.updateSession(session, event) - }), nil + columns, err := sessionColumns(event, + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), + handler.NewCol(view_model.UserSessionKeyPasswordVerification, event.CreatedAt()), + ) + if err != nil { + return nil, err + } + return handler.NewCreateStatement(event, + columns, + ), nil case instance.InstanceRemovedEventType: - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - return u.view.DeleteInstanceUserSessions(event.Aggregate().InstanceID) - }), nil + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + }, + ), nil case org.OrgRemovedEventType: - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - return u.view.DeleteOrgUserSessions(event) - }), nil + return handler.NewDeleteStatement(event, + []handler.Condition{ + handler.NewCond(view_model.UserSessionKeyInstanceID, event.Aggregate().InstanceID), + handler.NewCond(view_model.UserSessionKeyResourceOwner, event.Aggregate().ResourceOwner), + }, + ), nil default: - return handler.NewStatement(event, func(ex handler.Executer, projectionName string) error { - return nil - }), nil + return handler.NewNoOpStatement(event), nil } } - -func (u *UserSession) updateSession(session *view_model.UserSessionView, event eventstore.Event) error { - if err := session.AppendEvent(event); err != nil { - return err - } - return u.view.PutUserSession(session) -} diff --git a/internal/auth/repository/eventsourcing/view/refresh_token.go b/internal/auth/repository/eventsourcing/view/refresh_token.go index b45f769cb7..ce268ba139 100644 --- a/internal/auth/repository/eventsourcing/view/refresh_token.go +++ b/internal/auth/repository/eventsourcing/view/refresh_token.go @@ -4,13 +4,10 @@ import ( "context" "github.com/zitadel/zitadel/internal/api/authz" - "github.com/zitadel/zitadel/internal/eventstore" - "github.com/zitadel/zitadel/internal/eventstore/v1/models" "github.com/zitadel/zitadel/internal/query" user_model "github.com/zitadel/zitadel/internal/user/model" usr_view "github.com/zitadel/zitadel/internal/user/repository/view" "github.com/zitadel/zitadel/internal/user/repository/view/model" - "github.com/zitadel/zitadel/internal/zerrors" ) const ( @@ -29,54 +26,6 @@ func (v *View) SearchRefreshTokens(request *user_model.RefreshTokenSearchRequest return usr_view.SearchRefreshTokens(v.Db, refreshTokenTable, request) } -func (v *View) PutRefreshToken(token *model.RefreshTokenView) error { - return usr_view.PutRefreshToken(v.Db, refreshTokenTable, token) -} - -func (v *View) PutRefreshTokens(token []*model.RefreshTokenView) error { - return usr_view.PutRefreshTokens(v.Db, refreshTokenTable, token...) -} - -func (v *View) DeleteRefreshToken(tokenID, instanceID string) error { - err := usr_view.DeleteRefreshToken(v.Db, refreshTokenTable, tokenID, instanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteUserRefreshTokens(userID, instanceID string) error { - err := usr_view.DeleteUserRefreshTokens(v.Db, refreshTokenTable, userID, instanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteApplicationRefreshTokens(event *models.Event, ids ...string) error { - err := usr_view.DeleteApplicationTokens(v.Db, refreshTokenTable, event.InstanceID, ids) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteInstanceRefreshTokens(instanceID string) error { - err := usr_view.DeleteInstanceRefreshTokens(v.Db, refreshTokenTable, instanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteOrgRefreshTokens(event eventstore.Event) error { - err := usr_view.DeleteOrgRefreshTokens(v.Db, refreshTokenTable, event.Aggregate().InstanceID, event.Aggregate().ResourceOwner) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - func (v *View) GetLatestRefreshTokenSequence(ctx context.Context) (_ *query.CurrentState, err error) { q := &query.CurrentStateSearchQueries{ Queries: make([]query.SearchQuery, 2), diff --git a/internal/auth/repository/eventsourcing/view/token.go b/internal/auth/repository/eventsourcing/view/token.go index 0fe1d6d187..92713dc28c 100644 --- a/internal/auth/repository/eventsourcing/view/token.go +++ b/internal/auth/repository/eventsourcing/view/token.go @@ -3,12 +3,10 @@ package view import ( "context" - "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/query" "github.com/zitadel/zitadel/internal/telemetry/tracing" usr_view "github.com/zitadel/zitadel/internal/user/repository/view" "github.com/zitadel/zitadel/internal/user/repository/view/model" - "github.com/zitadel/zitadel/internal/zerrors" ) const ( @@ -23,70 +21,6 @@ func (v *View) TokensByUserID(userID, instanceID string) ([]*model.TokenView, er return usr_view.TokensByUserID(v.Db, tokenTable, userID, instanceID) } -func (v *View) PutToken(token *model.TokenView) error { - return usr_view.PutToken(v.Db, tokenTable, token) -} - -func (v *View) PutTokens(token []*model.TokenView) error { - return usr_view.PutTokens(v.Db, tokenTable, token...) -} - -func (v *View) DeleteToken(tokenID, instanceID string) error { - err := usr_view.DeleteToken(v.Db, tokenTable, tokenID, instanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteSessionTokens(agentID string, event eventstore.Event) error { - err := usr_view.DeleteSessionTokens(v.Db, tokenTable, agentID, event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteUserTokens(event eventstore.Event) error { - err := usr_view.DeleteUserTokens(v.Db, tokenTable, event.Aggregate().ID, event.Aggregate().InstanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteApplicationTokens(event eventstore.Event, ids ...string) error { - err := usr_view.DeleteApplicationTokens(v.Db, tokenTable, event.Aggregate().InstanceID, ids) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteTokensFromRefreshToken(refreshTokenID, instanceID string) error { - err := usr_view.DeleteTokensFromRefreshToken(v.Db, tokenTable, refreshTokenID, instanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteInstanceTokens(event eventstore.Event) error { - err := usr_view.DeleteInstanceTokens(v.Db, tokenTable, event.Aggregate().InstanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteOrgTokens(event eventstore.Event) error { - err := usr_view.DeleteOrgTokens(v.Db, tokenTable, event.Aggregate().InstanceID, event.Aggregate().ResourceOwner) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - func (v *View) GetLatestTokenSequence(ctx context.Context, instanceID string) (_ *query.CurrentState, err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() diff --git a/internal/auth/repository/eventsourcing/view/user.go b/internal/auth/repository/eventsourcing/view/user.go index 3c1c3ddcc1..e75846471d 100644 --- a/internal/auth/repository/eventsourcing/view/user.go +++ b/internal/auth/repository/eventsourcing/view/user.go @@ -5,7 +5,6 @@ import ( "github.com/zitadel/logging" - "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/query" usr_model "github.com/zitadel/zitadel/internal/user/model" "github.com/zitadel/zitadel/internal/user/repository/view" @@ -14,7 +13,7 @@ import ( ) const ( - userTable = "auth.users2" + userTable = "auth.users3" ) func (v *View) UserByID(userID, instanceID string) (*model.UserView, error) { @@ -142,42 +141,6 @@ func (v *View) userByID(ctx context.Context, instanceID string, queries ...query return user, nil } -func (v *View) UsersByOrgID(orgID, instanceID string) ([]*model.UserView, error) { - return view.UsersByOrgID(v.Db, userTable, orgID, instanceID) -} - -func (v *View) PutUser(user *model.UserView, event eventstore.Event) error { - return view.PutUser(v.Db, userTable, user) -} - -func (v *View) PutUsers(users []*model.UserView, event eventstore.Event) error { - return view.PutUsers(v.Db, userTable, users...) -} - -func (v *View) DeleteUser(userID, instanceID string, event eventstore.Event) error { - err := view.DeleteUser(v.Db, userTable, userID, instanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteInstanceUsers(event eventstore.Event) error { - err := view.DeleteInstanceUsers(v.Db, userTable, event.Aggregate().InstanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) UpdateOrgOwnerRemovedUsers(event eventstore.Event) error { - err := view.UpdateOrgOwnerRemovedUsers(v.Db, userTable, event.Aggregate().InstanceID, event.Aggregate().ID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - func (v *View) GetLatestUserSequence(ctx context.Context, instanceID string) (_ *query.CurrentState, err error) { q := &query.CurrentStateSearchQueries{ Queries: make([]query.SearchQuery, 2), diff --git a/internal/auth/repository/eventsourcing/view/user_session.go b/internal/auth/repository/eventsourcing/view/user_session.go index 59d2a967ab..893e5872ac 100644 --- a/internal/auth/repository/eventsourcing/view/user_session.go +++ b/internal/auth/repository/eventsourcing/view/user_session.go @@ -3,11 +3,9 @@ package view import ( "context" - "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/query" "github.com/zitadel/zitadel/internal/user/repository/view" "github.com/zitadel/zitadel/internal/user/repository/view/model" - "github.com/zitadel/zitadel/internal/zerrors" ) const ( @@ -22,34 +20,6 @@ func (v *View) UserSessionsByAgentID(agentID, instanceID string) ([]*model.UserS return view.UserSessionsByAgentID(v.client, agentID, instanceID) } -func (v *View) PutUserSession(userSession *model.UserSessionView) error { - return view.PutUserSession(v.Db, userSessionTable, userSession) -} - -func (v *View) DeleteUserSessions(userID, instanceID string) error { - err := view.DeleteUserSessions(v.Db, userSessionTable, userID, instanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteInstanceUserSessions(instanceID string) error { - err := view.DeleteInstanceUserSessions(v.Db, userSessionTable, instanceID) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - -func (v *View) DeleteOrgUserSessions(event eventstore.Event) error { - err := view.DeleteOrgUserSessions(v.Db, userSessionTable, event.Aggregate().InstanceID, event.Aggregate().ResourceOwner) - if err != nil && !zerrors.IsNotFound(err) { - return err - } - return nil -} - func (v *View) GetLatestUserSessionSequence(ctx context.Context, instanceID string) (_ *query.CurrentState, err error) { q := &query.CurrentStateSearchQueries{ Queries: make([]query.SearchQuery, 2), diff --git a/internal/eventstore/handler/v2/statement.go b/internal/eventstore/handler/v2/statement.go index 802bacc068..2eb9193083 100644 --- a/internal/eventstore/handler/v2/statement.go +++ b/internal/eventstore/handler/v2/statement.go @@ -565,6 +565,13 @@ func Not(condition Condition) Condition { } } +// NewOneOfTextCond returns a Condition that checks if the column that stores a text is one of the given values +func NewOneOfTextCond(column string, values []string) Condition { + return func(param string) (string, []any) { + return column + " = ANY(" + param + ")", []any{database.TextArray[string](values)} + } +} + type Executer interface { Exec(string, ...interface{}) (sql.Result, error) } diff --git a/internal/user/repository/view/model/refresh_token.go b/internal/user/repository/view/model/refresh_token.go index 06b4463623..23766c7b33 100644 --- a/internal/user/repository/view/model/refresh_token.go +++ b/internal/user/repository/view/model/refresh_token.go @@ -13,13 +13,24 @@ import ( ) const ( - RefreshTokenKeyTokenID = "id" - RefreshTokenKeyUserID = "user_id" - RefreshTokenKeyApplicationID = "application_id" - RefreshTokenKeyUserAgentID = "user_agent_id" - RefreshTokenKeyExpiration = "expiration" - RefreshTokenKeyResourceOwner = "resource_owner" - RefreshTokenKeyInstanceID = "instance_id" + RefreshTokenKeyTokenID = "id" + RefreshTokenKeyUserID = "user_id" + RefreshTokenKeyApplicationID = "application_id" + RefreshTokenKeyUserAgentID = "user_agent_id" + RefreshTokenKeyExpiration = "expiration" + RefreshTokenKeyResourceOwner = "resource_owner" + RefreshTokenKeyInstanceID = "instance_id" + RefreshTokenKeyCreationDate = "creation_date" + RefreshTokenKeyChangeDate = "change_date" + RefreshTokenKeySequence = "sequence" + RefreshTokenKeyActor = "actor" + RefreshTokenKeyAMR = "amr" + RefreshTokenKeyAuthTime = "auth_time" + RefreshTokenKeyAudience = "audience" + RefreshTokenKeyClientID = "client_id" + RefreshTokenKeyIdleExpiration = "idle_expiration" + RefreshTokenKeyScopes = "scopes" + RefreshTokenKeyToken = "token" ) type RefreshTokenView struct { @@ -72,6 +83,7 @@ func RefreshTokenViewToModel(token *RefreshTokenView) *usr_model.RefreshTokenVie } func (t *RefreshTokenView) AppendEventIfMyRefreshToken(event eventstore.Event) (err error) { + // in case anything needs to be change here check if the Reduce function needs the change as well view := new(RefreshTokenView) switch event.Type() { case user_repo.HumanRefreshTokenAddedType: @@ -101,6 +113,7 @@ func (t *RefreshTokenView) AppendEventIfMyRefreshToken(event eventstore.Event) ( } func (t *RefreshTokenView) AppendEvent(event eventstore.Event) error { + // in case anything needs to be change here check if the Reduce function needs the change as well t.ChangeDate = event.CreatedAt() t.Sequence = event.Sequence() switch event.Type() { @@ -123,7 +136,7 @@ func (t *RefreshTokenView) setRootData(event eventstore.Event) { func (t *RefreshTokenView) appendAddedEvent(event eventstore.Event) error { e := new(user_repo.HumanRefreshTokenAddedEvent) if err := event.Unmarshal(e); err != nil { - logging.Log("EVEN-Dbb31").WithError(err).Error("could not unmarshal event data") + logging.WithError(err).Error("could not unmarshal event data") return zerrors.ThrowInternal(err, "MODEL-Bbr42", "could not unmarshal event") } t.ID = e.TokenID @@ -144,7 +157,7 @@ func (t *RefreshTokenView) appendAddedEvent(event eventstore.Event) error { func (t *RefreshTokenView) appendRenewedEvent(event eventstore.Event) error { e := new(user_repo.HumanRefreshTokenRenewedEvent) if err := event.Unmarshal(e); err != nil { - logging.Log("EVEN-Vbbn2").WithError(err).Error("could not unmarshal event data") + logging.WithError(err).Error("could not unmarshal event data") return zerrors.ThrowInternal(err, "MODEL-Bbrn4", "could not unmarshal event") } t.ID = e.TokenID diff --git a/internal/user/repository/view/model/token.go b/internal/user/repository/view/model/token.go index ebe1564738..a780e7e167 100644 --- a/internal/user/repository/view/model/token.go +++ b/internal/user/repository/view/model/token.go @@ -16,14 +16,23 @@ import ( ) const ( - TokenKeyTokenID = "id" - TokenKeyUserID = "user_id" - TokenKeyRefreshTokenID = "refresh_token_id" - TokenKeyApplicationID = "application_id" - TokenKeyUserAgentID = "user_agent_id" - TokenKeyExpiration = "expiration" - TokenKeyResourceOwner = "resource_owner" - TokenKeyInstanceID = "instance_id" + TokenKeyTokenID = "id" + TokenKeyUserID = "user_id" + TokenKeyRefreshTokenID = "refresh_token_id" + TokenKeyApplicationID = "application_id" + TokenKeyUserAgentID = "user_agent_id" + TokenKeyExpiration = "expiration" + TokenKeyResourceOwner = "resource_owner" + TokenKeyInstanceID = "instance_id" + TokenKeyCreationDate = "creation_date" + TokenKeyChangeDate = "change_date" + TokenKeySequence = "sequence" + TokenKeyActor = "actor" + TokenKeyID = "id" + TokenKeyAudience = "audience" + TokenKeyPreferredLanguage = "preferred_language" + TokenKeyScopes = "scopes" + TokenKeyIsPat = "is_pat" ) type TokenView struct { @@ -100,6 +109,7 @@ func TokenViewToModel(token *TokenView) *usr_model.TokenView { } func (t *TokenView) AppendEventIfMyToken(event eventstore.Event) (err error) { + // in case anything needs to be change here check if the Reduce function needs the change as well view := new(TokenView) switch event.Type() { case user_repo.UserTokenAddedType, @@ -112,7 +122,7 @@ func (t *TokenView) AppendEventIfMyToken(event eventstore.Event) (err error) { return t.appendRefreshTokenRemoved(event) case user_repo.UserV1SignedOutType, user_repo.HumanSignedOutType: - id, err := agentIDFromSession(event) + id, err := UserAgentIDFromEvent(event) if err != nil { return err } @@ -146,6 +156,7 @@ func (t *TokenView) AppendEventIfMyToken(event eventstore.Event) (err error) { } func (t *TokenView) AppendEvent(event eventstore.Event) error { + // in case anything needs to be change here check if the Reduce function needs the change as well t.ChangeDate = event.CreatedAt() t.Sequence = event.Sequence() switch event.Type() { @@ -170,49 +181,40 @@ func (t *TokenView) setRootData(event eventstore.Event) { func (t *TokenView) setData(event eventstore.Event) error { if err := event.Unmarshal(t); err != nil { - logging.Log("EVEN-3Gm9s").WithError(err).Error("could not unmarshal event data") + logging.WithError(err).Error("could not unmarshal event data") return zerrors.ThrowInternal(err, "MODEL-5Gms9", "could not unmarshal event") } return nil } -func agentIDFromSession(event eventstore.Event) (string, error) { - session := make(map[string]interface{}) - if err := event.Unmarshal(&session); err != nil { - logging.Log("EVEN-Ghgt3").WithError(err).Error("could not unmarshal event data") - return "", zerrors.ThrowInternal(nil, "MODEL-GBf32", "could not unmarshal data") - } - return session["userAgentID"].(string), nil -} - func (t *TokenView) appendTokenRemoved(event eventstore.Event) error { - token, err := eventToMap(event) + tokenID, err := tokenIDFromEvent(event) if err != nil { return err } - if token["tokenId"] == t.ID { + if tokenID == t.ID { t.Deactivated = true } return nil } func (t *TokenView) appendRefreshTokenRemoved(event eventstore.Event) error { - refreshToken, err := eventToMap(event) + tokenID, err := tokenIDFromEvent(event) if err != nil { return err } - if refreshToken["tokenId"] == t.RefreshTokenID { + if tokenID == t.RefreshTokenID { t.Deactivated = true } return nil } func (t *TokenView) appendPATRemoved(event eventstore.Event) error { - pat, err := eventToMap(event) + tokenID, err := tokenIDFromEvent(event) if err != nil { return err } - if pat["tokenId"] == t.ID && t.IsPAT { + if tokenID == t.ID && t.IsPAT { t.Deactivated = true } return nil @@ -235,11 +237,15 @@ func (t *TokenView) GetRelevantEventTypes() []eventstore.EventType { } } -func eventToMap(event eventstore.Event) (map[string]interface{}, error) { - m := make(map[string]interface{}) - if err := event.Unmarshal(&m); err != nil { - logging.Log("EVEN-Dbffe").WithError(err).Error("could not unmarshal event data") - return nil, zerrors.ThrowInternal(nil, "MODEL-SDAfw", "could not unmarshal data") - } - return m, nil +type tokenIDPayload struct { + ID string `json:"tokenId"` +} + +func tokenIDFromEvent(event eventstore.Event) (string, error) { + m := new(tokenIDPayload) + if err := event.Unmarshal(&m); err != nil { + logging.WithError(err).Error("could not unmarshal event data") + return "", zerrors.ThrowInternal(nil, "MODEL-SDAfw", "could not unmarshal data") + } + return m.ID, nil } diff --git a/internal/user/repository/view/model/user.go b/internal/user/repository/view/model/user.go index 1beb4b323d..62c64edc0c 100644 --- a/internal/user/repository/view/model/user.go +++ b/internal/user/repository/view/model/user.go @@ -18,27 +18,27 @@ import ( ) const ( - UserKeyUserID = "id" - UserKeyUserName = "user_name" - UserKeyFirstName = "first_name" - UserKeyLastName = "last_name" - UserKeyNickName = "nick_name" - UserKeyDisplayName = "display_name" - UserKeyEmail = "email" - UserKeyState = "user_state" - UserKeyResourceOwner = "resource_owner" - UserKeyLoginNames = "login_names" - UserKeyPreferredLoginName = "preferred_login_name" - UserKeyType = "user_type" - UserKeyInstanceID = "instance_id" - UserKeyOwnerRemoved = "owner_removed" -) - -type userType string - -const ( - userTypeHuman = "human" - userTypeMachine = "machine" + UserKeyUserID = "id" + UserKeyUserName = "user_name" + UserKeyFirstName = "first_name" + UserKeyLastName = "last_name" + UserKeyNickName = "nick_name" + UserKeyDisplayName = "display_name" + UserKeyEmail = "email" + UserKeyState = "user_state" + UserKeyResourceOwner = "resource_owner" + UserKeyLoginNames = "login_names" + UserKeyPreferredLoginName = "preferred_login_name" + UserKeyType = "user_type" + UserKeyInstanceID = "instance_id" + UserKeyOwnerRemoved = "owner_removed" + UserKeyPasswordSet = "password_set" + UserKeyPasswordInitRequired = "password_init_required" + UserKeyPasswordChange = "password_change" + UserKeyInitRequired = "init_required" + UserKeyPasswordlessInitRequired = "passwordless_init_required" + UserKeyMFAInitSkipped = "mfa_init_skipped" + UserKeyChangeDate = "change_date" ) type UserView struct { @@ -51,7 +51,6 @@ type UserView struct { LoginNames database.TextArray[string] `json:"-" gorm:"column:login_names"` PreferredLoginName string `json:"-" gorm:"column:preferred_login_name"` Sequence uint64 `json:"-" gorm:"column:sequence"` - Type userType `json:"-" gorm:"column:user_type"` UserName string `json:"userName" gorm:"column:user_name"` InstanceID string `json:"instanceID" gorm:"column:instance_id;primary_key"` *MachineView @@ -236,13 +235,13 @@ func (u *UserView) SetLoginNames(userLoginMustBeDomain bool, domains []*org_mode } func (u *UserView) AppendEvent(event eventstore.Event) (err error) { + // in case anything needs to be change here check if the Reduce function needs the change as well u.ChangeDate = event.CreatedAt() u.Sequence = event.Sequence() switch event.Type() { case user.MachineAddedEventType: u.CreationDate = event.CreatedAt() u.setRootData(event) - u.Type = userTypeMachine err = u.setData(event) if err != nil { return err @@ -253,7 +252,6 @@ func (u *UserView) AppendEvent(event eventstore.Event) (err error) { user.HumanAddedType: u.CreationDate = event.CreatedAt() u.setRootData(event) - u.Type = userTypeHuman err = u.setData(event) if err != nil { return err @@ -396,7 +394,7 @@ func (u *UserView) setData(event eventstore.Event) error { func (u *UserView) setPasswordData(event eventstore.Event) error { password := new(es_model.Password) if err := event.Unmarshal(password); err != nil { - logging.Log("MODEL-sdw4r").WithError(err).Error("could not unmarshal event data") + logging.WithError(err).Error("could not unmarshal event data") return zerrors.ThrowInternal(nil, "MODEL-6jhsw", "could not unmarshal data") } u.PasswordSet = password.Secret != nil || password.EncodedHash != "" diff --git a/internal/user/repository/view/model/user_session.go b/internal/user/repository/view/model/user_session.go index f4f4b98621..4208ea5b53 100644 --- a/internal/user/repository/view/model/user_session.go +++ b/internal/user/repository/view/model/user_session.go @@ -1,6 +1,7 @@ package model import ( + "database/sql" "time" "github.com/zitadel/logging" @@ -14,12 +15,23 @@ import ( ) const ( - UserSessionKeyUserAgentID = "user_agent_id" - UserSessionKeyUserID = "user_id" - UserSessionKeyState = "state" - UserSessionKeyResourceOwner = "resource_owner" - UserSessionKeyInstanceID = "instance_id" - UserSessionKeyOwnerRemoved = "owner_removed" + UserSessionKeyUserAgentID = "user_agent_id" + UserSessionKeyUserID = "user_id" + UserSessionKeyState = "state" + UserSessionKeyResourceOwner = "resource_owner" + UserSessionKeyInstanceID = "instance_id" + UserSessionKeyOwnerRemoved = "owner_removed" + UserSessionKeyCreationDate = "creation_date" + UserSessionKeyChangeDate = "change_date" + UserSessionKeySequence = "sequence" + UserSessionKeyPasswordVerification = "password_verification" + UserSessionKeySecondFactorVerification = "second_factor_verification" + UserSessionKeySecondFactorVerificationType = "second_factor_verification_type" + UserSessionKeyMultiFactorVerification = "multi_factor_verification" + UserSessionKeyMultiFactorVerificationType = "multi_factor_verification_type" + UserSessionKeyPasswordlessVerification = "passwordless_verification" + UserSessionKeyExternalLoginVerification = "external_login_verification" + UserSessionKeySelectedIDPConfigID = "selected_idp_config_id" ) type UserSessionView struct { @@ -33,29 +45,33 @@ type UserSessionView struct { // are not projected in the user session handler anymore // and are therefore annotated with a `gorm:"-"`. // They will be read from the corresponding projection directly. - UserName string `json:"-" gorm:"-"` - LoginName string `json:"-" gorm:"-"` - DisplayName string `json:"-" gorm:"-"` - AvatarKey string `json:"-" gorm:"-"` - SelectedIDPConfigID string `json:"selectedIDPConfigID" gorm:"column:selected_idp_config_id"` - PasswordVerification time.Time `json:"-" gorm:"column:password_verification"` - PasswordlessVerification time.Time `json:"-" gorm:"column:passwordless_verification"` - ExternalLoginVerification time.Time `json:"-" gorm:"column:external_login_verification"` - SecondFactorVerification time.Time `json:"-" gorm:"column:second_factor_verification"` - SecondFactorVerificationType int32 `json:"-" gorm:"column:second_factor_verification_type"` - MultiFactorVerification time.Time `json:"-" gorm:"column:multi_factor_verification"` - MultiFactorVerificationType int32 `json:"-" gorm:"column:multi_factor_verification_type"` - Sequence uint64 `json:"-" gorm:"column:sequence"` - InstanceID string `json:"instanceID" gorm:"column:instance_id;primary_key"` + UserName sql.NullString `json:"-" gorm:"-"` + LoginName sql.NullString `json:"-" gorm:"-"` + DisplayName sql.NullString `json:"-" gorm:"-"` + AvatarKey sql.NullString `json:"-" gorm:"-"` + SelectedIDPConfigID sql.NullString `json:"selectedIDPConfigID" gorm:"column:selected_idp_config_id"` + PasswordVerification sql.NullTime `json:"-" gorm:"column:password_verification"` + PasswordlessVerification sql.NullTime `json:"-" gorm:"column:passwordless_verification"` + ExternalLoginVerification sql.NullTime `json:"-" gorm:"column:external_login_verification"` + SecondFactorVerification sql.NullTime `json:"-" gorm:"column:second_factor_verification"` + SecondFactorVerificationType sql.NullInt32 `json:"-" gorm:"column:second_factor_verification_type"` + MultiFactorVerification sql.NullTime `json:"-" gorm:"column:multi_factor_verification"` + MultiFactorVerificationType sql.NullInt32 `json:"-" gorm:"column:multi_factor_verification_type"` + Sequence uint64 `json:"-" gorm:"column:sequence"` + InstanceID string `json:"instanceID" gorm:"column:instance_id;primary_key"` } -func UserSessionFromEvent(event eventstore.Event) (*UserSessionView, error) { - v := new(UserSessionView) - if err := event.Unmarshal(v); err != nil { - logging.Log("EVEN-lso9e").WithError(err).Error("could not unmarshal event data") - return nil, zerrors.ThrowInternal(nil, "MODEL-sd325", "could not unmarshal data") +type userAgentIDPayload struct { + ID string `json:"userAgentID"` +} + +func UserAgentIDFromEvent(event eventstore.Event) (string, error) { + payload := new(userAgentIDPayload) + if err := event.Unmarshal(payload); err != nil { + logging.WithError(err).Error("could not unmarshal event data") + return "", zerrors.ThrowInternal(nil, "MODEL-HJwk9", "could not unmarshal data") } - return v, nil + return payload.ID, nil } func UserSessionToModel(userSession *UserSessionView) *model.UserSessionView { @@ -66,18 +82,18 @@ func UserSessionToModel(userSession *UserSessionView) *model.UserSessionView { State: domain.UserSessionState(userSession.State), UserAgentID: userSession.UserAgentID, UserID: userSession.UserID, - UserName: userSession.UserName, - LoginName: userSession.LoginName, - DisplayName: userSession.DisplayName, - AvatarKey: userSession.AvatarKey, - SelectedIDPConfigID: userSession.SelectedIDPConfigID, - PasswordVerification: userSession.PasswordVerification, - PasswordlessVerification: userSession.PasswordlessVerification, - ExternalLoginVerification: userSession.ExternalLoginVerification, - SecondFactorVerification: userSession.SecondFactorVerification, - SecondFactorVerificationType: domain.MFAType(userSession.SecondFactorVerificationType), - MultiFactorVerification: userSession.MultiFactorVerification, - MultiFactorVerificationType: domain.MFAType(userSession.MultiFactorVerificationType), + UserName: userSession.UserName.String, + LoginName: userSession.LoginName.String, + DisplayName: userSession.DisplayName.String, + AvatarKey: userSession.AvatarKey.String, + SelectedIDPConfigID: userSession.SelectedIDPConfigID.String, + PasswordVerification: userSession.PasswordVerification.Time, + PasswordlessVerification: userSession.PasswordlessVerification.Time, + ExternalLoginVerification: userSession.ExternalLoginVerification.Time, + SecondFactorVerification: userSession.SecondFactorVerification.Time, + SecondFactorVerificationType: domain.MFAType(userSession.SecondFactorVerificationType.Int32), + MultiFactorVerification: userSession.MultiFactorVerification.Time, + MultiFactorVerificationType: domain.MFAType(userSession.MultiFactorVerificationType.Int32), Sequence: userSession.Sequence, } } @@ -91,12 +107,13 @@ func UserSessionsToModel(userSessions []*UserSessionView) []*model.UserSessionVi } func (v *UserSessionView) AppendEvent(event eventstore.Event) error { + // in case anything needs to be change here check if the Reduce function needs the change as well v.Sequence = event.Sequence() v.ChangeDate = event.CreatedAt() switch event.Type() { case user.UserV1PasswordCheckSucceededType, user.HumanPasswordCheckSucceededType: - v.PasswordVerification = event.CreatedAt() + v.PasswordVerification = sql.NullTime{Time: event.CreatedAt(), Valid: true} v.State = int32(domain.UserSessionStateActive) case user.UserIDPLoginCheckSucceededType: data := new(es_model.AuthRequest) @@ -104,21 +121,21 @@ func (v *UserSessionView) AppendEvent(event eventstore.Event) error { if err != nil { return err } - v.ExternalLoginVerification = event.CreatedAt() - v.SelectedIDPConfigID = data.SelectedIDPConfigID + v.ExternalLoginVerification = sql.NullTime{Time: event.CreatedAt(), Valid: true} + v.SelectedIDPConfigID = sql.NullString{String: data.SelectedIDPConfigID, Valid: true} v.State = int32(domain.UserSessionStateActive) case user.HumanPasswordlessTokenCheckSucceededType: - v.PasswordlessVerification = event.CreatedAt() - v.MultiFactorVerification = event.CreatedAt() - v.MultiFactorVerificationType = int32(domain.MFATypeU2FUserVerification) + v.PasswordlessVerification = sql.NullTime{Time: event.CreatedAt(), Valid: true} + v.MultiFactorVerification = sql.NullTime{Time: event.CreatedAt(), Valid: true} + v.MultiFactorVerificationType = sql.NullInt32{Int32: int32(domain.MFATypeU2FUserVerification)} v.State = int32(domain.UserSessionStateActive) case user.HumanPasswordlessTokenCheckFailedType, user.HumanPasswordlessTokenRemovedType: - v.PasswordlessVerification = time.Time{} - v.MultiFactorVerification = time.Time{} + v.PasswordlessVerification = sql.NullTime{Time: time.Time{}, Valid: true} + v.MultiFactorVerification = sql.NullTime{Time: time.Time{}, Valid: true} case user.UserV1PasswordCheckFailedType, user.HumanPasswordCheckFailedType: - v.PasswordVerification = time.Time{} + v.PasswordVerification = sql.NullTime{Time: time.Time{}, Valid: true} case user.UserV1PasswordChangedType, user.HumanPasswordChangedType: data := new(es_model.PasswordChange) @@ -127,7 +144,7 @@ func (v *UserSessionView) AppendEvent(event eventstore.Event) error { return err } if v.UserAgentID != data.UserAgentID { - v.PasswordVerification = time.Time{} + v.PasswordVerification = sql.NullTime{Time: time.Time{}, Valid: true} } case user.HumanMFAOTPVerifiedType: data := new(es_model.OTPVerified) @@ -167,7 +184,7 @@ func (v *UserSessionView) AppendEvent(event eventstore.Event) error { user.HumanU2FTokenRemovedType, user.HumanOTPSMSCheckFailedType, user.HumanOTPEmailCheckFailedType: - v.SecondFactorVerification = time.Time{} + v.SecondFactorVerification = sql.NullTime{Time: time.Time{}, Valid: true} case user.HumanU2FTokenVerifiedType: data := new(es_model.WebAuthNVerify) err := data.SetData(event) @@ -183,24 +200,24 @@ func (v *UserSessionView) AppendEvent(event eventstore.Event) error { user.HumanSignedOutType, user.UserLockedType, user.UserDeactivatedType: - v.PasswordlessVerification = time.Time{} - v.PasswordVerification = time.Time{} - v.SecondFactorVerification = time.Time{} - v.SecondFactorVerificationType = int32(domain.MFALevelNotSetUp) - v.MultiFactorVerification = time.Time{} - v.MultiFactorVerificationType = int32(domain.MFALevelNotSetUp) - v.ExternalLoginVerification = time.Time{} + v.PasswordlessVerification = sql.NullTime{Time: time.Time{}, Valid: true} + v.PasswordVerification = sql.NullTime{Time: time.Time{}, Valid: true} + v.SecondFactorVerification = sql.NullTime{Time: time.Time{}, Valid: true} + v.SecondFactorVerificationType = sql.NullInt32{Int32: int32(domain.MFALevelNotSetUp)} + v.MultiFactorVerification = sql.NullTime{Time: time.Time{}, Valid: true} + v.MultiFactorVerificationType = sql.NullInt32{Int32: int32(domain.MFALevelNotSetUp)} + v.ExternalLoginVerification = sql.NullTime{Time: time.Time{}, Valid: true} v.State = int32(domain.UserSessionStateTerminated) case user.UserIDPLinkRemovedType, user.UserIDPLinkCascadeRemovedType: - v.ExternalLoginVerification = time.Time{} - v.SelectedIDPConfigID = "" + v.ExternalLoginVerification = sql.NullTime{Time: time.Time{}, Valid: true} + v.SelectedIDPConfigID = sql.NullString{String: "", Valid: true} } return nil } func (v *UserSessionView) setSecondFactorVerification(verificationTime time.Time, mfaType domain.MFAType) { - v.SecondFactorVerification = verificationTime - v.SecondFactorVerificationType = int32(mfaType) + v.SecondFactorVerification = sql.NullTime{Time: verificationTime, Valid: true} + v.SecondFactorVerificationType = sql.NullInt32{Int32: int32(mfaType)} v.State = int32(domain.UserSessionStateActive) } diff --git a/internal/user/repository/view/model/user_session_test.go b/internal/user/repository/view/model/user_session_test.go index 8f3157f989..25acd489c7 100644 --- a/internal/user/repository/view/model/user_session_test.go +++ b/internal/user/repository/view/model/user_session_test.go @@ -1,6 +1,7 @@ package model import ( + "database/sql" "encoding/json" "testing" "time" @@ -33,7 +34,7 @@ func TestAppendEvent(t *testing.T) { event: &es_models.Event{CreationDate: now(), Typ: user.UserV1PasswordCheckSucceededType}, userView: &UserSessionView{}, }, - result: &UserSessionView{ChangeDate: now(), PasswordVerification: now()}, + result: &UserSessionView{ChangeDate: now(), PasswordVerification: sql.NullTime{Time: now(), Valid: true}}, }, { name: "append human password check succeeded event", @@ -41,23 +42,23 @@ func TestAppendEvent(t *testing.T) { event: &es_models.Event{CreationDate: now(), Typ: user.HumanPasswordCheckSucceededType}, userView: &UserSessionView{}, }, - result: &UserSessionView{ChangeDate: now(), PasswordVerification: now()}, + result: &UserSessionView{ChangeDate: now(), PasswordVerification: sql.NullTime{Time: now(), Valid: true}}, }, { name: "append user password check failed event", args: args{ event: &es_models.Event{CreationDate: now(), Typ: user.UserV1PasswordCheckFailedType}, - userView: &UserSessionView{PasswordVerification: now()}, + userView: &UserSessionView{PasswordVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{ChangeDate: now(), PasswordVerification: time.Time{}}, + result: &UserSessionView{ChangeDate: now(), PasswordVerification: sql.NullTime{Time: time.Time{}, Valid: true}}, }, { name: "append human password check failed event", args: args{ event: &es_models.Event{CreationDate: now(), Typ: user.HumanPasswordCheckFailedType}, - userView: &UserSessionView{PasswordVerification: now()}, + userView: &UserSessionView{PasswordVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{ChangeDate: now(), PasswordVerification: time.Time{}}, + result: &UserSessionView{ChangeDate: now(), PasswordVerification: sql.NullTime{Time: time.Time{}, Valid: true}}, }, { name: "append user password changed event", @@ -72,9 +73,9 @@ func TestAppendEvent(t *testing.T) { return d }(), }, - userView: &UserSessionView{UserAgentID: "id", PasswordVerification: now()}, + userView: &UserSessionView{UserAgentID: "id", PasswordVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{UserAgentID: "id", ChangeDate: now(), PasswordVerification: time.Time{}}, + result: &UserSessionView{UserAgentID: "id", ChangeDate: now(), PasswordVerification: sql.NullTime{Time: time.Time{}, Valid: true}}, }, { name: "append human password changed event", @@ -91,9 +92,9 @@ func TestAppendEvent(t *testing.T) { return d }(), }, - userView: &UserSessionView{UserAgentID: "id", PasswordVerification: now()}, + userView: &UserSessionView{UserAgentID: "id", PasswordVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{UserAgentID: "id", ChangeDate: now(), PasswordVerification: time.Time{}}, + result: &UserSessionView{UserAgentID: "id", ChangeDate: now(), PasswordVerification: sql.NullTime{Time: time.Time{}, Valid: true}}, }, { name: "append human password changed event same user agent", @@ -111,9 +112,9 @@ func TestAppendEvent(t *testing.T) { return d }(), }, - userView: &UserSessionView{UserAgentID: "id", PasswordVerification: now()}, + userView: &UserSessionView{UserAgentID: "id", PasswordVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{UserAgentID: "id", ChangeDate: now(), PasswordVerification: now()}, + result: &UserSessionView{UserAgentID: "id", ChangeDate: now(), PasswordVerification: sql.NullTime{Time: now(), Valid: true}}, }, { name: "append user otp verified event", @@ -142,7 +143,7 @@ func TestAppendEvent(t *testing.T) { }, userView: &UserSessionView{UserAgentID: "id"}, }, - result: &UserSessionView{UserAgentID: "id", ChangeDate: now(), SecondFactorVerification: now()}, + result: &UserSessionView{UserAgentID: "id", ChangeDate: now(), SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}}, }, { name: "append user otp check succeeded event", @@ -150,7 +151,7 @@ func TestAppendEvent(t *testing.T) { event: &es_models.Event{CreationDate: now(), Typ: user.UserV1MFAOTPCheckSucceededType}, userView: &UserSessionView{}, }, - result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: now()}, + result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}}, }, { name: "append human otp check succeeded event", @@ -158,55 +159,77 @@ func TestAppendEvent(t *testing.T) { event: &es_models.Event{CreationDate: now(), Typ: user.HumanMFAOTPCheckSucceededType}, userView: &UserSessionView{}, }, - result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: now()}, + result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}}, }, { name: "append user otp check failed event", args: args{ event: &es_models.Event{CreationDate: now(), Typ: user.UserV1MFAOTPCheckFailedType}, - userView: &UserSessionView{SecondFactorVerification: now()}, + userView: &UserSessionView{SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: time.Time{}}, + result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}}, }, { name: "append human otp check failed event", args: args{ event: &es_models.Event{CreationDate: now(), Typ: user.HumanMFAOTPCheckFailedType}, - userView: &UserSessionView{SecondFactorVerification: now()}, + userView: &UserSessionView{SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: time.Time{}}, + result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}}, }, { name: "append user otp removed event", args: args{ event: &es_models.Event{CreationDate: now(), Typ: user.UserV1MFAOTPRemovedType}, - userView: &UserSessionView{SecondFactorVerification: now()}, + userView: &UserSessionView{SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: time.Time{}}, + result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}}, }, { name: "append human otp removed event", args: args{ event: &es_models.Event{CreationDate: now(), Typ: user.HumanMFAOTPRemovedType}, - userView: &UserSessionView{SecondFactorVerification: now()}, + userView: &UserSessionView{SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}}, }, - result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: time.Time{}}, + result: &UserSessionView{ChangeDate: now(), SecondFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}}, }, { name: "append user signed out event", args: args{ - event: &es_models.Event{CreationDate: now(), Typ: user.UserV1SignedOutType}, - userView: &UserSessionView{PasswordVerification: now(), SecondFactorVerification: now()}, + event: &es_models.Event{CreationDate: now(), Typ: user.UserV1SignedOutType}, + userView: &UserSessionView{ + PasswordVerification: sql.NullTime{Time: now(), Valid: true}, + SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}, + }, + }, + result: &UserSessionView{ + ChangeDate: now(), + PasswordVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + SecondFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + ExternalLoginVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + PasswordlessVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + MultiFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + State: 1, }, - result: &UserSessionView{ChangeDate: now(), PasswordVerification: time.Time{}, SecondFactorVerification: time.Time{}, State: 1}, }, { name: "append human signed out event", args: args{ - event: &es_models.Event{CreationDate: now(), Typ: user.HumanSignedOutType}, - userView: &UserSessionView{PasswordVerification: now(), SecondFactorVerification: now()}, + event: &es_models.Event{CreationDate: now(), Typ: user.HumanSignedOutType}, + userView: &UserSessionView{ + PasswordVerification: sql.NullTime{Time: now(), Valid: true}, + SecondFactorVerification: sql.NullTime{Time: now(), Valid: true}, + }, + }, + result: &UserSessionView{ + ChangeDate: now(), + PasswordVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + SecondFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + ExternalLoginVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + PasswordlessVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + MultiFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}, + State: 1, }, - result: &UserSessionView{ChangeDate: now(), PasswordVerification: time.Time{}, SecondFactorVerification: time.Time{}, State: 1}, }, } for _, tt := range tests { diff --git a/internal/user/repository/view/refresh_token_view.go b/internal/user/repository/view/refresh_token_view.go index 642dfc1016..bc8c8b79a1 100644 --- a/internal/user/repository/view/refresh_token_view.go +++ b/internal/user/repository/view/refresh_token_view.go @@ -42,74 +42,9 @@ func RefreshTokensByUserID(db *gorm.DB, table, userID, instanceID string) ([]*us return tokens, err } -func PutRefreshToken(db *gorm.DB, table string, token *usr_model.RefreshTokenView) error { - save := repository.PrepareSaveOnConflict(table, - []string{"client_id", "user_agent_id", "user_id"}, - []string{"id", "creation_date", "change_date", "token", "auth_time", "idle_expiration", "expiration", "sequence", "scopes", "audience", "amr"}, - ) - return save(db, token) -} - -func PutRefreshTokens(db *gorm.DB, table string, tokens ...*usr_model.RefreshTokenView) error { - save := repository.PrepareBulkSave(table) - t := make([]interface{}, len(tokens)) - for i, token := range tokens { - t[i] = token - } - return save(db, t...) -} - func SearchRefreshTokens(db *gorm.DB, table string, req *model.RefreshTokenSearchRequest) ([]*usr_model.RefreshTokenView, uint64, error) { tokens := make([]*usr_model.RefreshTokenView, 0) query := repository.PrepareSearchQuery(table, usr_model.RefreshTokenSearchRequest{Limit: req.Limit, Offset: req.Offset, Queries: req.Queries}) count, err := query(db, &tokens) return tokens, count, err } - -func DeleteRefreshToken(db *gorm.DB, table, tokenID, instanceID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyRefreshTokenID), tokenID}, - repository.Key{usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyInstanceID), instanceID}, - ) - return delete(db) -} - -func DeleteSessionRefreshTokens(db *gorm.DB, table, agentID, userID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyUserAgentID), Value: agentID}, - repository.Key{Key: usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyUserID), Value: userID}, - ) - return delete(db) -} - -func DeleteUserRefreshTokens(db *gorm.DB, table, userID, instanceID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyUserID), userID}, - repository.Key{usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyInstanceID), instanceID}, - ) - return delete(db) -} - -func DeleteApplicationRefreshTokens(db *gorm.DB, table string, instanceID string, appIDs []string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyInstanceID), Value: instanceID}, - repository.Key{Key: usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyApplicationID), Value: appIDs}, - ) - return delete(db) -} - -func DeleteOrgRefreshTokens(db *gorm.DB, table string, instanceID, orgID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyInstanceID), Value: instanceID}, - repository.Key{Key: usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyResourceOwner), Value: orgID}, - ) - return delete(db) -} - -func DeleteInstanceRefreshTokens(db *gorm.DB, table string, instanceID string) error { - delete := repository.PrepareDeleteByKey(table, - usr_model.RefreshTokenSearchKey(model.RefreshTokenSearchKeyInstanceID), - instanceID, - ) - return delete(db) -} diff --git a/internal/user/repository/view/token_view.go b/internal/user/repository/view/token_view.go index 72a0d164a4..9c681c1f67 100644 --- a/internal/user/repository/view/token_view.go +++ b/internal/user/repository/view/token_view.go @@ -47,74 +47,3 @@ func TokensByUserID(db *gorm.DB, table, userID, instanceID string) ([]*usr_model _, err := query(db, &tokens) return tokens, err } - -func PutToken(db *gorm.DB, table string, token *usr_model.TokenView) error { - save := repository.PrepareSave(table) - return save(db, token) -} - -func PutTokens(db *gorm.DB, table string, tokens ...*usr_model.TokenView) error { - save := repository.PrepareBulkSave(table) - t := make([]interface{}, len(tokens)) - for i, token := range tokens { - t[i] = token - } - return save(db, t...) -} - -func DeleteToken(db *gorm.DB, table, tokenID, instanceID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyTokenID), Value: tokenID}, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyInstanceID), Value: instanceID}, - ) - return delete(db) -} - -func DeleteSessionTokens(db *gorm.DB, table, agentID, userID, instanceID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyUserAgentID), Value: agentID}, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyUserID), Value: userID}, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyInstanceID), Value: instanceID}, - ) - return delete(db) -} - -func DeleteUserTokens(db *gorm.DB, table, userID, instanceID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyUserID), Value: userID}, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyInstanceID), Value: instanceID}, - ) - return delete(db) -} - -func DeleteTokensFromRefreshToken(db *gorm.DB, table, refreshTokenID, instanceID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyRefreshTokenID), Value: refreshTokenID}, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyInstanceID), Value: instanceID}, - ) - return delete(db) -} - -func DeleteApplicationTokens(db *gorm.DB, table, instanceID string, appIDs []string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyApplicationID), Value: appIDs}, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyInstanceID), Value: instanceID}, - ) - return delete(db) -} - -func DeleteInstanceTokens(db *gorm.DB, table, instanceID string) error { - delete := repository.PrepareDeleteByKey(table, - usr_model.TokenSearchKey(model.TokenSearchKeyInstanceID), - instanceID, - ) - return delete(db) -} - -func DeleteOrgTokens(db *gorm.DB, table, instanceID, orgID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyResourceOwner), Value: orgID}, - repository.Key{Key: usr_model.TokenSearchKey(model.TokenSearchKeyInstanceID), Value: instanceID}, - ) - return delete(db) -} diff --git a/internal/user/repository/view/user_by_id.sql b/internal/user/repository/view/user_by_id.sql new file mode 100644 index 0000000000..fa85fc43f4 --- /dev/null +++ b/internal/user/repository/view/user_by_id.sql @@ -0,0 +1,93 @@ +WITH auth_methods AS ( + SELECT + user_id + , method_type + , token_id + , state + , instance_id + , name + FROM + projections.user_auth_methods4 + WHERE + instance_id = $1 + AND user_id = $2 +), +verified_auth_methods AS ( + SELECT + method_type + FROM + auth_methods + WHERE state = 2 +) +SELECT + u.id + , u.creation_date + , LEAST(u.change_date, au.change_date) AS change_date + , u.resource_owner + , u.state AS user_state + , au.password_set + , h.password_change_required + , au.password_change + , au.last_login + , u.username AS user_name + , (SELECT array_agg(ll.login_name) login_names FROM projections.login_names3 ll + WHERE u.instance_id = ll.instance_id AND u.id = ll.user_id + GROUP BY ll.user_id, ll.instance_id) AS login_names + , l.login_name + , h.first_name + , h.last_name + , h.nick_name + , h.display_name + , h.preferred_language + , h.gender + , h.email + , h.is_email_verified + , h.phone + , h.is_phone_verified + , (SELECT COALESCE((SELECT state FROM auth_methods WHERE method_type = 1), 0)) AS otp_state + , CASE + WHEN EXISTS (SELECT true FROM verified_auth_methods WHERE method_type = 3) THEN 2 + WHEN EXISTS (SELECT true FROM verified_auth_methods WHERE method_type = 2) THEN 1 + ELSE 0 + END AS mfa_max_set_up + , au.mfa_init_skipped + , u.sequence + , au.init_required + , au.username_change_required + , m.name AS machine_name + , m.description AS machine_description + , u.type AS user_type + , (SELECT + JSONB_AGG(json_build_object('webAuthNTokenId', token_id, 'webAuthNTokenName', name, 'state', state)) + FROM auth_methods + WHERE method_type = 2 + ) AS u2f_tokens + , (SELECT + JSONB_AGG(json_build_object('webAuthNTokenId', token_id, 'webAuthNTokenName', name, 'state', state)) + FROM auth_methods + WHERE method_type = 3 + ) AS passwordless_tokens + , h.avatar_key + , au.passwordless_init_required + , au.password_init_required + , u.instance_id + , (SELECT EXISTS (SELECT true FROM verified_auth_methods WHERE method_type = 6)) AS otp_sms_added + , (SELECT EXISTS (SELECT true FROM verified_auth_methods WHERE method_type = 7)) AS otp_email_added +FROM projections.users12 u + LEFT JOIN projections.users12_humans h + ON u.instance_id = h.instance_id + AND u.id = h.user_id + LEFT JOIN projections.login_names3 l + ON u.instance_id = l.instance_id + AND u.id = l.user_id + AND l.is_primary = true + LEFT JOIN projections.users12_machines m + ON u.instance_id = m.instance_id + AND u.id = m.user_id + LEFT JOIN auth.users3 au + ON u.instance_id = au.instance_id + AND u.id = au.id +WHERE + u.instance_id = $1 + AND u.id = $2 +LIMIT 1; \ No newline at end of file diff --git a/internal/user/repository/view/user_session_view.go b/internal/user/repository/view/user_session_view.go index 3afd3c16b2..2de6233797 100644 --- a/internal/user/repository/view/user_session_view.go +++ b/internal/user/repository/view/user_session_view.go @@ -5,12 +5,8 @@ import ( _ "embed" "errors" - "github.com/jinzhu/gorm" - "github.com/zitadel/zitadel/internal/database" - usr_model "github.com/zitadel/zitadel/internal/user/model" "github.com/zitadel/zitadel/internal/user/repository/view/model" - "github.com/zitadel/zitadel/internal/view/repository" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -46,38 +42,8 @@ func UserSessionsByAgentID(db *database.DB, agentID, instanceID string) (userSes return userSessions, err } -func PutUserSession(db *gorm.DB, table string, session *model.UserSessionView) error { - save := repository.PrepareSave(table) - return save(db, session) -} - -func DeleteUserSessions(db *gorm.DB, table, userID, instanceID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: model.UserSessionSearchKey(usr_model.UserSessionSearchKeyUserID), Value: userID}, - repository.Key{Key: model.UserSessionSearchKey(usr_model.UserSessionSearchKeyInstanceID), Value: instanceID}, - ) - return delete(db) -} - -func DeleteInstanceUserSessions(db *gorm.DB, table, instanceID string) error { - delete := repository.PrepareDeleteByKey(table, - model.UserSessionSearchKey(usr_model.UserSessionSearchKeyInstanceID), - instanceID, - ) - return delete(db) -} - -func DeleteOrgUserSessions(db *gorm.DB, table, instanceID, orgID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{Key: model.UserSessionSearchKey(usr_model.UserSessionSearchKeyResourceOwner), Value: orgID}, - repository.Key{Key: model.UserSessionSearchKey(usr_model.UserSessionSearchKeyInstanceID), Value: instanceID}, - ) - return delete(db) -} - func scanUserSession(row *sql.Row) (*model.UserSessionView, error) { session := new(model.UserSessionView) - var userName, loginName, displayName, avatarKey sql.NullString err := row.Scan( &session.CreationDate, &session.ChangeDate, @@ -85,10 +51,10 @@ func scanUserSession(row *sql.Row) (*model.UserSessionView, error) { &session.State, &session.UserAgentID, &session.UserID, - &userName, - &loginName, - &displayName, - &avatarKey, + &session.UserName, + &session.LoginName, + &session.DisplayName, + &session.AvatarKey, &session.SelectedIDPConfigID, &session.PasswordVerification, &session.PasswordlessVerification, @@ -103,10 +69,6 @@ func scanUserSession(row *sql.Row) (*model.UserSessionView, error) { if errors.Is(err, sql.ErrNoRows) { return nil, zerrors.ThrowNotFound(nil, "VIEW-NGBs1", "Errors.UserSession.NotFound") } - session.UserName = userName.String - session.LoginName = loginName.String - session.DisplayName = displayName.String - session.AvatarKey = avatarKey.String return session, err } @@ -114,7 +76,6 @@ func scanUserSessions(rows *sql.Rows) ([]*model.UserSessionView, error) { sessions := make([]*model.UserSessionView, 0) for rows.Next() { session := new(model.UserSessionView) - var userName, loginName, displayName, avatarKey sql.NullString err := rows.Scan( &session.CreationDate, &session.ChangeDate, @@ -122,10 +83,10 @@ func scanUserSessions(rows *sql.Rows) ([]*model.UserSessionView, error) { &session.State, &session.UserAgentID, &session.UserID, - &userName, - &loginName, - &displayName, - &avatarKey, + &session.UserName, + &session.LoginName, + &session.DisplayName, + &session.AvatarKey, &session.SelectedIDPConfigID, &session.PasswordVerification, &session.PasswordlessVerification, @@ -140,10 +101,6 @@ func scanUserSessions(rows *sql.Rows) ([]*model.UserSessionView, error) { if err != nil { return nil, err } - session.UserName = userName.String - session.LoginName = loginName.String - session.DisplayName = displayName.String - session.AvatarKey = avatarKey.String sessions = append(sessions, session) } diff --git a/internal/user/repository/view/user_view.go b/internal/user/repository/view/user_view.go index 0b0aeba47d..98b23f4661 100644 --- a/internal/user/repository/view/user_view.go +++ b/internal/user/repository/view/user_view.go @@ -1,98 +1,42 @@ package view import ( - "github.com/jinzhu/gorm" + "context" + "database/sql" + _ "embed" + "errors" + + "github.com/jinzhu/gorm" + "github.com/zitadel/logging" - "github.com/zitadel/zitadel/internal/domain" - usr_model "github.com/zitadel/zitadel/internal/user/model" "github.com/zitadel/zitadel/internal/user/repository/view/model" - "github.com/zitadel/zitadel/internal/view/repository" "github.com/zitadel/zitadel/internal/zerrors" ) +//go:embed user_by_id.sql +var userByIDQuery string + func UserByID(db *gorm.DB, table, userID, instanceID string) (*model.UserView, error) { user := new(model.UserView) - userIDQuery := &model.UserSearchQuery{ - Key: usr_model.UserSearchKeyUserID, - Method: domain.SearchMethodEquals, - Value: userID, - } - instanceIDQuery := &model.UserSearchQuery{ - Key: usr_model.UserSearchKeyInstanceID, - Method: domain.SearchMethodEquals, - Value: instanceID, - } - ownerRemovedQuery := &model.UserSearchQuery{ - Key: usr_model.UserSearchOwnerRemoved, - Method: domain.SearchMethodEquals, - Value: false, - } - query := repository.PrepareGetByQuery(table, userIDQuery, instanceIDQuery, ownerRemovedQuery) - err := query(db, user) - if zerrors.IsNotFound(err) { - return nil, zerrors.ThrowNotFound(nil, "VIEW-sj8Sw", "Errors.User.NotFound") - } - user.SetEmptyUserType() - return user, err -} -func UsersByOrgID(db *gorm.DB, table, orgID, instanceID string) ([]*model.UserView, error) { - users := make([]*model.UserView, 0) - orgIDQuery := &usr_model.UserSearchQuery{ - Key: usr_model.UserSearchKeyResourceOwner, - Method: domain.SearchMethodEquals, - Value: orgID, + query := db.Raw(userByIDQuery, instanceID, userID) + + tx := query.BeginTx(context.Background(), &sql.TxOptions{ReadOnly: true}) + defer func() { + if err := tx.Commit().Error; err != nil { + logging.OnError(err).Info("commit failed") + } + tx.RollbackUnlessCommitted() + }() + + err := tx.Scan(user).Error + if err == nil { + user.SetEmptyUserType() + return user, nil } - instanceIDQuery := &usr_model.UserSearchQuery{ - Key: usr_model.UserSearchKeyInstanceID, - Method: domain.SearchMethodEquals, - Value: instanceID, + if errors.Is(err, gorm.ErrRecordNotFound) { + return nil, zerrors.ThrowNotFound(err, "VIEW-hodc6", "object not found") } - ownerRemovedQuery := &usr_model.UserSearchQuery{ - Key: usr_model.UserSearchOwnerRemoved, - Method: domain.SearchMethodEquals, - Value: false, - } - query := repository.PrepareSearchQuery(table, model.UserSearchRequest{ - Queries: []*usr_model.UserSearchQuery{orgIDQuery, instanceIDQuery, ownerRemovedQuery}, - }) - _, err := query(db, &users) - return users, err -} - -func PutUsers(db *gorm.DB, table string, users ...*model.UserView) error { - save := repository.PrepareBulkSave(table) - u := make([]interface{}, len(users)) - for i, user := range users { - u[i] = user - } - return save(db, u...) -} - -func PutUser(db *gorm.DB, table string, user *model.UserView) error { - save := repository.PrepareSave(table) - return save(db, user) -} - -func DeleteUser(db *gorm.DB, table, userID, instanceID string) error { - delete := repository.PrepareDeleteByKeys(table, - repository.Key{model.UserSearchKey(usr_model.UserSearchKeyUserID), userID}, - repository.Key{model.UserSearchKey(usr_model.UserSearchKeyInstanceID), instanceID}, - ) - return delete(db) -} - -func DeleteInstanceUsers(db *gorm.DB, table, instanceID string) error { - delete := repository.PrepareDeleteByKey(table, model.UserSearchKey(usr_model.UserSearchKeyInstanceID), instanceID) - return delete(db) -} - -func UpdateOrgOwnerRemovedUsers(db *gorm.DB, table, instanceID, aggID string) error { - update := repository.PrepareUpdateByKeys(table, - model.UserSearchKey(usr_model.UserSearchOwnerRemoved), - true, - repository.Key{Key: model.UserSearchKey(usr_model.UserSearchKeyInstanceID), Value: instanceID}, - repository.Key{Key: model.UserSearchKey(usr_model.UserSearchKeyResourceOwner), Value: aggID}, - ) - return update(db) + logging.WithFields("table ", table).WithError(err).Warn("get from cache error") + return nil, zerrors.ThrowInternal(err, "VIEW-qJBg9", "cache error") } From f37113194d6a6407264450cbea2dbb0dd7eb49cd Mon Sep 17 00:00:00 2001 From: Stefan Benz <46600784+stebenz@users.noreply.github.com> Date: Wed, 22 May 2024 18:05:06 +0200 Subject: [PATCH 19/35] fix: actions v2 circular check for includes (#7563) Add a check for circular includes in action v2 executions, so that no self-includes or infinite loops can happen. Closes #7445 ### Definition of Ready - [x] I am happy with the code - [x] Short description of the feature/issue is added in the pr description - [x] PR is linked to the corresponding user story - [x] Acceptance criteria are met - [x] All open todos and follow ups are defined in a new ticket and justified - [x] Deviations from the acceptance criteria and design are agreed with the PO and documented. - [x] No debug or dead code - [x] My code has no repetitions - [x] Critical parts are tested automatically - [x] Where possible E2E tests are implemented - [x] Documentation/examples are up-to-date - [x] All non-functional requirements are met - [x] Functionality of the acceptance criteria is checked manually on the dev system. --------- Co-authored-by: Livio Spring --- docs/docs/apis/actionsv2/introduction.md | 5 + .../v3alpha/execution_integration_test.go | 60 ++- internal/command/action_v2_execution.go | 76 ++- internal/command/action_v2_execution_model.go | 11 + internal/command/action_v2_execution_test.go | 497 ++++++++++++++++++ 5 files changed, 624 insertions(+), 25 deletions(-) diff --git a/docs/docs/apis/actionsv2/introduction.md b/docs/docs/apis/actionsv2/introduction.md index 16adaac423..e6362c1aee 100644 --- a/docs/docs/apis/actionsv2/introduction.md +++ b/docs/docs/apis/actionsv2/introduction.md @@ -86,6 +86,11 @@ And if you use a different service, for example `zitadel.session.v2.SessionServi ### Targets and Includes +:::info +Includes are limited to 3 levels, which mean that include1->include2->include3 is the maximum for now. +If you have feedback to the include logic, or a reason why 3 levels are not enough, please open [an issue on github](https://github.com/zitadel/zitadel/issues) or [start a discussion on github](https://github.com/zitadel/zitadel/discussions)/[start a topic on discord](https://zitadel.com/chat) +::: + An execution can not only contain a list of Targets, but also Includes. The Includes can be defined in the Execution directly, which means you include all defined Targets by a before set Execution. diff --git a/internal/api/grpc/action/v3alpha/execution_integration_test.go b/internal/api/grpc/action/v3alpha/execution_integration_test.go index 4ca1b97d6f..fcbdb2b576 100644 --- a/internal/api/grpc/action/v3alpha/execution_integration_test.go +++ b/internal/api/grpc/action/v3alpha/execution_integration_test.go @@ -196,6 +196,33 @@ func TestServer_SetExecution_Request_Include(t *testing.T) { executionTargetsSingleTarget(targetResp.GetId()), ) + circularExecutionService := &action.Condition{ + ConditionType: &action.Condition_Request{ + Request: &action.RequestExecution{ + Condition: &action.RequestExecution_Service{ + Service: "zitadel.session.v2beta.SessionService", + }, + }, + }, + } + Tester.SetExecution(CTX, t, + circularExecutionService, + executionTargetsSingleInclude(executionCond), + ) + circularExecutionMethod := &action.Condition{ + ConditionType: &action.Condition_Request{ + Request: &action.RequestExecution{ + Condition: &action.RequestExecution_Method{ + Method: "/zitadel.session.v2beta.SessionService/ListSessions", + }, + }, + }, + } + Tester.SetExecution(CTX, t, + circularExecutionMethod, + executionTargetsSingleInclude(circularExecutionService), + ) + tests := []struct { name string ctx context.Context @@ -203,6 +230,15 @@ func TestServer_SetExecution_Request_Include(t *testing.T) { want *action.SetExecutionResponse wantErr bool }{ + { + name: "method, circular error", + ctx: CTX, + req: &action.SetExecutionRequest{ + Condition: circularExecutionService, + Targets: executionTargetsSingleInclude(circularExecutionMethod), + }, + wantErr: true, + }, { name: "method, ok", ctx: CTX, @@ -247,30 +283,6 @@ func TestServer_SetExecution_Request_Include(t *testing.T) { }, }, }, - /* circular - { - name: "all, ok", - ctx: CTX, - req: &action.SetExecutionRequest{ - Condition: &action.Condition{ - ConditionType: &action.Condition_Request{ - Request: &action.RequestExecution{ - Condition: &action.RequestExecution_All{ - All: true, - }, - }, - }, - }, - Targets: executionTargetsSingleInclude(executionCond), - }, - want: &action.SetExecutionResponse{ - Details: &object.Details{ - ChangeDate: timestamppb.Now(), - ResourceOwner: Tester.Instance.InstanceID(), - }, - }, - }, - */ } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff --git a/internal/command/action_v2_execution.go b/internal/command/action_v2_execution.go index 422e053daf..7fb08a4a32 100644 --- a/internal/command/action_v2_execution.go +++ b/internal/command/action_v2_execution.go @@ -216,7 +216,9 @@ func (e *SetExecution) Existing(c *Commands, ctx context.Context, resourceOwner if len(includes) > 0 && !c.existsExecutionsByIDs(ctx, includes, resourceOwner) { return zerrors.ThrowNotFound(nil, "COMMAND-slgj0l4cdz", "Errors.Execution.IncludeNotFound") } - return nil + get, set := createIncludeCacheFunctions() + // maxLevels could be configurable, but set as 3 for now + return checkForIncludeCircular(ctx, e.AggregateID, resourceOwner, includes, c.getExecutionIncludes(get, set), 3) } func (c *Commands) setExecution(ctx context.Context, set *SetExecution, resourceOwner string) (_ *domain.ObjectDetails, err error) { @@ -309,3 +311,75 @@ func (c *Commands) getExecutionWriteModelByID(ctx context.Context, id string, re } return wm, nil } + +func createIncludeCacheFunctions() (func(s string) ([]string, bool), func(s string, strings []string)) { + tempCache := make(map[string][]string) + return func(s string) ([]string, bool) { + include, ok := tempCache[s] + return include, ok + }, func(s string, strings []string) { + tempCache[s] = strings + } +} + +type includeCacheFunc func(ctx context.Context, id string, resourceOwner string) ([]string, error) + +func checkForIncludeCircular(ctx context.Context, id string, resourceOwner string, includes []string, cache includeCacheFunc, maxLevels int) error { + if len(includes) == 0 { + return nil + } + level := 0 + for _, include := range includes { + if id == include { + return zerrors.ThrowPreconditionFailed(nil, "COMMAND-mo1cmjp5k7", "Errors.Execution.CircularInclude") + } + if err := checkForIncludeCircularRecur(ctx, []string{id}, resourceOwner, include, cache, maxLevels, level); err != nil { + return err + } + } + return nil +} + +func (c *Commands) getExecutionIncludes( + getCache func(string) ([]string, bool), + setCache func(string, []string), +) includeCacheFunc { + return func(ctx context.Context, id string, resourceOwner string) ([]string, error) { + included, ok := getCache(id) + if !ok { + included, err := c.getExecutionWriteModelByID(ctx, id, resourceOwner) + if err != nil { + return nil, err + } + includes := included.IncludeList() + setCache(id, includes) + return includes, nil + } + return included, nil + } +} + +func checkForIncludeCircularRecur(ctx context.Context, ids []string, resourceOwner string, include string, cache includeCacheFunc, maxLevels, level int) error { + included, err := cache(ctx, include, resourceOwner) + if err != nil { + return err + } + currentLevel := level + 1 + if currentLevel >= maxLevels { + return zerrors.ThrowPreconditionFailed(nil, "COMMAND-gbhd3g57oo", "Errors.Execution.MaxLevelsInclude") + } + for _, includedInclude := range included { + if include == includedInclude { + return zerrors.ThrowPreconditionFailed(nil, "COMMAND-iuch02i656", "Errors.Execution.CircularInclude") + } + for _, id := range ids { + if includedInclude == id { + return zerrors.ThrowPreconditionFailed(nil, "COMMAND-819opvhgjv", "Errors.Execution.CircularInclude") + } + } + if err := checkForIncludeCircularRecur(ctx, append(ids, include), resourceOwner, includedInclude, cache, maxLevels, currentLevel); err != nil { + return err + } + } + return nil +} diff --git a/internal/command/action_v2_execution_model.go b/internal/command/action_v2_execution_model.go index c53992856e..30cab0f56e 100644 --- a/internal/command/action_v2_execution_model.go +++ b/internal/command/action_v2_execution_model.go @@ -3,6 +3,7 @@ package command import ( "slices" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/execution" ) @@ -15,6 +16,16 @@ type ExecutionWriteModel struct { ExecutionTargets []*execution.Target } +func (e *ExecutionWriteModel) IncludeList() []string { + includes := make([]string, 0) + for i := range e.ExecutionTargets { + if e.ExecutionTargets[i].Type == domain.ExecutionTargetTypeInclude { + includes = append(includes, e.ExecutionTargets[i].Target) + } + } + return includes +} + func (e *ExecutionWriteModel) Exists() bool { return len(e.ExecutionTargets) > 0 || len(e.Includes) > 0 || len(e.Targets) > 0 } diff --git a/internal/command/action_v2_execution_test.go b/internal/command/action_v2_execution_test.go index c8f91f49b2..5a9c0ecb1d 100644 --- a/internal/command/action_v2_execution_test.go +++ b/internal/command/action_v2_execution_test.go @@ -348,6 +348,16 @@ func TestCommands_SetExecutionRequest(t *testing.T) { "push ok, method include", fields{ eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + execution.NewSetEventV2(context.Background(), + execution.NewAggregate("request/include", "instance"), + []*execution.Target{ + {Type: domain.ExecutionTargetTypeTarget, Target: "target"}, + }, + ), + ), + ), expectFilter( eventFromEventPusher( execution.NewSetEventV2(context.Background(), @@ -419,6 +429,16 @@ func TestCommands_SetExecutionRequest(t *testing.T) { "push ok, service include", fields{ eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + execution.NewSetEventV2(context.Background(), + execution.NewAggregate("request/include", "instance"), + []*execution.Target{ + {Type: domain.ExecutionTargetTypeTarget, Target: "target"}, + }, + ), + ), + ), expectFilter( eventFromEventPusher( execution.NewSetEventV2(context.Background(), @@ -489,6 +509,16 @@ func TestCommands_SetExecutionRequest(t *testing.T) { "push ok, all include", fields{ eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + execution.NewSetEventV2(context.Background(), + execution.NewAggregate("request/include", "instance"), + []*execution.Target{ + {Type: domain.ExecutionTargetTypeTarget, Target: "target"}, + }, + ), + ), + ), expectFilter( eventFromEventPusher( execution.NewSetEventV2(context.Background(), @@ -2373,3 +2403,470 @@ func TestCommands_DeleteExecutionFunction(t *testing.T) { }) } } + +func mockExecutionIncludesCache(cache map[string][]string) includeCacheFunc { + return func(ctx context.Context, id string, resourceOwner string) ([]string, error) { + included, ok := cache[id] + if !ok { + return nil, zerrors.ThrowPreconditionFailed(nil, "", "cache failed") + } + return included, nil + } +} + +func TestCommands_checkForIncludeCircular(t *testing.T) { + type args struct { + ctx context.Context + id string + resourceOwner string + includes []string + cache map[string][]string + } + type res struct { + err func(error) bool + } + tests := []struct { + name string + args args + res res + }{ + { + "not found, error", + args{ + ctx: context.Background(), + id: "id", + resourceOwner: "", + includes: []string{"notexistent"}, + cache: map[string][]string{}, + }, + res{ + err: zerrors.IsPreconditionFailed, + }, + }, + { + "single, ok", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id2"}, + cache: map[string][]string{ + "id2": {}, + }, + }, + res{}, + }, + { + "single, circular", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id1"}, + cache: map[string][]string{}, + }, + res{ + err: zerrors.IsPreconditionFailed, + }, + }, + { + "multi 3, ok", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id2"}, + cache: map[string][]string{ + "id2": {"id3"}, + "id3": {}, + }, + }, + res{}, + }, + { + "multi 3, circular", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id2"}, + cache: map[string][]string{ + "id2": {"id3"}, + "id3": {"id1"}, + }, + }, + res{ + err: zerrors.IsPreconditionFailed, + }, + }, + { + "multi 5, ok", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id11", "id12"}, + cache: map[string][]string{ + "id11": {"id21", "id23"}, + "id12": {"id22"}, + "id21": {}, + "id22": {}, + "id23": {}, + }, + }, + res{}, + }, + { + "multi 5, circular", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id11", "id12"}, + cache: map[string][]string{ + "id11": {"id21", "id23"}, + "id12": {"id22"}, + "id21": {}, + "id22": {}, + "id23": {"id1"}, + }, + }, + res{ + err: zerrors.IsPreconditionFailed, + }, + }, + { + "multi 5, circular", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id11", "id12"}, + cache: map[string][]string{ + "id11": {"id21", "id23"}, + "id12": {"id22"}, + "id21": {}, + "id22": {}, + "id23": {"id11"}, + }, + }, + res{ + err: zerrors.IsPreconditionFailed, + }, + }, + { + "multi 5, circular", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id11", "id12"}, + cache: map[string][]string{ + "id11": {"id21", "id23"}, + "id12": {"id22"}, + "id21": {"id11"}, + "id22": {}, + "id23": {}, + }, + }, + res{ + err: zerrors.IsPreconditionFailed, + }, + }, + { + "multi 5, circular", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id11", "id12"}, + cache: map[string][]string{ + "id11": {"id21", "id23"}, + "id12": {"id22"}, + "id21": {}, + "id22": {"id12"}, + "id23": {}, + }, + }, + res{ + err: zerrors.IsPreconditionFailed, + }, + }, + { + "multi 3, maxlevel", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id2"}, + cache: map[string][]string{ + "id2": {"id3"}, + "id3": {}, + }, + }, + res{}, + }, + { + "multi 4, over maxlevel", + args{ + ctx: context.Background(), + id: "id1", + resourceOwner: "", + includes: []string{"id2"}, + cache: map[string][]string{ + "id2": {"id3"}, + "id3": {"id4"}, + "id4": {}, + }, + }, + res{ + err: zerrors.IsPreconditionFailed, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + f := mockExecutionIncludesCache(tt.args.cache) + err := checkForIncludeCircular(tt.args.ctx, tt.args.id, tt.args.resourceOwner, tt.args.includes, f, 3) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + }) + } +} + +func mockExecutionIncludesCacheFuncs(cache map[string][]string) (func(string) ([]string, bool), func(string, []string)) { + return func(s string) ([]string, bool) { + includes, ok := cache[s] + return includes, ok + }, func(s string, strings []string) { + cache[s] = strings + } +} + +func TestCommands_getExecutionIncludes(t *testing.T) { + type fields struct { + eventstore func(t *testing.T) *eventstore.Eventstore + } + type args struct { + ctx context.Context + cache map[string][]string + id string + resourceOwner string + } + type res struct { + includes []string + cache map[string][]string + err func(error) bool + } + tests := []struct { + name string + fields fields + args args + res res + }{ + { + "new empty, ok", + fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + execution.NewSetEventV2(context.Background(), + execution.NewAggregate("request/include", "instance"), + []*execution.Target{ + {Type: domain.ExecutionTargetTypeTarget, Target: "target"}, + }, + ), + ), + ), + ), + }, + args{ + ctx: context.Background(), + cache: map[string][]string{}, + id: "id", + resourceOwner: "instance", + }, + res{ + includes: []string{}, + cache: map[string][]string{"id": {}}, + }, + }, + { + "new includes, ok", + fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + execution.NewSetEventV2(context.Background(), + execution.NewAggregate("request/include", "instance"), + []*execution.Target{ + {Type: domain.ExecutionTargetTypeInclude, Target: "include"}, + }, + ), + ), + ), + ), + }, + args{ + ctx: context.Background(), + cache: map[string][]string{}, + id: "id", + resourceOwner: "instance", + }, + res{ + includes: []string{"include"}, + cache: map[string][]string{"id": {"include"}}, + }, + }, + { + "found, ok", + fields{ + eventstore: expectEventstore(), + }, + args{ + ctx: context.Background(), + cache: map[string][]string{"id": nil}, + id: "id", + resourceOwner: "instance", + }, + res{ + includes: nil, + cache: map[string][]string{"id": nil}, + }, + }, + { + "found includes, ok", + fields{ + eventstore: expectEventstore(), + }, + args{ + ctx: context.Background(), + cache: map[string][]string{"id": {"include1", "include2", "include3"}}, + id: "id", + resourceOwner: "instance", + }, + res{ + includes: []string{"include1", "include2", "include3"}, + cache: map[string][]string{"id": {"include1", "include2", "include3"}}, + }, + }, + { + "found multiple, ok", + fields{ + eventstore: expectEventstore(), + }, + args{ + ctx: context.Background(), + cache: map[string][]string{ + "id1": {"include1", "include2", "include3"}, + "id2": {"include1", "include2", "include3"}, + "id3": {"include1", "include2", "include3"}, + }, + id: "id2", + resourceOwner: "instance", + }, + res{ + includes: []string{"include1", "include2", "include3"}, + cache: map[string][]string{ + "id1": {"include1", "include2", "include3"}, + "id2": {"include1", "include2", "include3"}, + "id3": {"include1", "include2", "include3"}, + }, + }, + }, + { + "new multiple, ok", + fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + execution.NewSetEventV2(context.Background(), + execution.NewAggregate("request/include", "instance"), + []*execution.Target{ + {Type: domain.ExecutionTargetTypeTarget, Target: "target"}, + }, + ), + ), + ), + ), + }, + args{ + ctx: context.Background(), + cache: map[string][]string{ + "id1": {"include1", "include2", "include3"}, + "id2": {"include1", "include2", "include3"}, + "id3": {"include1", "include2", "include3"}, + }, + id: "id", + resourceOwner: "instance", + }, + res{ + includes: []string{}, + cache: map[string][]string{ + "id1": {"include1", "include2", "include3"}, + "id2": {"include1", "include2", "include3"}, + "id3": {"include1", "include2", "include3"}, + "id": {}, + }, + }, + }, + { + "new multiple includes, ok", + fields{ + eventstore: expectEventstore( + expectFilter( + eventFromEventPusher( + execution.NewSetEventV2(context.Background(), + execution.NewAggregate("request/include", "instance"), + []*execution.Target{ + {Type: domain.ExecutionTargetTypeInclude, Target: "include"}, + }, + ), + ), + ), + ), + }, + args{ + ctx: context.Background(), + cache: map[string][]string{ + "id1": {"include1", "include2", "include3"}, + "id2": {"include1", "include2", "include3"}, + "id3": {"include1", "include2", "include3"}, + }, + id: "id", + resourceOwner: "instance", + }, + res{ + includes: []string{"include"}, + cache: map[string][]string{ + "id1": {"include1", "include2", "include3"}, + "id2": {"include1", "include2", "include3"}, + "id3": {"include1", "include2", "include3"}, + "id": {"include"}, + }, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + c := &Commands{ + eventstore: tt.fields.eventstore(t), + } + includes, err := c.getExecutionIncludes(mockExecutionIncludesCacheFuncs(tt.args.cache))(tt.args.ctx, tt.args.id, tt.args.resourceOwner) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + if tt.res.err == nil { + assert.Equal(t, tt.res.cache, tt.args.cache) + assert.Equal(t, tt.res.includes, includes) + } + }) + } +} From 12be21a3ff3e65f6894f9b63962b1f1f0435be91 Mon Sep 17 00:00:00 2001 From: Silvan Date: Thu, 23 May 2024 06:36:08 +0200 Subject: [PATCH 20/35] refactor(v2): init events (#7823) creates events structures for initial projections and read models --- internal/v2/avatar/added.go | 7 + internal/v2/avatar/removed.go | 7 + internal/v2/database/mock/sql_mock.go | 8 + internal/v2/domain/added.go | 7 + internal/v2/domain/primary_set.go | 7 + internal/v2/domain/removed.go | 7 + internal/v2/domain/verfied.go | 7 + internal/v2/eventstore/event.go | 76 ++- internal/v2/eventstore/event_store.go | 10 +- internal/v2/eventstore/postgres/event.go | 74 +-- internal/v2/eventstore/postgres/intent.go | 5 + internal/v2/eventstore/postgres/push.go | 29 +- internal/v2/eventstore/postgres/push_test.go | 453 +++++++++--------- internal/v2/eventstore/postgres/query.go | 10 +- internal/v2/eventstore/postgres/query_test.go | 2 +- internal/v2/eventstore/push.go | 20 +- internal/v2/eventstore/query.go | 2 +- internal/v2/instance/aggregate.go | 8 + internal/v2/instance/domain_policy.go | 65 +++ internal/v2/instance/removed.go | 27 ++ internal/v2/org/added.go | 62 +++ internal/v2/org/aggregate.go | 22 + internal/v2/org/changed.go | 37 ++ internal/v2/org/deactivated.go | 27 ++ internal/v2/org/domain.go | 123 +++++ internal/v2/org/domain_policy.go | 94 ++++ internal/v2/org/reactivated.go | 27 ++ internal/v2/org/removed.go | 27 ++ internal/v2/org/state.go | 36 ++ internal/v2/policy/domain.go | 23 + internal/v2/user/aggregate.go | 23 + internal/v2/user/domain_claimed.go | 38 ++ internal/v2/user/human_added.go | 57 +++ internal/v2/user/human_avatar.go | 61 +++ internal/v2/user/human_email_changed.go | 38 ++ internal/v2/user/human_email_verified.go | 27 ++ internal/v2/user/human_init_code_added.go | 43 ++ internal/v2/user/human_init_code_succeeded.go | 27 ++ internal/v2/user/human_password_changed.go | 44 ++ internal/v2/user/human_phone_changed.go | 38 ++ internal/v2/user/human_phone_removed.go | 27 ++ internal/v2/user/human_phone_verified.go | 27 ++ internal/v2/user/human_profile_changed.go | 45 ++ internal/v2/user/human_registered.go | 55 +++ internal/v2/user/machine_added.go | 41 ++ internal/v2/user/machine_changed.go | 40 ++ .../v2/user/machine_secret_hash_updated.go | 37 ++ internal/v2/user/machine_secret_removed.go | 27 ++ internal/v2/user/machine_secret_set.go | 41 ++ internal/v2/user/token_added.go | 51 ++ internal/v2/user/user_deactivated.go | 27 ++ internal/v2/user/user_locked.go | 27 ++ internal/v2/user/user_reactivated.go | 27 ++ internal/v2/user/user_removed.go | 27 ++ internal/v2/user/user_unlocked.go | 27 ++ internal/v2/user/username_changed.go | 37 ++ 56 files changed, 1952 insertions(+), 316 deletions(-) create mode 100644 internal/v2/avatar/added.go create mode 100644 internal/v2/avatar/removed.go create mode 100644 internal/v2/domain/added.go create mode 100644 internal/v2/domain/primary_set.go create mode 100644 internal/v2/domain/removed.go create mode 100644 internal/v2/domain/verfied.go create mode 100644 internal/v2/instance/aggregate.go create mode 100644 internal/v2/instance/domain_policy.go create mode 100644 internal/v2/instance/removed.go create mode 100644 internal/v2/org/added.go create mode 100644 internal/v2/org/aggregate.go create mode 100644 internal/v2/org/changed.go create mode 100644 internal/v2/org/deactivated.go create mode 100644 internal/v2/org/domain.go create mode 100644 internal/v2/org/domain_policy.go create mode 100644 internal/v2/org/reactivated.go create mode 100644 internal/v2/org/removed.go create mode 100644 internal/v2/org/state.go create mode 100644 internal/v2/policy/domain.go create mode 100644 internal/v2/user/aggregate.go create mode 100644 internal/v2/user/domain_claimed.go create mode 100644 internal/v2/user/human_added.go create mode 100644 internal/v2/user/human_avatar.go create mode 100644 internal/v2/user/human_email_changed.go create mode 100644 internal/v2/user/human_email_verified.go create mode 100644 internal/v2/user/human_init_code_added.go create mode 100644 internal/v2/user/human_init_code_succeeded.go create mode 100644 internal/v2/user/human_password_changed.go create mode 100644 internal/v2/user/human_phone_changed.go create mode 100644 internal/v2/user/human_phone_removed.go create mode 100644 internal/v2/user/human_phone_verified.go create mode 100644 internal/v2/user/human_profile_changed.go create mode 100644 internal/v2/user/human_registered.go create mode 100644 internal/v2/user/machine_added.go create mode 100644 internal/v2/user/machine_changed.go create mode 100644 internal/v2/user/machine_secret_hash_updated.go create mode 100644 internal/v2/user/machine_secret_removed.go create mode 100644 internal/v2/user/machine_secret_set.go create mode 100644 internal/v2/user/token_added.go create mode 100644 internal/v2/user/user_deactivated.go create mode 100644 internal/v2/user/user_locked.go create mode 100644 internal/v2/user/user_reactivated.go create mode 100644 internal/v2/user/user_removed.go create mode 100644 internal/v2/user/user_unlocked.go create mode 100644 internal/v2/user/username_changed.go diff --git a/internal/v2/avatar/added.go b/internal/v2/avatar/added.go new file mode 100644 index 0000000000..5a083a10e3 --- /dev/null +++ b/internal/v2/avatar/added.go @@ -0,0 +1,7 @@ +package avatar + +const AvatarAddedTypeSuffix = ".avatar.added" + +type AddedPayload struct { + StoreKey string `json:"storeKey"` +} diff --git a/internal/v2/avatar/removed.go b/internal/v2/avatar/removed.go new file mode 100644 index 0000000000..44cd5b63db --- /dev/null +++ b/internal/v2/avatar/removed.go @@ -0,0 +1,7 @@ +package avatar + +const AvatarRemovedTypeSuffix = ".avatar.removed" + +type RemovedPayload struct { + StoreKey string `json:"storeKey"` +} diff --git a/internal/v2/database/mock/sql_mock.go b/internal/v2/database/mock/sql_mock.go index c693671d6f..6fe282d1c4 100644 --- a/internal/v2/database/mock/sql_mock.go +++ b/internal/v2/database/mock/sql_mock.go @@ -137,3 +137,11 @@ type AnyType[T interface{}] struct{} func (a AnyType[T]) Match(v driver.Value) bool { return reflect.TypeOf(new(T)).Elem().Kind().String() == reflect.TypeOf(v).Kind().String() } + +var NilArg nilArgument + +type nilArgument struct{} + +func (a nilArgument) Match(v driver.Value) bool { + return reflect.ValueOf(v).IsNil() +} diff --git a/internal/v2/domain/added.go b/internal/v2/domain/added.go new file mode 100644 index 0000000000..4d6f873869 --- /dev/null +++ b/internal/v2/domain/added.go @@ -0,0 +1,7 @@ +package domain + +const AddedTypeSuffix = "domain.added" + +type AddedPayload struct { + Name string `json:"domain"` +} diff --git a/internal/v2/domain/primary_set.go b/internal/v2/domain/primary_set.go new file mode 100644 index 0000000000..4155656b35 --- /dev/null +++ b/internal/v2/domain/primary_set.go @@ -0,0 +1,7 @@ +package domain + +const PrimarySetTypeSuffix = "domain.primary.set" + +type PrimarySetPayload struct { + Name string `json:"domain"` +} diff --git a/internal/v2/domain/removed.go b/internal/v2/domain/removed.go new file mode 100644 index 0000000000..8041abb6df --- /dev/null +++ b/internal/v2/domain/removed.go @@ -0,0 +1,7 @@ +package domain + +const RemovedTypeSuffix = "domain.removed" + +type RemovedPayload struct { + Name string `json:"domain"` +} diff --git a/internal/v2/domain/verfied.go b/internal/v2/domain/verfied.go new file mode 100644 index 0000000000..835274bf9a --- /dev/null +++ b/internal/v2/domain/verfied.go @@ -0,0 +1,7 @@ +package domain + +const VerifiedTypeSuffix = "domain.verified" + +type VerifiedPayload struct { + Name string `json:"domain"` +} diff --git a/internal/v2/eventstore/event.go b/internal/v2/eventstore/event.go index b452093305..2117177587 100644 --- a/internal/v2/eventstore/event.go +++ b/internal/v2/eventstore/event.go @@ -1,36 +1,66 @@ package eventstore -import "time" +import ( + "time" +) + +type Unmarshal func(ptr any) error + +type Payload interface { + Unmarshal | any +} + +type Action[P Payload] struct { + Creator string + Type string + Revision uint16 + Payload P +} + +type Command struct { + Action[any] + UniqueConstraints []*UniqueConstraint +} + +type StorageEvent struct { + Action[Unmarshal] -type Event[P any] struct { Aggregate Aggregate CreatedAt time.Time - Creator string Position GlobalPosition - Revision uint16 Sequence uint32 - Type string - Payload P } -type StoragePayload interface { - Unmarshal(ptr any) error +type Event[P any] struct { + *StorageEvent + Payload P } -func EventFromStorage[E Event[P], P any](event *Event[StoragePayload]) (*E, error) { +func UnmarshalPayload[P any](unmarshal Unmarshal) (P, error) { var payload P - - if err := event.Payload.Unmarshal(&payload); err != nil { - return nil, err - } - return &E{ - Aggregate: event.Aggregate, - CreatedAt: event.CreatedAt, - Creator: event.Creator, - Position: event.Position, - Revision: event.Revision, - Sequence: event.Sequence, - Type: event.Type, - Payload: payload, - }, nil + err := unmarshal(&payload) + return payload, err +} + +type EmptyPayload struct{} + +type TypeChecker interface { + ActionType() string +} + +func Type[T TypeChecker]() string { + var t T + return t.ActionType() +} + +func IsType[T TypeChecker](types ...string) bool { + gotten := Type[T]() + + for _, typ := range types { + if gotten == typ { + return true + } + } + + return false } diff --git a/internal/v2/eventstore/event_store.go b/internal/v2/eventstore/event_store.go index fe70bb36a3..cc447c5e15 100644 --- a/internal/v2/eventstore/event_store.go +++ b/internal/v2/eventstore/event_store.go @@ -34,8 +34,12 @@ type GlobalPosition struct { InPositionOrder uint32 } -type Reducer interface { - Reduce(events ...*Event[StoragePayload]) error +func (gp GlobalPosition) IsLess(other GlobalPosition) bool { + return gp.Position < other.Position || (gp.Position == other.Position && gp.InPositionOrder < other.InPositionOrder) } -type Reduce func(events ...*Event[StoragePayload]) error +type Reducer interface { + Reduce(events ...*StorageEvent) error +} + +type Reduce func(events ...*StorageEvent) error diff --git a/internal/v2/eventstore/postgres/event.go b/internal/v2/eventstore/postgres/event.go index 9970dd14ea..18d86c5751 100644 --- a/internal/v2/eventstore/postgres/event.go +++ b/internal/v2/eventstore/postgres/event.go @@ -2,8 +2,8 @@ package postgres import ( "encoding/json" - - "github.com/zitadel/logging" + "reflect" + "time" "github.com/zitadel/zitadel/internal/v2/eventstore" "github.com/zitadel/zitadel/internal/zerrors" @@ -13,52 +13,52 @@ func intentToCommands(intent *intent) (commands []*command, err error) { commands = make([]*command, len(intent.Commands())) for i, cmd := range intent.Commands() { - var payload unmarshalPayload - if cmd.Payload() != nil { - payload, err = json.Marshal(cmd.Payload()) - if err != nil { - logging.WithError(err).Warn("marshal payload failed") - return nil, zerrors.ThrowInternal(err, "POSTG-MInPK", "Errors.Internal") - } + payload, err := marshalPayload(cmd.Payload) + if err != nil { + return nil, zerrors.ThrowInternal(err, "POSTG-MInPK", "Errors.Internal") } - commands[i] = &command{ - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *intent.Aggregate(), - Creator: cmd.Creator(), - Revision: cmd.Revision(), - Type: cmd.Type(), - // always add at least 1 to the currently stored sequence - Sequence: intent.sequence + uint32(i) + 1, - Payload: payload, - }, - intent: intent, - uniqueConstraints: cmd.UniqueConstraints(), + Command: cmd, + intent: intent, + sequence: intent.nextSequence(), + payload: payload, } } return commands, nil } +func marshalPayload(payload any) ([]byte, error) { + if reflect.ValueOf(payload).IsZero() { + return nil, nil + } + return json.Marshal(payload) +} + type command struct { - *eventstore.Event[eventstore.StoragePayload] + eventstore.Command - intent *intent - uniqueConstraints []*eventstore.UniqueConstraint + intent *intent + + payload []byte + position eventstore.GlobalPosition + createdAt time.Time + sequence uint32 } -var _ eventstore.StoragePayload = (unmarshalPayload)(nil) - -type unmarshalPayload []byte - -// Unmarshal implements eventstore.StoragePayload. -func (p unmarshalPayload) Unmarshal(ptr any) error { - if len(p) == 0 { - return nil +func (cmd *command) toEvent() *eventstore.StorageEvent { + return &eventstore.StorageEvent{ + Action: eventstore.Action[eventstore.Unmarshal]{ + Creator: cmd.Creator, + Type: cmd.Type, + Revision: cmd.Revision, + Payload: func(ptr any) error { + return json.Unmarshal(cmd.payload, ptr) + }, + }, + Aggregate: *cmd.intent.Aggregate(), + Sequence: cmd.intent.sequence, + Position: cmd.position, + CreatedAt: cmd.createdAt, } - if err := json.Unmarshal(p, ptr); err != nil { - return zerrors.ThrowInternal(err, "POSTG-u8qVo", "Errors.Internal") - } - - return nil } diff --git a/internal/v2/eventstore/postgres/intent.go b/internal/v2/eventstore/postgres/intent.go index 9ab259ada8..34b7860e35 100644 --- a/internal/v2/eventstore/postgres/intent.go +++ b/internal/v2/eventstore/postgres/intent.go @@ -12,6 +12,11 @@ type intent struct { sequence uint32 } +func (i *intent) nextSequence() uint32 { + i.sequence++ + return i.sequence +} + func makeIntents(pushIntent *eventstore.PushIntent) []*intent { res := make([]*intent, len(pushIntent.Aggregates())) diff --git a/internal/v2/eventstore/postgres/push.go b/internal/v2/eventstore/postgres/push.go index 7ae64fd41d..269d22cdef 100644 --- a/internal/v2/eventstore/postgres/push.go +++ b/internal/v2/eventstore/postgres/push.go @@ -140,19 +140,19 @@ func push(ctx context.Context, tx *sql.Tx, reducer eventstore.Reducer, commands stmt.WriteString(", ") } - cmd.Position.InPositionOrder = uint32(i) + cmd.position.InPositionOrder = uint32(i) stmt.WriteString(`(`) stmt.WriteArgs( - cmd.Aggregate.Instance, - cmd.Aggregate.Owner, - cmd.Aggregate.Type, - cmd.Aggregate.ID, + cmd.intent.Aggregate().Instance, + cmd.intent.Aggregate().Owner, + cmd.intent.Aggregate().Type, + cmd.intent.Aggregate().ID, cmd.Revision, cmd.Creator, cmd.Type, - cmd.Payload, - cmd.Sequence, - i, + cmd.payload, + cmd.sequence, + cmd.position.InPositionOrder, ) stmt.WriteString(", statement_timestamp(), EXTRACT(EPOCH FROM clock_timestamp())") stmt.WriteString(`)`) @@ -171,13 +171,13 @@ func push(ctx context.Context, tx *sql.Tx, reducer eventstore.Reducer, commands defer func() { i++ }() err := scan( - &commands[i].CreatedAt, - &commands[i].Position.Position, + &commands[i].createdAt, + &commands[i].position.Position, ) if err != nil { return err } - return reducer.Reduce(commands[i].Event) + return reducer.Reduce(commands[i].toEvent()) }) } @@ -188,12 +188,13 @@ func uniqueConstraints(ctx context.Context, tx *sql.Tx, commands []*command) (er var stmt database.Statement for _, cmd := range commands { - if len(cmd.uniqueConstraints) == 0 { + if len(cmd.UniqueConstraints) == 0 { continue } - for _, constraint := range cmd.uniqueConstraints { + for _, constraint := range cmd.UniqueConstraints { stmt.Reset() - instance := cmd.Aggregate.Instance + + instance := cmd.intent.PushAggregate.Aggregate().Instance if constraint.IsGlobal { instance = "" } diff --git a/internal/v2/eventstore/postgres/push_test.go b/internal/v2/eventstore/postgres/push_test.go index 819add334f..b81b3a1517 100644 --- a/internal/v2/eventstore/postgres/push_test.go +++ b/internal/v2/eventstore/postgres/push_test.go @@ -47,13 +47,16 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewAddEventUniqueConstraint("test", "id", "error"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewAddEventUniqueConstraint("test", "id", "error"), + }, }, }, }, @@ -72,13 +75,16 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewAddGlobalUniqueConstraint("test", "id", "error"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewAddGlobalUniqueConstraint("test", "id", "error"), + }, }, }, }, @@ -97,14 +103,17 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewAddEventUniqueConstraint("test", "id", "error"), - eventstore.NewAddEventUniqueConstraint("test", "id2", "error"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewAddEventUniqueConstraint("test", "id", "error"), + eventstore.NewAddEventUniqueConstraint("test", "id2", "error"), + }, }, }, }, @@ -128,23 +137,29 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewAddEventUniqueConstraint("test", "id", "error"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewAddEventUniqueConstraint("test", "id", "error"), + }, }, }, { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewAddEventUniqueConstraint("test", "id2", "error"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewAddEventUniqueConstraint("test", "id2", "error"), + }, }, }, }, @@ -168,13 +183,16 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewRemoveInstanceUniqueConstraints(), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewRemoveInstanceUniqueConstraints(), + }, }, }, }, @@ -193,23 +211,29 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewRemoveInstanceUniqueConstraints(), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewRemoveInstanceUniqueConstraints(), + }, }, }, { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewRemoveInstanceUniqueConstraints(), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewRemoveInstanceUniqueConstraints(), + }, }, }, }, @@ -233,13 +257,16 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewRemoveUniqueConstraint("test", "id"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewRemoveUniqueConstraint("test", "id"), + }, }, }, }, @@ -258,13 +285,16 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewRemoveGlobalUniqueConstraint("test", "id"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewRemoveGlobalUniqueConstraint("test", "id"), + }, }, }, }, @@ -283,14 +313,17 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewRemoveUniqueConstraint("test", "id"), - eventstore.NewRemoveUniqueConstraint("test", "id2"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewRemoveUniqueConstraint("test", "id"), + eventstore.NewRemoveUniqueConstraint("test", "id2"), + }, }, }, }, @@ -314,23 +347,29 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewRemoveUniqueConstraint("test", "id"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewRemoveUniqueConstraint("test", "id"), + }, }, }, { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewRemoveUniqueConstraint("test", "id2"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewRemoveUniqueConstraint("test", "id2"), + }, }, }, }, @@ -354,13 +393,16 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewAddEventUniqueConstraint("test", "id", ""), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewAddEventUniqueConstraint("test", "id", ""), + }, }, }, }, @@ -385,13 +427,16 @@ func Test_uniqueConstraints(t *testing.T) { args: args{ commands: []*command{ { - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - Instance: "instance", - }, + intent: &intent{ + PushAggregate: eventstore.NewPushIntent( + "instance", + eventstore.AppendAggregate("", "", ""), + ).Aggregates()[0], }, - uniqueConstraints: []*eventstore.UniqueConstraint{ - eventstore.NewAddEventUniqueConstraint("test", "id", "My.Error"), + Command: eventstore.Command{ + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewAddEventUniqueConstraint("test", "id", "My.Error"), + }, }, }, }, @@ -741,16 +786,14 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type", - Sequence: 1, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type", + }, }, + sequence: 1, }, }, expectations: []mock.Expectation{ @@ -764,9 +807,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type", - nil, + mock.NilArg, uint32(1), - 0, + uint32(0), ), mock.WithQueryResult( []string{"created_at", "position"}, @@ -798,16 +841,14 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type", - Sequence: 1, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type", + }, }, + sequence: 1, }, { intent: &intent{ @@ -816,16 +857,14 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type2", - Sequence: 2, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type2", + }, }, + sequence: 2, }, }, expectations: []mock.Expectation{ @@ -839,9 +878,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type", - nil, + mock.NilArg, uint32(1), - 0, + uint32(0), "instance", "owner", "testType", @@ -849,9 +888,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type2", - nil, + mock.NilArg, uint32(2), - 1, + uint32(1), ), mock.WithQueryResult( []string{"created_at", "position"}, @@ -887,36 +926,30 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type", - Sequence: 1, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type", + }, }, + sequence: 1, }, { intent: &intent{ PushAggregate: eventstore.NewPushIntent( "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), + eventstore.AppendAggregate("owner", "type2", "id2"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: eventstore.Aggregate{ - ID: "id2", - Type: "type2", - Instance: "instance", - Owner: "owner", + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type2", }, - Creator: "gigi", - Revision: 1, - Type: "test.type2", - Sequence: 10, }, + sequence: 10, }, }, expectations: []mock.Expectation{ @@ -930,9 +963,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type", - nil, + mock.NilArg, uint32(1), - 0, + uint32(0), "instance", "owner", "type2", @@ -940,9 +973,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type2", - nil, + mock.NilArg, uint32(10), - 1, + uint32(1), ), mock.WithQueryResult( []string{"created_at", "position"}, @@ -978,17 +1011,15 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type", - Sequence: 1, - Payload: unmarshalPayload(`{"name": "gigi"}`), + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type", + }, }, + sequence: 1, + payload: []byte(`{"name": "gigi"}`), }, }, expectations: []mock.Expectation{ @@ -1002,9 +1033,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type", - unmarshalPayload(`{"name": "gigi"}`), + []byte(`{"name": "gigi"}`), uint32(1), - 0, + uint32(0), ), mock.WithQueryResult( []string{"created_at", "position"}, @@ -1036,16 +1067,14 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type", - Sequence: 1, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type", + }, }, + sequence: 1, }, }, expectations: []mock.Expectation{ @@ -1059,9 +1088,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type", - nil, + mock.NilArg, uint32(1), - 0, + uint32(0), ), mock.WithQueryResult( []string{"created_at", "position"}, @@ -1094,16 +1123,14 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type", - Sequence: 1, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type", + }, }, + sequence: 1, }, { intent: &intent{ @@ -1112,16 +1139,14 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type2", - Sequence: 2, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type2", + }, }, + sequence: 2, }, }, expectations: []mock.Expectation{ @@ -1135,9 +1160,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type", - nil, + mock.NilArg, uint32(1), - 0, + uint32(0), "instance", "owner", "testType", @@ -1145,9 +1170,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type2", - nil, + mock.NilArg, uint32(2), - 1, + uint32(1), ), mock.WithQueryResult( []string{"created_at", "position"}, @@ -1189,16 +1214,14 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type", - Sequence: 1, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type", + }, }, + sequence: 1, }, { intent: &intent{ @@ -1207,16 +1230,14 @@ func Test_push(t *testing.T) { eventstore.AppendAggregate("owner", "testType", "testID"), ).Aggregates()[0], }, - Event: &eventstore.Event[eventstore.StoragePayload]{ - Aggregate: *eventstore.NewPushIntent( - "instance", - eventstore.AppendAggregate("owner", "testType", "testID"), - ).Aggregates()[0].Aggregate(), - Creator: "gigi", - Revision: 1, - Type: "test.type2", - Sequence: 2, + Command: eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: "gigi", + Revision: 1, + Type: "test.type2", + }, }, + sequence: 2, }, }, expectations: []mock.Expectation{ @@ -1230,9 +1251,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type", - nil, + mock.NilArg, uint32(1), - 0, + uint32(0), "instance", "owner", "testType", @@ -1240,9 +1261,9 @@ func Test_push(t *testing.T) { uint16(1), "gigi", "test.type2", - nil, + mock.NilArg, uint32(2), - 1, + uint32(1), ), mock.WithQueryResult( []string{"created_at", "position"}, diff --git a/internal/v2/eventstore/postgres/query.go b/internal/v2/eventstore/postgres/query.go index 608b31e533..ca7a081c75 100644 --- a/internal/v2/eventstore/postgres/query.go +++ b/internal/v2/eventstore/postgres/query.go @@ -3,6 +3,7 @@ package postgres import ( "context" "database/sql" + "encoding/json" "slices" "github.com/zitadel/logging" @@ -38,7 +39,7 @@ func executeQuery(ctx context.Context, tx database.Querier, stmt *database.State } err = database.MapRowsToObject(rows, func(scan func(dest ...any) error) error { - e := new(eventstore.Event[eventstore.StoragePayload]) + e := new(eventstore.StorageEvent) var payload sql.Null[[]byte] @@ -59,7 +60,12 @@ func executeQuery(ctx context.Context, tx database.Querier, stmt *database.State if err != nil { return err } - e.Payload = unmarshalPayload(payload.V) + e.Payload = func(ptr any) error { + if len(payload.V) == 0 { + return nil + } + return json.Unmarshal(payload.V, ptr) + } eventCount++ return reducer.Reduce(e) diff --git a/internal/v2/eventstore/postgres/query_test.go b/internal/v2/eventstore/postgres/query_test.go index c6e2c6f8a3..f73d7341f2 100644 --- a/internal/v2/eventstore/postgres/query_test.go +++ b/internal/v2/eventstore/postgres/query_test.go @@ -1143,7 +1143,7 @@ type testReducer struct { } // Reduce implements eventstore.Reducer. -func (r *testReducer) Reduce(events ...*eventstore.Event[eventstore.StoragePayload]) error { +func (r *testReducer) Reduce(events ...*eventstore.StorageEvent) error { if r == nil { return nil } diff --git a/internal/v2/eventstore/push.go b/internal/v2/eventstore/push.go index 6260315b82..b426078b8e 100644 --- a/internal/v2/eventstore/push.go +++ b/internal/v2/eventstore/push.go @@ -36,7 +36,7 @@ func (pi *PushIntent) Instance() string { return pi.instance } -func (pi *PushIntent) Reduce(events ...*Event[StoragePayload]) error { +func (pi *PushIntent) Reduce(events ...*StorageEvent) error { if pi.reducer == nil { return nil } @@ -170,21 +170,3 @@ func AppendCommands(commands ...Command) PushAggregateOpt { pa.commands = append(pa.commands, commands...) } } - -type Command interface { - // Creator is the id of the user which created the action - Creator() string - // Type describes the action it's in the past (e.g. user.created) - Type() string - // Revision of the action - Revision() uint16 - // Payload returns the payload of the event. It represent the changed fields by the event - // valid types are: - // * nil: no payload - // * struct: which can be marshalled to json - // * pointer to struct: which can be marshalled to json - // * []byte: json marshalled data - Payload() any - // UniqueConstraints should be added for unique attributes of an event, if nil constraints will not be checked - UniqueConstraints() []*UniqueConstraint -} diff --git a/internal/v2/eventstore/query.go b/internal/v2/eventstore/query.go index 0dd23ea898..eddb1aedde 100644 --- a/internal/v2/eventstore/query.go +++ b/internal/v2/eventstore/query.go @@ -41,7 +41,7 @@ func (q *Query) Pagination() *Pagination { return q.pagination } -func (q *Query) Reduce(events ...*Event[StoragePayload]) error { +func (q *Query) Reduce(events ...*StorageEvent) error { return q.reducer.Reduce(events...) } diff --git a/internal/v2/instance/aggregate.go b/internal/v2/instance/aggregate.go new file mode 100644 index 0000000000..aa4182b244 --- /dev/null +++ b/internal/v2/instance/aggregate.go @@ -0,0 +1,8 @@ +package instance + +import "github.com/zitadel/zitadel/internal/repository/instance" + +const ( + AggregateType = string(instance.AggregateType) + eventTypePrefix = AggregateType + "." +) diff --git a/internal/v2/instance/domain_policy.go b/internal/v2/instance/domain_policy.go new file mode 100644 index 0000000000..8746328ee1 --- /dev/null +++ b/internal/v2/instance/domain_policy.go @@ -0,0 +1,65 @@ +package instance + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/v2/policy" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const DomainPolicyAddedType = eventTypePrefix + policy.DomainPolicyAddedTypeSuffix + +type DomainPolicyAddedPayload policy.DomainPolicyAddedPayload + +type DomainPolicyAddedEvent eventstore.Event[DomainPolicyAddedPayload] + +var _ eventstore.TypeChecker = (*DomainPolicyAddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainPolicyAddedEvent) ActionType() string { + return DomainPolicyAddedType +} + +func DomainPolicyAddedEventFromStorage(event *eventstore.StorageEvent) (e *DomainPolicyAddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "INSTA-z1a7D", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainPolicyAddedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainPolicyAddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} + +const DomainPolicyChangedType = eventTypePrefix + policy.DomainPolicyChangedTypeSuffix + +type DomainPolicyChangedPayload policy.DomainPolicyChangedPayload + +type DomainPolicyChangedEvent eventstore.Event[DomainPolicyChangedPayload] + +var _ eventstore.TypeChecker = (*DomainPolicyChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainPolicyChangedEvent) ActionType() string { + return DomainPolicyChangedType +} + +func DomainPolicyChangedEventFromStorage(event *eventstore.StorageEvent) (e *DomainPolicyChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "INSTA-BTLhd", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainPolicyChangedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainPolicyChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/instance/removed.go b/internal/v2/instance/removed.go new file mode 100644 index 0000000000..fe2e814893 --- /dev/null +++ b/internal/v2/instance/removed.go @@ -0,0 +1,27 @@ +package instance + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const RemovedType = eventTypePrefix + "removed" + +type RemovedEvent eventstore.Event[eventstore.EmptyPayload] + +var _ eventstore.TypeChecker = (*RemovedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *RemovedEvent) ActionType() string { + return RemovedType +} + +func RemovedEventFromStorage(event *eventstore.StorageEvent) (e *RemovedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "INSTA-xppIg", "Errors.Invalid.Event.Type") + } + + return &RemovedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/org/added.go b/internal/v2/org/added.go new file mode 100644 index 0000000000..3d8cb62078 --- /dev/null +++ b/internal/v2/org/added.go @@ -0,0 +1,62 @@ +package org + +import ( + "context" + "strings" + + "github.com/zitadel/zitadel/internal/api/authz" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const AddedType = eventTypePrefix + "added" + +type addedPayload struct { + Name string `json:"name"` +} + +type AddedEvent eventstore.Event[addedPayload] + +var _ eventstore.TypeChecker = (*AddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *AddedEvent) ActionType() string { + return AddedType +} + +func AddedEventFromStorage(event *eventstore.StorageEvent) (e *AddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-Nf3tr", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[addedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &AddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} + +const uniqueOrgName = "org_name" + +func NewAddedCommand(ctx context.Context, name string) (*eventstore.Command, error) { + if name = strings.TrimSpace(name); name == "" { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-mruNY", "Errors.Invalid.Argument") + } + return &eventstore.Command{ + Action: eventstore.Action[any]{ + Creator: authz.GetCtxData(ctx).UserID, + Type: AddedType, + Revision: 1, + Payload: addedPayload{ + Name: name, + }, + }, + UniqueConstraints: []*eventstore.UniqueConstraint{ + eventstore.NewAddEventUniqueConstraint(uniqueOrgName, name, "Errors.Org.AlreadyExists"), + }, + }, nil +} diff --git a/internal/v2/org/aggregate.go b/internal/v2/org/aggregate.go new file mode 100644 index 0000000000..5ea881b755 --- /dev/null +++ b/internal/v2/org/aggregate.go @@ -0,0 +1,22 @@ +package org + +import ( + "context" + + "github.com/zitadel/zitadel/internal/api/authz" + "github.com/zitadel/zitadel/internal/v2/eventstore" +) + +const ( + AggregateType = "org" + eventTypePrefix = AggregateType + "." +) + +func NewAggregate(ctx context.Context, id string) *eventstore.Aggregate { + return &eventstore.Aggregate{ + ID: id, + Type: AggregateType, + Instance: authz.GetInstance(ctx).InstanceID(), + Owner: authz.GetCtxData(ctx).OrgID, + } +} diff --git a/internal/v2/org/changed.go b/internal/v2/org/changed.go new file mode 100644 index 0000000000..eb85fba9b0 --- /dev/null +++ b/internal/v2/org/changed.go @@ -0,0 +1,37 @@ +package org + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const ChangedType = eventTypePrefix + "changed" + +type changedPayload struct { + Name string `json:"name"` +} + +type ChangedEvent eventstore.Event[changedPayload] + +var _ eventstore.TypeChecker = (*ChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *ChangedEvent) ActionType() string { + return ChangedType +} + +func ChangedEventFromStorage(event *eventstore.StorageEvent) (e *ChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-pzOfP", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[changedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &ChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/org/deactivated.go b/internal/v2/org/deactivated.go new file mode 100644 index 0000000000..454b8586fa --- /dev/null +++ b/internal/v2/org/deactivated.go @@ -0,0 +1,27 @@ +package org + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const DeactivatedType = eventTypePrefix + "deactivated" + +type DeactivatedEvent eventstore.Event[eventstore.EmptyPayload] + +var _ eventstore.TypeChecker = (*DeactivatedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DeactivatedEvent) ActionType() string { + return DeactivatedType +} + +func DeactivatedEventFromStorage(event *eventstore.StorageEvent) (e *DeactivatedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-4zeWH", "Errors.Invalid.Event.Type") + } + + return &DeactivatedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/org/domain.go b/internal/v2/org/domain.go new file mode 100644 index 0000000000..b978997b49 --- /dev/null +++ b/internal/v2/org/domain.go @@ -0,0 +1,123 @@ +package org + +import ( + "github.com/zitadel/zitadel/internal/v2/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const DomainAddedType = "org." + domain.AddedTypeSuffix + +type DomainAddedPayload domain.AddedPayload + +type DomainAddedEvent eventstore.Event[DomainAddedPayload] + +var _ eventstore.TypeChecker = (*DomainAddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainAddedEvent) ActionType() string { + return DomainAddedType +} + +func DomainAddedEventFromStorage(event *eventstore.StorageEvent) (e *DomainAddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-CXVe3", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainAddedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainAddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} + +const DomainVerifiedType = "org." + domain.VerifiedTypeSuffix + +type DomainVerifiedPayload domain.VerifiedPayload + +type DomainVerifiedEvent eventstore.Event[DomainVerifiedPayload] + +var _ eventstore.TypeChecker = (*DomainVerifiedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainVerifiedEvent) ActionType() string { + return DomainVerifiedType +} + +func DomainVerifiedEventFromStorage(event *eventstore.StorageEvent) (e *DomainVerifiedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-RAwdb", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainVerifiedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainVerifiedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} + +const DomainPrimarySetType = "org." + domain.PrimarySetTypeSuffix + +type DomainPrimarySetPayload domain.PrimarySetPayload + +type DomainPrimarySetEvent eventstore.Event[DomainPrimarySetPayload] + +var _ eventstore.TypeChecker = (*DomainPrimarySetEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainPrimarySetEvent) ActionType() string { + return DomainPrimarySetType +} + +func DomainPrimarySetEventFromStorage(event *eventstore.StorageEvent) (e *DomainPrimarySetEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-7P3Iz", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainPrimarySetPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainPrimarySetEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} + +const DomainRemovedType = "org." + domain.RemovedTypeSuffix + +type DomainRemovedPayload domain.RemovedPayload + +type DomainRemovedEvent eventstore.Event[DomainRemovedPayload] + +var _ eventstore.TypeChecker = (*DomainRemovedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainRemovedEvent) ActionType() string { + return DomainRemovedType +} + +func DomainRemovedEventFromStorage(event *eventstore.StorageEvent) (e *DomainRemovedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-ndpL2", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainRemovedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainRemovedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/org/domain_policy.go b/internal/v2/org/domain_policy.go new file mode 100644 index 0000000000..ad37be0327 --- /dev/null +++ b/internal/v2/org/domain_policy.go @@ -0,0 +1,94 @@ +package org + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/v2/policy" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const DomainPolicyAddedType = eventTypePrefix + policy.DomainPolicyAddedTypeSuffix + +type DomainPolicyAddedPayload policy.DomainPolicyAddedPayload + +type DomainPolicyAddedEvent eventstore.Event[DomainPolicyAddedPayload] + +var _ eventstore.TypeChecker = (*DomainPolicyAddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainPolicyAddedEvent) ActionType() string { + return DomainPolicyAddedType +} + +func DomainPolicyAddedEventFromStorage(event *eventstore.StorageEvent) (e *DomainPolicyAddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-asiSN", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainPolicyAddedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainPolicyAddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} + +const DomainPolicyChangedType = eventTypePrefix + policy.DomainPolicyChangedTypeSuffix + +type DomainPolicyChangedPayload policy.DomainPolicyChangedPayload + +type DomainPolicyChangedEvent eventstore.Event[DomainPolicyChangedPayload] + +var _ eventstore.TypeChecker = (*DomainPolicyChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainPolicyChangedEvent) ActionType() string { + return DomainPolicyChangedType +} + +func DomainPolicyChangedEventFromStorage(event *eventstore.StorageEvent) (e *DomainPolicyChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-BmN6K", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainPolicyChangedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainPolicyChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} + +const DomainPolicyRemovedType = eventTypePrefix + policy.DomainPolicyRemovedTypeSuffix + +type DomainPolicyRemovedPayload policy.DomainPolicyRemovedPayload + +type DomainPolicyRemovedEvent eventstore.Event[DomainPolicyRemovedPayload] + +var _ eventstore.TypeChecker = (*DomainPolicyRemovedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainPolicyRemovedEvent) ActionType() string { + return DomainPolicyRemovedType +} + +func DomainPolicyRemovedEventFromStorage(event *eventstore.StorageEvent) (e *DomainPolicyRemovedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-nHy4z", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[DomainPolicyRemovedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainPolicyRemovedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/org/reactivated.go b/internal/v2/org/reactivated.go new file mode 100644 index 0000000000..5b3da8fdd6 --- /dev/null +++ b/internal/v2/org/reactivated.go @@ -0,0 +1,27 @@ +package org + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const ReactivatedType = eventTypePrefix + "reactivated" + +type ReactivatedEvent eventstore.Event[eventstore.EmptyPayload] + +var _ eventstore.TypeChecker = (*ReactivatedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *ReactivatedEvent) ActionType() string { + return ReactivatedType +} + +func ReactivatedEventFromStorage(event *eventstore.StorageEvent) (e *ReactivatedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-cPWZw", "Errors.Invalid.Event.Type") + } + + return &ReactivatedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/org/removed.go b/internal/v2/org/removed.go new file mode 100644 index 0000000000..571c1c0113 --- /dev/null +++ b/internal/v2/org/removed.go @@ -0,0 +1,27 @@ +package org + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const RemovedType = eventTypePrefix + "removed" + +type RemovedEvent eventstore.Event[eventstore.EmptyPayload] + +var _ eventstore.TypeChecker = (*RemovedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *RemovedEvent) ActionType() string { + return RemovedType +} + +func RemovedEventFromStorage(event *eventstore.StorageEvent) (e *RemovedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "ORG-RSPYk", "Errors.Invalid.Event.Type") + } + + return &RemovedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/org/state.go b/internal/v2/org/state.go new file mode 100644 index 0000000000..428bdf82a5 --- /dev/null +++ b/internal/v2/org/state.go @@ -0,0 +1,36 @@ +package org + +type State uint8 + +const ( + UndefinedState State = iota + ActiveState + InactiveState + RemovedState + maxState +) + +func (s State) IsValid() bool { + return s != UndefinedState || + s < maxState +} + +func (s State) Is(state State) bool { + return s == state +} + +func (s State) IsValidState(state State) bool { + return s.IsValid() && s.Is(state) +} + +func (s State) IsValidStates(states ...State) bool { + if !s.IsValid() { + return false + } + for _, state := range states { + if s.Is(state) { + return true + } + } + return false +} diff --git a/internal/v2/policy/domain.go b/internal/v2/policy/domain.go new file mode 100644 index 0000000000..759caa254a --- /dev/null +++ b/internal/v2/policy/domain.go @@ -0,0 +1,23 @@ +package policy + +import "github.com/zitadel/zitadel/internal/v2/eventstore" + +const DomainPolicyAddedTypeSuffix = "policy.domain.added" + +type DomainPolicyAddedPayload struct { + UserLoginMustBeDomain bool `json:"userLoginMustBeDomain,omitempty"` + ValidateOrgDomains bool `json:"validateOrgDomains,omitempty"` + SMTPSenderAddressMatchesInstanceDomain bool `json:"smtpSenderAddressMatchesInstanceDomain,omitempty"` +} + +const DomainPolicyChangedTypeSuffix = "policy.domain.changed" + +type DomainPolicyChangedPayload struct { + UserLoginMustBeDomain *bool `json:"userLoginMustBeDomain,omitempty"` + ValidateOrgDomains *bool `json:"validateOrgDomains,omitempty"` + SMTPSenderAddressMatchesInstanceDomain *bool `json:"smtpSenderAddressMatchesInstanceDomain,omitempty"` +} + +const DomainPolicyRemovedTypeSuffix = "policy.domain.removed" + +type DomainPolicyRemovedPayload eventstore.EmptyPayload diff --git a/internal/v2/user/aggregate.go b/internal/v2/user/aggregate.go new file mode 100644 index 0000000000..291daa9af2 --- /dev/null +++ b/internal/v2/user/aggregate.go @@ -0,0 +1,23 @@ +package user + +import ( + "context" + + "github.com/zitadel/zitadel/internal/api/authz" + "github.com/zitadel/zitadel/internal/v2/eventstore" +) + +const ( + AggregateType = "user" + humanPrefix = AggregateType + ".human" + machinePrefix = AggregateType + ".machine" +) + +func NewAggregate(ctx context.Context, id string) *eventstore.Aggregate { + return &eventstore.Aggregate{ + ID: id, + Type: AggregateType, + Instance: authz.GetInstance(ctx).InstanceID(), + Owner: authz.GetCtxData(ctx).OrgID, + } +} diff --git a/internal/v2/user/domain_claimed.go b/internal/v2/user/domain_claimed.go new file mode 100644 index 0000000000..18960bb41f --- /dev/null +++ b/internal/v2/user/domain_claimed.go @@ -0,0 +1,38 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type domainClaimedPayload struct { + Username string `json:"userName"` + TriggeredAtOrigin string `json:"triggerOrigin,omitempty"` +} + +type DomainClaimedEvent eventstore.Event[domainClaimedPayload] + +const DomainClaimedType = AggregateType + ".domain.claimed.sent" + +var _ eventstore.TypeChecker = (*DomainClaimedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DomainClaimedEvent) ActionType() string { + return DomainClaimedType +} + +func DomainClaimedEventFromStorage(event *eventstore.StorageEvent) (e *DomainClaimedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-x8O4o", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[domainClaimedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &DomainClaimedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/human_added.go b/internal/v2/user/human_added.go new file mode 100644 index 0000000000..527e14f4db --- /dev/null +++ b/internal/v2/user/human_added.go @@ -0,0 +1,57 @@ +package user + +import ( + "golang.org/x/text/language" + + "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +const HumanAddedType = AggregateType + ".human.added" + +type humanAddedPayload struct { + Username string `json:"userName"` + + FirstName string `json:"firstName,omitempty"` + LastName string `json:"lastName,omitempty"` + NickName string `json:"nickName,omitempty"` + DisplayName string `json:"displayName,omitempty"` + PreferredLanguage language.Tag `json:"preferredLanguage,omitempty"` + Gender domain.Gender `json:"gender,omitempty"` + + EmailAddress domain.EmailAddress `json:"email,omitempty"` + PhoneNumber domain.PhoneNumber `json:"phone,omitempty"` + + // New events only use EncodedHash. However, the secret field + // is preserved to handle events older than the switch to Passwap. + Secret *crypto.CryptoValue `json:"secret,omitempty"` + EncodedHash string `json:"encodedHash,omitempty"` + PasswordChangeRequired bool `json:"changeRequired,omitempty"` +} + +type HumanAddedEvent eventstore.Event[humanAddedPayload] + +var _ eventstore.TypeChecker = (*HumanAddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanAddedEvent) ActionType() string { + return HumanAddedType +} + +func HumanAddedEventFromStorage(event *eventstore.StorageEvent) (e *HumanAddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-MRZ3p", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[humanAddedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanAddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/human_avatar.go b/internal/v2/user/human_avatar.go new file mode 100644 index 0000000000..9b684ce02b --- /dev/null +++ b/internal/v2/user/human_avatar.go @@ -0,0 +1,61 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/avatar" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type HumanAvatarAddedEvent eventstore.Event[avatar.AddedPayload] + +const HumanAvatarAddedType = humanPrefix + avatar.AvatarAddedTypeSuffix + +var _ eventstore.TypeChecker = (*HumanAvatarAddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanAvatarAddedEvent) ActionType() string { + return HumanAvatarAddedType +} + +func HumanAvatarAddedEventFromStorage(event *eventstore.StorageEvent) (e *HumanAvatarAddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-ddQaI", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[avatar.AddedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanAvatarAddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} + +type HumanAvatarRemovedEvent eventstore.Event[avatar.RemovedPayload] + +const HumanAvatarRemovedType = humanPrefix + avatar.AvatarRemovedTypeSuffix + +var _ eventstore.TypeChecker = (*HumanAvatarRemovedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanAvatarRemovedEvent) ActionType() string { + return HumanAvatarRemovedType +} + +func HumanAvatarRemovedEventFromStorage(event *eventstore.StorageEvent) (e *HumanAvatarRemovedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-j2CkY", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[avatar.RemovedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanAvatarRemovedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/human_email_changed.go b/internal/v2/user/human_email_changed.go new file mode 100644 index 0000000000..88a7903afb --- /dev/null +++ b/internal/v2/user/human_email_changed.go @@ -0,0 +1,38 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type humanEmailChangedPayload struct { + Address domain.EmailAddress `json:"email,omitempty"` +} + +type HumanEmailChangedEvent eventstore.Event[humanEmailChangedPayload] + +const HumanEmailChangedType = humanPrefix + ".email.changed" + +var _ eventstore.TypeChecker = (*HumanEmailChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanEmailChangedEvent) ActionType() string { + return HumanEmailChangedType +} + +func HumanEmailChangedEventFromStorage(event *eventstore.StorageEvent) (e *HumanEmailChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-Wr2lR", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[humanEmailChangedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanEmailChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/human_email_verified.go b/internal/v2/user/human_email_verified.go new file mode 100644 index 0000000000..65c4a9b391 --- /dev/null +++ b/internal/v2/user/human_email_verified.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type HumanEmailVerifiedEvent eventstore.Event[eventstore.EmptyPayload] + +const HumanEmailVerifiedType = humanPrefix + ".email.verified" + +var _ eventstore.TypeChecker = (*HumanEmailVerifiedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanEmailVerifiedEvent) ActionType() string { + return HumanEmailVerifiedType +} + +func HumanEmailVerifiedEventFromStorage(event *eventstore.StorageEvent) (e *HumanEmailVerifiedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-X3esB", "Errors.Invalid.Event.Type") + } + + return &HumanEmailVerifiedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/human_init_code_added.go b/internal/v2/user/human_init_code_added.go new file mode 100644 index 0000000000..37938e000a --- /dev/null +++ b/internal/v2/user/human_init_code_added.go @@ -0,0 +1,43 @@ +package user + +import ( + "time" + + "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type humanInitCodeAddedPayload struct { + Code *crypto.CryptoValue `json:"code,omitempty"` + Expiry time.Duration `json:"expiry,omitempty"` + TriggeredAtOrigin string `json:"triggerOrigin,omitempty"` + AuthRequestID string `json:"authRequestID,omitempty"` +} + +type HumanInitCodeAddedEvent eventstore.Event[humanInitCodeAddedPayload] + +const HumanInitCodeAddedType = humanPrefix + ".initialization.code.added" + +var _ eventstore.TypeChecker = (*HumanInitCodeAddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanInitCodeAddedEvent) ActionType() string { + return HumanInitCodeAddedType +} + +func HumanInitCodeAddedEventFromStorage(event *eventstore.StorageEvent) (e *HumanInitCodeAddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-XaGf6", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[humanInitCodeAddedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanInitCodeAddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/human_init_code_succeeded.go b/internal/v2/user/human_init_code_succeeded.go new file mode 100644 index 0000000000..33e3d9a347 --- /dev/null +++ b/internal/v2/user/human_init_code_succeeded.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type HumanInitCodeSucceededEvent eventstore.Event[eventstore.EmptyPayload] + +const HumanInitCodeSucceededType = humanPrefix + ".initialization.check.succeeded" + +var _ eventstore.TypeChecker = (*HumanInitCodeSucceededEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanInitCodeSucceededEvent) ActionType() string { + return HumanInitCodeSucceededType +} + +func HumanInitCodeSucceededEventFromStorage(event *eventstore.StorageEvent) (e *HumanInitCodeSucceededEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-12A5m", "Errors.Invalid.Event.Type") + } + + return &HumanInitCodeSucceededEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/human_password_changed.go b/internal/v2/user/human_password_changed.go new file mode 100644 index 0000000000..fcdc589b31 --- /dev/null +++ b/internal/v2/user/human_password_changed.go @@ -0,0 +1,44 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type humanPasswordChangedPayload struct { + // New events only use EncodedHash. However, the secret field + // is preserved to handle events older than the switch to Passwap. + Secret *crypto.CryptoValue `json:"secret,omitempty"` + EncodedHash string `json:"encodedHash,omitempty"` + ChangeRequired bool `json:"changeRequired"` + UserAgentID string `json:"userAgentID,omitempty"` + TriggeredAtOrigin string `json:"triggerOrigin,omitempty"` +} + +type HumanPasswordChangedEvent eventstore.Event[humanPasswordChangedPayload] + +const HumanPasswordChangedType = humanPrefix + ".password.changed" + +var _ eventstore.TypeChecker = (*HumanPasswordChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanPasswordChangedEvent) ActionType() string { + return HumanPasswordChangedType +} + +func HumanPasswordChangedEventFromStorage(event *eventstore.StorageEvent) (e *HumanPasswordChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-Fx5tr", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[humanPasswordChangedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanPasswordChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/human_phone_changed.go b/internal/v2/user/human_phone_changed.go new file mode 100644 index 0000000000..964259e3bd --- /dev/null +++ b/internal/v2/user/human_phone_changed.go @@ -0,0 +1,38 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type humanPhoneChangedPayload struct { + PhoneNumber domain.PhoneNumber `json:"phone,omitempty"` +} + +type HumanPhoneChangedEvent eventstore.Event[humanPhoneChangedPayload] + +const HumanPhoneChangedType = humanPrefix + ".phone.changed" + +var _ eventstore.TypeChecker = (*HumanPhoneChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanPhoneChangedEvent) ActionType() string { + return HumanPhoneChangedType +} + +func HumanPhoneChangedEventFromStorage(event *eventstore.StorageEvent) (e *HumanPhoneChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-d6hGS", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[humanPhoneChangedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanPhoneChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/human_phone_removed.go b/internal/v2/user/human_phone_removed.go new file mode 100644 index 0000000000..11d3dcbb0c --- /dev/null +++ b/internal/v2/user/human_phone_removed.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type HumanPhoneRemovedEvent eventstore.Event[eventstore.EmptyPayload] + +const HumanPhoneRemovedType = humanPrefix + ".phone.removed" + +var _ eventstore.TypeChecker = (*HumanPhoneRemovedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanPhoneRemovedEvent) ActionType() string { + return HumanPhoneRemovedType +} + +func HumanPhoneRemovedEventFromStorage(event *eventstore.StorageEvent) (e *HumanPhoneRemovedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-vaD75", "Errors.Invalid.Event.Type") + } + + return &HumanPhoneRemovedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/human_phone_verified.go b/internal/v2/user/human_phone_verified.go new file mode 100644 index 0000000000..bfe7888425 --- /dev/null +++ b/internal/v2/user/human_phone_verified.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type HumanPhoneVerifiedEvent eventstore.Event[eventstore.EmptyPayload] + +const HumanPhoneVerifiedType = humanPrefix + ".phone.removed" + +var _ eventstore.TypeChecker = (*HumanPhoneVerifiedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanPhoneVerifiedEvent) ActionType() string { + return HumanPhoneVerifiedType +} + +func HumanPhoneVerifiedEventFromStorage(event *eventstore.StorageEvent) (e *HumanPhoneVerifiedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-ycRBi", "Errors.Invalid.Event.Type") + } + + return &HumanPhoneVerifiedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/human_profile_changed.go b/internal/v2/user/human_profile_changed.go new file mode 100644 index 0000000000..8124d3b993 --- /dev/null +++ b/internal/v2/user/human_profile_changed.go @@ -0,0 +1,45 @@ +package user + +import ( + "golang.org/x/text/language" + + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type humanProfileChangedPayload struct { + FirstName string `json:"firstName,omitempty"` + LastName string `json:"lastName,omitempty"` + NickName *string `json:"nickName,omitempty"` + DisplayName *string `json:"displayName,omitempty"` + PreferredLanguage *language.Tag `json:"preferredLanguage,omitempty"` + Gender *domain.Gender `json:"gender,omitempty"` +} + +type HumanProfileChangedEvent eventstore.Event[humanProfileChangedPayload] + +const HumanProfileChangedType = humanPrefix + ".profile.changed" + +var _ eventstore.TypeChecker = (*HumanProfileChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanProfileChangedEvent) ActionType() string { + return HumanProfileChangedType +} + +func HumanProfileChangedEventFromStorage(event *eventstore.StorageEvent) (e *HumanProfileChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-Z1aFH", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[humanProfileChangedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanProfileChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/human_registered.go b/internal/v2/user/human_registered.go new file mode 100644 index 0000000000..c1908da377 --- /dev/null +++ b/internal/v2/user/human_registered.go @@ -0,0 +1,55 @@ +package user + +import ( + "golang.org/x/text/language" + + "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type humanRegisteredPayload struct { + Username string `json:"userName"` + FirstName string `json:"firstName,omitempty"` + LastName string `json:"lastName,omitempty"` + NickName string `json:"nickName,omitempty"` + DisplayName string `json:"displayName,omitempty"` + PreferredLanguage language.Tag `json:"preferredLanguage,omitempty"` + Gender domain.Gender `json:"gender,omitempty"` + EmailAddress domain.EmailAddress `json:"email,omitempty"` + PhoneNumber domain.PhoneNumber `json:"phone,omitempty"` + + // New events only use EncodedHash. However, the secret field + // is preserved to handle events older than the switch to Passwap. + Secret *crypto.CryptoValue `json:"secret,omitempty"` // legacy + EncodedHash string `json:"encodedHash,omitempty"` + PasswordChangeRequired bool `json:"changeRequired,omitempty"` +} + +type HumanRegisteredEvent eventstore.Event[humanRegisteredPayload] + +const HumanRegisteredType = humanPrefix + ".selfregistered" + +var _ eventstore.TypeChecker = (*HumanRegisteredEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *HumanRegisteredEvent) ActionType() string { + return HumanRegisteredType +} + +func HumanRegisteredEventFromStorage(event *eventstore.StorageEvent) (e *HumanRegisteredEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-8HvGi", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[humanRegisteredPayload](event.Payload) + if err != nil { + return nil, err + } + + return &HumanRegisteredEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/machine_added.go b/internal/v2/user/machine_added.go new file mode 100644 index 0000000000..57659db9a8 --- /dev/null +++ b/internal/v2/user/machine_added.go @@ -0,0 +1,41 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type machineAddedPayload struct { + Username string `json:"userName"` + Name string `json:"name,omitempty"` + Description string `json:"description,omitempty"` + AccessTokenType domain.OIDCTokenType `json:"accessTokenType,omitempty"` +} + +type MachineAddedEvent eventstore.Event[machineAddedPayload] + +const MachineAddedType = machinePrefix + ".added" + +var _ eventstore.TypeChecker = (*MachineAddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *MachineAddedEvent) ActionType() string { + return MachineAddedType +} + +func MachineAddedEventFromStorage(event *eventstore.StorageEvent) (e *MachineAddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-WLLoW", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[machineAddedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &MachineAddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/machine_changed.go b/internal/v2/user/machine_changed.go new file mode 100644 index 0000000000..bdd721b131 --- /dev/null +++ b/internal/v2/user/machine_changed.go @@ -0,0 +1,40 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type machineChangedPayload struct { + Name *string `json:"name,omitempty"` + Description *string `json:"description,omitempty"` + AccessTokenType *domain.OIDCTokenType `json:"accessTokenType,omitempty"` +} + +type MachineChangedEvent eventstore.Event[machineChangedPayload] + +const MachineChangedType = machinePrefix + ".changed" + +var _ eventstore.TypeChecker = (*MachineChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *MachineChangedEvent) ActionType() string { + return MachineChangedType +} + +func MachineChangedEventFromStorage(event *eventstore.StorageEvent) (e *MachineChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-JHwNs", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[machineChangedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &MachineChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/machine_secret_hash_updated.go b/internal/v2/user/machine_secret_hash_updated.go new file mode 100644 index 0000000000..87d60a4305 --- /dev/null +++ b/internal/v2/user/machine_secret_hash_updated.go @@ -0,0 +1,37 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type machineSecretHashUpdatedPayload struct { + HashedSecret string `json:"hashedSecret,omitempty"` +} + +type MachineSecretHashUpdatedEvent eventstore.Event[machineSecretHashUpdatedPayload] + +const MachineSecretHashUpdatedType = machinePrefix + ".secret.updated" + +var _ eventstore.TypeChecker = (*MachineSecretHashUpdatedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *MachineSecretHashUpdatedEvent) ActionType() string { + return MachineSecretHashUpdatedType +} + +func MachineSecretHashUpdatedEventFromStorage(event *eventstore.StorageEvent) (e *MachineSecretHashUpdatedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-y41RK", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[machineSecretHashUpdatedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &MachineSecretHashUpdatedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/machine_secret_removed.go b/internal/v2/user/machine_secret_removed.go new file mode 100644 index 0000000000..a05da5f796 --- /dev/null +++ b/internal/v2/user/machine_secret_removed.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type MachineSecretRemovedEvent eventstore.Event[eventstore.EmptyPayload] + +const MachineSecretRemovedType = machinePrefix + ".secret.removed" + +var _ eventstore.TypeChecker = (*MachineSecretRemovedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *MachineSecretRemovedEvent) ActionType() string { + return MachineSecretRemovedType +} + +func MachineSecretRemovedEventFromStorage(event *eventstore.StorageEvent) (e *MachineSecretRemovedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-SMtct", "Errors.Invalid.Event.Type") + } + + return &MachineSecretRemovedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/machine_secret_set.go b/internal/v2/user/machine_secret_set.go new file mode 100644 index 0000000000..a2a9ffa557 --- /dev/null +++ b/internal/v2/user/machine_secret_set.go @@ -0,0 +1,41 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type machineSecretSetPayload struct { + // New events only use EncodedHash. However, the ClientSecret field + // is preserved to handle events older than the switch to Passwap. + ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"` + HashedSecret string `json:"hashedSecret,omitempty"` +} + +type MachineSecretHashSetEvent eventstore.Event[machineSecretSetPayload] + +const MachineSecretHashSetType = machinePrefix + ".secret.set" + +var _ eventstore.TypeChecker = (*MachineSecretHashSetEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *MachineSecretHashSetEvent) ActionType() string { + return MachineSecretHashSetType +} + +func MachineSecretHashSetEventFromStorage(event *eventstore.StorageEvent) (e *MachineSecretHashSetEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-DzycT", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[machineSecretSetPayload](event.Payload) + if err != nil { + return nil, err + } + + return &MachineSecretHashSetEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/token_added.go b/internal/v2/user/token_added.go new file mode 100644 index 0000000000..682dc219d3 --- /dev/null +++ b/internal/v2/user/token_added.go @@ -0,0 +1,51 @@ +package user + +import ( + "time" + + "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type tokenAddedPayload struct { + TokenID string `json:"tokenId,omitempty"` + ApplicationID string `json:"applicationId,omitempty"` + UserAgentID string `json:"userAgentId,omitempty"` + RefreshTokenID string `json:"refreshTokenID,omitempty"` + Audience []string `json:"audience,omitempty"` + Scopes []string `json:"scopes,omitempty"` + AuthMethodsReferences []string `json:"authMethodsReferences,omitempty"` + AuthTime time.Time `json:"authTime,omitempty"` + Expiration time.Time `json:"expiration,omitempty"` + PreferredLanguage string `json:"preferredLanguage,omitempty"` + Reason domain.TokenReason `json:"reason,omitempty"` + Actor *domain.TokenActor `json:"actor,omitempty"` +} + +type TokenAddedEvent eventstore.Event[tokenAddedPayload] + +const TokenAddedType = AggregateType + ".token.added" + +var _ eventstore.TypeChecker = (*TokenAddedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *TokenAddedEvent) ActionType() string { + return TokenAddedType +} + +func TokenAddedEventFromStorage(event *eventstore.StorageEvent) (e *TokenAddedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-0YSt4", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[tokenAddedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &TokenAddedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} diff --git a/internal/v2/user/user_deactivated.go b/internal/v2/user/user_deactivated.go new file mode 100644 index 0000000000..9d01a9e713 --- /dev/null +++ b/internal/v2/user/user_deactivated.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type DeactivatedEvent eventstore.Event[eventstore.EmptyPayload] + +const DeactivatedType = AggregateType + ".deactivated" + +var _ eventstore.TypeChecker = (*DeactivatedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *DeactivatedEvent) ActionType() string { + return DeactivatedType +} + +func DeactivatedEventFromStorage(event *eventstore.StorageEvent) (e *DeactivatedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-SBLu2", "Errors.Invalid.Event.Type") + } + + return &DeactivatedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/user_locked.go b/internal/v2/user/user_locked.go new file mode 100644 index 0000000000..a0702cdbc2 --- /dev/null +++ b/internal/v2/user/user_locked.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type LockedEvent eventstore.Event[eventstore.EmptyPayload] + +const LockedType = AggregateType + ".locked" + +var _ eventstore.TypeChecker = (*LockedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *LockedEvent) ActionType() string { + return LockedType +} + +func LockedEventFromStorage(event *eventstore.StorageEvent) (e *LockedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-48jjE", "Errors.Invalid.Event.Type") + } + + return &LockedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/user_reactivated.go b/internal/v2/user/user_reactivated.go new file mode 100644 index 0000000000..005392ce23 --- /dev/null +++ b/internal/v2/user/user_reactivated.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type ReactivatedEvent eventstore.Event[eventstore.EmptyPayload] + +const ReactivatedType = AggregateType + ".reactivated" + +var _ eventstore.TypeChecker = (*ReactivatedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *ReactivatedEvent) ActionType() string { + return ReactivatedType +} + +func ReactivatedEventFromStorage(event *eventstore.StorageEvent) (e *ReactivatedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-B3fcY", "Errors.Invalid.Event.Type") + } + + return &ReactivatedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/user_removed.go b/internal/v2/user/user_removed.go new file mode 100644 index 0000000000..b5ad827f05 --- /dev/null +++ b/internal/v2/user/user_removed.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type RemovedEvent eventstore.Event[eventstore.EmptyPayload] + +const RemovedType = AggregateType + ".removed" + +var _ eventstore.TypeChecker = (*RemovedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *RemovedEvent) ActionType() string { + return RemovedType +} + +func RemovedEventFromStorage(event *eventstore.StorageEvent) (e *RemovedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-UN6Xa", "Errors.Invalid.Event.Type") + } + + return &RemovedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/user_unlocked.go b/internal/v2/user/user_unlocked.go new file mode 100644 index 0000000000..97340619ce --- /dev/null +++ b/internal/v2/user/user_unlocked.go @@ -0,0 +1,27 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type UnlockedEvent eventstore.Event[eventstore.EmptyPayload] + +const UnlockedType = AggregateType + ".unlocked" + +var _ eventstore.TypeChecker = (*UnlockedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *UnlockedEvent) ActionType() string { + return UnlockedType +} + +func UnlockedEventFromStorage(event *eventstore.StorageEvent) (e *UnlockedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-HB0wi", "Errors.Invalid.Event.Type") + } + + return &UnlockedEvent{ + StorageEvent: event, + }, nil +} diff --git a/internal/v2/user/username_changed.go b/internal/v2/user/username_changed.go new file mode 100644 index 0000000000..5c0c8afdbc --- /dev/null +++ b/internal/v2/user/username_changed.go @@ -0,0 +1,37 @@ +package user + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/zerrors" +) + +type usernameChangedPayload struct { + Username string `json:"userName"` +} + +type UsernameChangedEvent eventstore.Event[usernameChangedPayload] + +const UsernameChangedType = AggregateType + ".username.changed" + +var _ eventstore.TypeChecker = (*UsernameChangedEvent)(nil) + +// ActionType implements eventstore.Typer. +func (c *UsernameChangedEvent) ActionType() string { + return UsernameChangedType +} + +func UsernameChangedEventFromStorage(event *eventstore.StorageEvent) (e *UsernameChangedEvent, _ error) { + if event.Type != e.ActionType() { + return nil, zerrors.ThrowInvalidArgument(nil, "USER-hCGsh", "Errors.Invalid.Event.Type") + } + + payload, err := eventstore.UnmarshalPayload[usernameChangedPayload](event.Payload) + if err != nil { + return nil, err + } + + return &UsernameChangedEvent{ + StorageEvent: event, + Payload: payload, + }, nil +} From e57a9b57c8e770383316599a338ceef023d96de6 Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Thu, 23 May 2024 07:04:07 +0200 Subject: [PATCH 21/35] feat(saml): allow setting nameid-format and alternative mapping for transient format (#7979) # Which Problems Are Solved ZITADEL currently always uses `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` in SAML requests, relying on the IdP to respect that flag and always return a peristent nameid in order to be able to map the external user with an existing user (idp link) in ZITADEL. In case the IdP however returns a `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` (transient) nameid, the attribute will differ between each request and it will not be possible to match existing users. # How the Problems Are Solved This PR adds the following two options on SAML IdP: - **nameIDFormat**: allows to set the nameid-format used in the SAML Request - **transientMappingAttributeName**: allows to set an attribute name, which will be used instead of the nameid itself in case the returned nameid-format is transient # Additional Changes To reduce impact on current installations, the `idp_templates6_saml` table is altered with the two added columns by a setup job. New installations will automatically get the table with the two columns directly. All idp unit tests are updated to use `expectEventstore` instead of the deprecated `eventstoreExpect`. # Additional Context Closes #7483 Closes #7743 --------- Co-authored-by: peintnermax Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com> --- cmd/setup/27.go | 27 ++ cmd/setup/27.sql | 2 + cmd/setup/config.go | 1 + cmd/setup/setup.go | 2 + .../provider-options.component.scss | 2 +- .../provider-saml-sp.component.html | 22 + .../provider-saml-sp.component.scss | 9 + .../provider-saml-sp.component.ts | 36 +- .../src/app/modules/providers/providers.scss | 8 +- console/src/assets/i18n/en.json | 7 +- console/src/assets/i18n/nl.json | 2 +- internal/api/grpc/admin/idp_converter.go | 37 +- internal/api/grpc/idp/converter.go | 43 +- internal/api/grpc/management/idp_converter.go | 37 +- .../api/grpc/user/v2/user_integration_test.go | 2 +- internal/api/idp/idp.go | 13 +- internal/api/idp/idp_integration_test.go | 118 +++-- .../api/ui/login/external_provider_handler.go | 11 +- internal/command/idp.go | 15 +- internal/command/idp_intent_test.go | 5 + internal/command/idp_model.go | 38 +- internal/command/instance_idp.go | 6 + internal/command/instance_idp_model.go | 5 + internal/command/instance_idp_test.go | 449 +++++++++--------- internal/command/org_idp.go | 6 + internal/command/org_idp_model.go | 5 + internal/command/org_idp_test.go | 449 +++++++++--------- internal/domain/idp.go | 9 + internal/idp/providers/saml/mapper.go | 5 +- internal/idp/providers/saml/saml.go | 43 +- internal/idp/providers/saml/saml_test.go | 51 +- internal/idp/providers/saml/session.go | 44 +- internal/idp/providers/saml/session_test.go | 80 +++- internal/integration/client.go | 9 +- internal/query/idp_template.go | 62 ++- internal/query/idp_template_test.go | 74 ++- internal/query/projection/idp_template.go | 48 +- .../query/projection/idp_template_test.go | 12 +- internal/repository/idp/saml.go | 67 ++- internal/repository/instance/idp.go | 5 + internal/repository/org/idp.go | 5 + internal/static/i18n/bg.yaml | 1 + internal/static/i18n/cs.yaml | 1 + internal/static/i18n/de.yaml | 1 + internal/static/i18n/en.yaml | 1 + internal/static/i18n/es.yaml | 1 + internal/static/i18n/fr.yaml | 1 + internal/static/i18n/it.yaml | 1 + internal/static/i18n/ja.yaml | 1 + internal/static/i18n/mk.yaml | 1 + internal/static/i18n/nl.yaml | 1 + internal/static/i18n/pl.yaml | 1 + internal/static/i18n/pt.yaml | 1 + internal/static/i18n/ru.yaml | 1 + internal/static/i18n/zh.yaml | 1 + proto/zitadel/admin.proto | 54 +-- proto/zitadel/idp.proto | 33 +- proto/zitadel/management.proto | 54 +-- 58 files changed, 1306 insertions(+), 720 deletions(-) create mode 100644 cmd/setup/27.go create mode 100644 cmd/setup/27.sql diff --git a/cmd/setup/27.go b/cmd/setup/27.go new file mode 100644 index 0000000000..ee420ddfae --- /dev/null +++ b/cmd/setup/27.go @@ -0,0 +1,27 @@ +package setup + +import ( + "context" + _ "embed" + + "github.com/zitadel/zitadel/internal/database" + "github.com/zitadel/zitadel/internal/eventstore" +) + +var ( + //go:embed 27.sql + addSAMLNameIDFormat string +) + +type IDPTemplate6SAMLNameIDFormat struct { + dbClient *database.DB +} + +func (mig *IDPTemplate6SAMLNameIDFormat) Execute(ctx context.Context, _ eventstore.Event) error { + _, err := mig.dbClient.ExecContext(ctx, addSAMLNameIDFormat) + return err +} + +func (mig *IDPTemplate6SAMLNameIDFormat) String() string { + return "26_idp_templates6_add_saml_name_id_format" +} diff --git a/cmd/setup/27.sql b/cmd/setup/27.sql new file mode 100644 index 0000000000..0e0503b7f1 --- /dev/null +++ b/cmd/setup/27.sql @@ -0,0 +1,2 @@ +ALTER TABLE IF EXISTS projections.idp_templates6_saml ADD COLUMN IF NOT EXISTS name_id_format SMALLINT; +ALTER TABLE IF EXISTS projections.idp_templates6_saml ADD COLUMN IF NOT EXISTS transient_mapping_attribute_name TEXT; diff --git a/cmd/setup/config.go b/cmd/setup/config.go index c66edb4db3..1ba85804ab 100644 --- a/cmd/setup/config.go +++ b/cmd/setup/config.go @@ -109,6 +109,7 @@ type Steps struct { s24AddActorToAuthTokens *AddActorToAuthTokens s25User11AddLowerFieldsToVerifiedEmail *User11AddLowerFieldsToVerifiedEmail s26AuthUsers3 *AuthUsers3 + s27IDPTemplate6SAMLNameIDFormat *IDPTemplate6SAMLNameIDFormat } func MustNewSteps(v *viper.Viper) *Steps { diff --git a/cmd/setup/setup.go b/cmd/setup/setup.go index 96d0f05bc9..bb0111d5be 100644 --- a/cmd/setup/setup.go +++ b/cmd/setup/setup.go @@ -139,6 +139,7 @@ func Setup(config *Config, steps *Steps, masterKey string) { steps.s24AddActorToAuthTokens = &AddActorToAuthTokens{dbClient: queryDBClient} steps.s25User11AddLowerFieldsToVerifiedEmail = &User11AddLowerFieldsToVerifiedEmail{dbClient: esPusherDBClient} steps.s26AuthUsers3 = &AuthUsers3{dbClient: esPusherDBClient} + steps.s27IDPTemplate6SAMLNameIDFormat = &IDPTemplate6SAMLNameIDFormat{dbClient: esPusherDBClient} err = projection.Create(ctx, projectionDBClient, eventstoreClient, config.Projections, nil, nil, nil) logging.OnError(err).Fatal("unable to start projections") @@ -190,6 +191,7 @@ func Setup(config *Config, steps *Steps, masterKey string) { steps.s18AddLowerFieldsToLoginNames, steps.s21AddBlockFieldToLimits, steps.s25User11AddLowerFieldsToVerifiedEmail, + steps.s27IDPTemplate6SAMLNameIDFormat, } { mustExecuteMigration(ctx, eventstoreClient, step, "migration failed") } diff --git a/console/src/app/modules/provider-options/provider-options.component.scss b/console/src/app/modules/provider-options/provider-options.component.scss index 5363ea02da..a39f3d6c5f 100644 --- a/console/src/app/modules/provider-options/provider-options.component.scss +++ b/console/src/app/modules/provider-options/provider-options.component.scss @@ -1,7 +1,7 @@ .option-form { display: grid; grid-template-columns: 1fr; - max-width: 400px; + max-width: 500px; padding-bottom: 1rem; .checkbox-desc { diff --git a/console/src/app/modules/providers/provider-saml-sp/provider-saml-sp.component.html b/console/src/app/modules/providers/provider-saml-sp/provider-saml-sp.component.html index d8b5b89fdf..79bab0f3df 100644 --- a/console/src/app/modules/providers/provider-saml-sp/provider-saml-sp.component.html +++ b/console/src/app/modules/providers/provider-saml-sp/provider-saml-sp.component.html @@ -70,6 +70,28 @@
+
+ + {{ 'IDP.SAML.NAMEIDFORMAT' | translate }} + + {{ + nameIdFormat + }} + + + + +
+

{{ 'IDP.SAML.TRANSIENTMAPPINGATTRIBUTENAME_DESC' | translate }}

+
+ + + {{ 'IDP.SAML.TRANSIENTMAPPINGATTRIBUTENAME' | translate }} + + + +
+ = new BehaviorSubject(''); public justActivated$ = new BehaviorSubject(false); @@ -118,6 +125,8 @@ export class ProviderSamlSpComponent { metadataUrl: new UntypedFormControl('', []), binding: new UntypedFormControl(this.bindingValues[0], [requiredValidator]), withSignedRequest: new UntypedFormControl(true, [requiredValidator]), + nameIdFormat: new UntypedFormControl(SAMLNameIDFormat.SAML_NAME_ID_FORMAT_PERSISTENT, []), + transientMappingAttributeName: new UntypedFormControl('', []), }, atLeastOneIsFilled('metadataXml', 'metadataUrl'), ); @@ -196,8 +205,12 @@ export class ProviderSamlSpComponent { req.setWithSignedRequest(this.withSignedRequest?.value); // @ts-ignore req.setBinding(SAMLBinding[this.binding?.value]); + // @ts-ignore + req.setNameIdFormat(SAMLNameIDFormat[this.nameIDFormat?.value]); + req.setTransientMappingAttributeName(this.transientMapping?.value); req.setProviderOptions(this.options); + console.log(req); this.loading = true; this.service .updateSAMLProvider(req) @@ -229,6 +242,11 @@ export class ProviderSamlSpComponent { // @ts-ignore req.setBinding(SAMLBinding[this.binding?.value]); req.setWithSignedRequest(this.withSignedRequest?.value); + if (this.nameIDFormat) { + // @ts-ignore + req.setNameIdFormat(SAMLNameIDFormat[this.nameIDFormat.value]); + } + req.setTransientMappingAttributeName(this.transientMapping?.value); this.loading = true; this.service .addSAMLProvider(req) @@ -279,6 +297,14 @@ export class ProviderSamlSpComponent { return false; } + compareNameIDFormat(value: string, index: number) { + console.log(value, index); + if (value) { + return value === Object.keys(SAMLNameIDFormat)[index]; + } + return false; + } + private get name(): AbstractControl | null { return this.form.get('name'); } @@ -298,4 +324,12 @@ export class ProviderSamlSpComponent { private get withSignedRequest(): AbstractControl | null { return this.form.get('withSignedRequest'); } + + private get nameIDFormat(): AbstractControl | null { + return this.form.get('nameIdFormat'); + } + + private get transientMapping(): AbstractControl | null { + return this.form.get('transientMappingAttributeName'); + } } diff --git a/console/src/app/modules/providers/providers.scss b/console/src/app/modules/providers/providers.scss index ba96f6c301..85584b956a 100644 --- a/console/src/app/modules/providers/providers.scss +++ b/console/src/app/modules/providers/providers.scss @@ -50,7 +50,7 @@ .formfield { display: block; - max-width: 400px; + max-width: 500px; &.pwd { display: none; @@ -132,7 +132,7 @@ } .string-list-component-wrapper { - max-width: 400px; + max-width: 500px; } .identity-provider-content { @@ -144,7 +144,7 @@ } .identity-provider-2-col { - max-width: 400px; + max-width: 500px; display: grid; grid-template-columns: 1fr 1fr; column-gap: 1rem; @@ -160,7 +160,7 @@ .flex-line { display: flex; align-items: flex-start; - max-width: 400px; + max-width: 500px; .formfield { flex: 1; diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json index d85616fe5e..9f686bbfb1 100644 --- a/console/src/assets/i18n/en.json +++ b/console/src/assets/i18n/en.json @@ -2044,7 +2044,7 @@ "DESCRIPTION": "Enter the credentials for your Apple Provider" }, "SAML": { - "TITLE": "Sign in with Saml SP", + "TITLE": "Sign in with SAML SP", "DESCRIPTION": "Enter the credentials for your SAML Provider" } }, @@ -2177,7 +2177,10 @@ "METADATAXML": "Metadata Xml", "METADATAURL": "Metadata URL", "BINDING": "Binding", - "SIGNEDREQUEST": "Signed Request" + "SIGNEDREQUEST": "Signed Request", + "NAMEIDFORMAT": "NameID Format", + "TRANSIENTMAPPINGATTRIBUTENAME": "Custom Mapping Attribute Name", + "TRANSIENTMAPPINGATTRIBUTENAME_DESC": "Alternative attribute name to map the user in case the `nameid-format` returned is `transient`, e.g. `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`" }, "TOAST": { "SAVED": "Successfully saved.", diff --git a/console/src/assets/i18n/nl.json b/console/src/assets/i18n/nl.json index 296ddb3b3c..1e4fb7abfd 100644 --- a/console/src/assets/i18n/nl.json +++ b/console/src/assets/i18n/nl.json @@ -2044,7 +2044,7 @@ "DESCRIPTION": "Voer de inloggegevens in voor uw Apple Provider" }, "SAML": { - "TITLE": "Log in met Saml SP", + "TITLE": "Log in met SAML SP", "DESCRIPTION": "Voer de inloggegevens in voor uw SAML Provider" } }, diff --git a/internal/api/grpc/admin/idp_converter.go b/internal/api/grpc/admin/idp_converter.go index ce3884d2b5..2914f94b30 100644 --- a/internal/api/grpc/admin/idp_converter.go +++ b/internal/api/grpc/admin/idp_converter.go @@ -2,6 +2,7 @@ package admin import ( "github.com/crewjam/saml" + "github.com/muhlemmer/gu" idp_grpc "github.com/zitadel/zitadel/internal/api/grpc/idp" "github.com/zitadel/zitadel/internal/api/grpc/object" @@ -469,24 +470,36 @@ func updateAppleProviderToCommand(req *admin_pb.UpdateAppleProviderRequest) comm } func addSAMLProviderToCommand(req *admin_pb.AddSAMLProviderRequest) command.SAMLProvider { + var nameIDFormat *domain.SAMLNameIDFormat + if req.NameIdFormat != nil { + nameIDFormat = gu.Ptr(idp_grpc.SAMLNameIDFormatToDomain(req.GetNameIdFormat())) + } return command.SAMLProvider{ - Name: req.Name, - Metadata: req.GetMetadataXml(), - MetadataURL: req.GetMetadataUrl(), - Binding: bindingToCommand(req.Binding), - WithSignedRequest: req.WithSignedRequest, - IDPOptions: idp_grpc.OptionsToCommand(req.ProviderOptions), + Name: req.Name, + Metadata: req.GetMetadataXml(), + MetadataURL: req.GetMetadataUrl(), + Binding: bindingToCommand(req.Binding), + WithSignedRequest: req.WithSignedRequest, + NameIDFormat: nameIDFormat, + TransientMappingAttributeName: req.GetTransientMappingAttributeName(), + IDPOptions: idp_grpc.OptionsToCommand(req.ProviderOptions), } } func updateSAMLProviderToCommand(req *admin_pb.UpdateSAMLProviderRequest) command.SAMLProvider { + var nameIDFormat *domain.SAMLNameIDFormat + if req.NameIdFormat != nil { + nameIDFormat = gu.Ptr(idp_grpc.SAMLNameIDFormatToDomain(req.GetNameIdFormat())) + } return command.SAMLProvider{ - Name: req.Name, - Metadata: req.GetMetadataXml(), - MetadataURL: req.GetMetadataUrl(), - Binding: bindingToCommand(req.Binding), - WithSignedRequest: req.WithSignedRequest, - IDPOptions: idp_grpc.OptionsToCommand(req.ProviderOptions), + Name: req.Name, + Metadata: req.GetMetadataXml(), + MetadataURL: req.GetMetadataUrl(), + Binding: bindingToCommand(req.Binding), + WithSignedRequest: req.WithSignedRequest, + NameIDFormat: nameIDFormat, + TransientMappingAttributeName: req.GetTransientMappingAttributeName(), + IDPOptions: idp_grpc.OptionsToCommand(req.ProviderOptions), } } diff --git a/internal/api/grpc/idp/converter.go b/internal/api/grpc/idp/converter.go index 2acaf4d3d8..9b3e09a10c 100644 --- a/internal/api/grpc/idp/converter.go +++ b/internal/api/grpc/idp/converter.go @@ -2,6 +2,7 @@ package idp import ( "github.com/crewjam/saml" + "github.com/muhlemmer/gu" "google.golang.org/protobuf/types/known/durationpb" obj_grpc "github.com/zitadel/zitadel/internal/api/grpc/object" @@ -339,6 +340,21 @@ func azureADTenantTypeToCommand(tenantType idp_pb.AzureADTenantType) azuread.Ten } } +func SAMLNameIDFormatToDomain(format idp_pb.SAMLNameIDFormat) domain.SAMLNameIDFormat { + switch format { + case idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_UNSPECIFIED: + return domain.SAMLNameIDFormatUnspecified + case idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_EMAIL_ADDRESS: + return domain.SAMLNameIDFormatEmailAddress + case idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_PERSISTENT: + return domain.SAMLNameIDFormatPersistent + case idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_TRANSIENT: + return domain.SAMLNameIDFormatTransient + default: + return domain.SAMLNameIDFormatUnspecified + } +} + func ProvidersToPb(providers []*query.IDPTemplate) []*idp_pb.Provider { list := make([]*idp_pb.Provider, len(providers)) for i, provider := range providers { @@ -639,11 +655,17 @@ func appleConfigToPb(providerConfig *idp_pb.ProviderConfig, template *query.Appl } func samlConfigToPb(providerConfig *idp_pb.ProviderConfig, template *query.SAMLIDPTemplate) { + nameIDFormat := idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_PERSISTENT + if template.NameIDFormat.Valid { + nameIDFormat = nameIDToPb(template.NameIDFormat.V) + } providerConfig.Config = &idp_pb.ProviderConfig_Saml{ Saml: &idp_pb.SAMLConfig{ - MetadataXml: template.Metadata, - Binding: bindingToPb(template.Binding), - WithSignedRequest: template.WithSignedRequest, + MetadataXml: template.Metadata, + Binding: bindingToPb(template.Binding), + WithSignedRequest: template.WithSignedRequest, + NameIdFormat: nameIDFormat, + TransientMappingAttributeName: gu.Ptr(template.TransientMappingAttributeName), }, } } @@ -662,3 +684,18 @@ func bindingToPb(binding string) idp_pb.SAMLBinding { return idp_pb.SAMLBinding_SAML_BINDING_UNSPECIFIED } } + +func nameIDToPb(format domain.SAMLNameIDFormat) idp_pb.SAMLNameIDFormat { + switch format { + case domain.SAMLNameIDFormatUnspecified: + return idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_UNSPECIFIED + case domain.SAMLNameIDFormatEmailAddress: + return idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_EMAIL_ADDRESS + case domain.SAMLNameIDFormatPersistent: + return idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_PERSISTENT + case domain.SAMLNameIDFormatTransient: + return idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_TRANSIENT + default: + return idp_pb.SAMLNameIDFormat_SAML_NAME_ID_FORMAT_UNSPECIFIED + } +} diff --git a/internal/api/grpc/management/idp_converter.go b/internal/api/grpc/management/idp_converter.go index d8949a5444..48d5a85a99 100644 --- a/internal/api/grpc/management/idp_converter.go +++ b/internal/api/grpc/management/idp_converter.go @@ -4,6 +4,7 @@ import ( "context" "github.com/crewjam/saml" + "github.com/muhlemmer/gu" "github.com/zitadel/zitadel/internal/api/authz" idp_grpc "github.com/zitadel/zitadel/internal/api/grpc/idp" @@ -462,24 +463,36 @@ func updateAppleProviderToCommand(req *mgmt_pb.UpdateAppleProviderRequest) comma } func addSAMLProviderToCommand(req *mgmt_pb.AddSAMLProviderRequest) command.SAMLProvider { + var nameIDFormat *domain.SAMLNameIDFormat + if req.NameIdFormat != nil { + nameIDFormat = gu.Ptr(idp_grpc.SAMLNameIDFormatToDomain(req.GetNameIdFormat())) + } return command.SAMLProvider{ - Name: req.Name, - Metadata: req.GetMetadataXml(), - MetadataURL: req.GetMetadataUrl(), - Binding: bindingToCommand(req.Binding), - WithSignedRequest: req.WithSignedRequest, - IDPOptions: idp_grpc.OptionsToCommand(req.ProviderOptions), + Name: req.Name, + Metadata: req.GetMetadataXml(), + MetadataURL: req.GetMetadataUrl(), + Binding: bindingToCommand(req.Binding), + WithSignedRequest: req.WithSignedRequest, + NameIDFormat: nameIDFormat, + TransientMappingAttributeName: req.GetTransientMappingAttributeName(), + IDPOptions: idp_grpc.OptionsToCommand(req.ProviderOptions), } } func updateSAMLProviderToCommand(req *mgmt_pb.UpdateSAMLProviderRequest) command.SAMLProvider { + var nameIDFormat *domain.SAMLNameIDFormat + if req.NameIdFormat != nil { + nameIDFormat = gu.Ptr(idp_grpc.SAMLNameIDFormatToDomain(req.GetNameIdFormat())) + } return command.SAMLProvider{ - Name: req.Name, - Metadata: req.GetMetadataXml(), - MetadataURL: req.GetMetadataUrl(), - Binding: bindingToCommand(req.Binding), - WithSignedRequest: req.WithSignedRequest, - IDPOptions: idp_grpc.OptionsToCommand(req.ProviderOptions), + Name: req.Name, + Metadata: req.GetMetadataXml(), + MetadataURL: req.GetMetadataUrl(), + Binding: bindingToCommand(req.Binding), + WithSignedRequest: req.WithSignedRequest, + NameIDFormat: nameIDFormat, + TransientMappingAttributeName: req.GetTransientMappingAttributeName(), + IDPOptions: idp_grpc.OptionsToCommand(req.ProviderOptions), } } diff --git a/internal/api/grpc/user/v2/user_integration_test.go b/internal/api/grpc/user/v2/user_integration_test.go index 19ce0aecc6..824029724e 100644 --- a/internal/api/grpc/user/v2/user_integration_test.go +++ b/internal/api/grpc/user/v2/user_integration_test.go @@ -1883,7 +1883,7 @@ func TestServer_StartIdentityProviderIntent(t *testing.T) { orgResp := Tester.CreateOrganization(IamCTX, fmt.Sprintf("NotDefaultOrg%d", time.Now().UnixNano()), fmt.Sprintf("%d@mouse.com", time.Now().UnixNano())) notDefaultOrgIdpID := Tester.AddOrgGenericOAuthProvider(t, CTX, orgResp.OrganizationId) samlIdpID := Tester.AddSAMLProvider(t, CTX) - samlRedirectIdpID := Tester.AddSAMLRedirectProvider(t, CTX) + samlRedirectIdpID := Tester.AddSAMLRedirectProvider(t, CTX, "") samlPostIdpID := Tester.AddSAMLPostProvider(t, CTX) type args struct { ctx context.Context diff --git a/internal/api/idp/idp.go b/internal/api/idp/idp.go index 6a2cb6e32e..0209e0337d 100644 --- a/internal/api/idp/idp.go +++ b/internal/api/idp/idp.go @@ -229,11 +229,6 @@ func (h *Handler) handleACS(w http.ResponseWriter, r *http.Request) { http.Error(w, err.Error(), http.StatusBadRequest) return } - sp, err := samlProvider.GetSP() - if err != nil { - http.Error(w, err.Error(), http.StatusBadRequest) - return - } intent, err := h.commands.GetActiveIntent(ctx, data.RelayState) if err != nil { @@ -245,10 +240,10 @@ func (h *Handler) handleACS(w http.ResponseWriter, r *http.Request) { return } - session := saml2.Session{ - ServiceProvider: sp, - RequestID: intent.RequestID, - Request: r, + session, err := saml2.NewSession(samlProvider, intent.RequestID, r) + if err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return } idpUser, err := session.FetchUser(r.Context()) diff --git a/internal/api/idp/idp_integration_test.go b/internal/api/idp/idp_integration_test.go index 1ade5d7f3e..8fdc24539c 100644 --- a/internal/api/idp/idp_integration_test.go +++ b/internal/api/idp/idp_integration_test.go @@ -52,7 +52,7 @@ func TestMain(m *testing.M) { } func TestServer_SAMLCertificate(t *testing.T) { - samlRedirectIdpID := Tester.AddSAMLRedirectProvider(t, CTX) + samlRedirectIdpID := Tester.AddSAMLRedirectProvider(t, CTX, "") oauthIdpID := Tester.AddGenericOAuthProvider(t, CTX) type args struct { @@ -109,7 +109,7 @@ func TestServer_SAMLCertificate(t *testing.T) { } func TestServer_SAMLMetadata(t *testing.T) { - samlRedirectIdpID := Tester.AddSAMLRedirectProvider(t, CTX) + samlRedirectIdpID := Tester.AddSAMLRedirectProvider(t, CTX, "") oauthIdpID := Tester.AddGenericOAuthProvider(t, CTX) type args struct { @@ -167,7 +167,7 @@ func TestServer_SAMLMetadata(t *testing.T) { func TestServer_SAMLACS(t *testing.T) { userHuman := Tester.CreateHumanUser(CTX) - samlRedirectIdpID := Tester.AddSAMLRedirectProvider(t, CTX) + samlRedirectIdpID := Tester.AddSAMLRedirectProvider(t, CTX, "urn:oid:0.9.2342.19200300.100.1.1") // the username is set in urn:oid:0.9.2342.19200300.100.1.1 externalUserID := "test1" linkedExternalUserID := "test2" Tester.CreateUserIDPlink(CTX, userHuman.UserId, linkedExternalUserID, samlRedirectIdpID, linkedExternalUserID) @@ -180,13 +180,15 @@ func TestServer_SAMLACS(t *testing.T) { assert.NoError(t, err) type args struct { - ctx context.Context - successURL string - failureURL string - idpID string - username string - intentID string - response string + ctx context.Context + successURL string + failureURL string + idpID string + username string + nameID string + nameIDFormat string + intentID string + response string } type want struct { successful bool @@ -201,12 +203,14 @@ func TestServer_SAMLACS(t *testing.T) { { name: "intent invalid", args: args{ - ctx: CTX, - successURL: "https://example.com/success", - failureURL: "https://example.com/failure", - idpID: samlRedirectIdpID, - username: externalUserID, - intentID: "notexisting", + ctx: CTX, + successURL: "https://example.com/success", + failureURL: "https://example.com/failure", + idpID: samlRedirectIdpID, + username: externalUserID, + nameID: externalUserID, + nameIDFormat: string(saml.PersistentNameIDFormat), + intentID: "notexisting", }, want: want{ successful: false, @@ -217,12 +221,14 @@ func TestServer_SAMLACS(t *testing.T) { { name: "response invalid", args: args{ - ctx: CTX, - successURL: "https://example.com/success", - failureURL: "https://example.com/failure", - idpID: samlRedirectIdpID, - username: externalUserID, - response: "invalid", + ctx: CTX, + successURL: "https://example.com/success", + failureURL: "https://example.com/failure", + idpID: samlRedirectIdpID, + username: externalUserID, + nameID: externalUserID, + nameIDFormat: string(saml.PersistentNameIDFormat), + response: "invalid", }, want: want{ successful: false, @@ -232,11 +238,13 @@ func TestServer_SAMLACS(t *testing.T) { { name: "saml flow redirect, ok", args: args{ - ctx: CTX, - successURL: "https://example.com/success", - failureURL: "https://example.com/failure", - idpID: samlRedirectIdpID, - username: externalUserID, + ctx: CTX, + successURL: "https://example.com/success", + failureURL: "https://example.com/failure", + idpID: samlRedirectIdpID, + username: externalUserID, + nameID: externalUserID, + nameIDFormat: string(saml.PersistentNameIDFormat), }, want: want{ successful: true, @@ -246,11 +254,45 @@ func TestServer_SAMLACS(t *testing.T) { { name: "saml flow redirect with link, ok", args: args{ - ctx: CTX, - successURL: "https://example.com/success", - failureURL: "https://example.com/failure", - idpID: samlRedirectIdpID, - username: linkedExternalUserID, + ctx: CTX, + successURL: "https://example.com/success", + failureURL: "https://example.com/failure", + idpID: samlRedirectIdpID, + username: linkedExternalUserID, + nameID: linkedExternalUserID, + nameIDFormat: string(saml.PersistentNameIDFormat), + }, + want: want{ + successful: true, + user: userHuman.UserId, + }, + }, + { + name: "saml flow redirect (transient), ok", + args: args{ + ctx: CTX, + successURL: "https://example.com/success", + failureURL: "https://example.com/failure", + idpID: samlRedirectIdpID, + username: externalUserID, + nameID: "genericID", + nameIDFormat: string(saml.TransientNameIDFormat), + }, + want: want{ + successful: true, + user: "", + }, + }, + { + name: "saml flow redirect with link (transient), ok", + args: args{ + ctx: CTX, + successURL: "https://example.com/success", + failureURL: "https://example.com/failure", + idpID: samlRedirectIdpID, + username: linkedExternalUserID, + nameID: "genericID", + nameIDFormat: string(saml.TransientNameIDFormat), }, want: want{ successful: true, @@ -287,7 +329,7 @@ func TestServer_SAMLACS(t *testing.T) { relayState = tt.args.intentID } callbackURL := http_util.BuildOrigin(Tester.Host(), Tester.Server.Config.ExternalSecure) + "/idps/" + tt.args.idpID + "/saml/acs" - response := createResponse(t, idp, samlRequest, tt.args.username) + response := createResponse(t, idp, samlRequest, tt.args.nameID, tt.args.nameIDFormat, tt.args.username) //test purposes, use defined response if tt.args.response != "" { response = tt.args.response @@ -432,14 +474,16 @@ func getIDP(zitadelBaseURL string, idpIDs []string, user1, user2 string) (*saml. return &idpServer.IDP, nil } -func createResponse(t *testing.T, idp *saml.IdentityProvider, req *http.Request, username string) string { +func createResponse(t *testing.T, idp *saml.IdentityProvider, req *http.Request, nameID, nameIDFormat, username string) string { authnReq, err := saml.NewIdpAuthnRequest(idp, req) assert.NoError(t, authnReq.Validate()) err = idp.AssertionMaker.MakeAssertion(authnReq, &saml.Session{ - CreateTime: time.Now().UTC(), - Index: "", - NameID: username, + CreateTime: time.Now().UTC(), + Index: "", + NameID: nameID, + NameIDFormat: nameIDFormat, + UserName: username, }) assert.NoError(t, err) err = authnReq.MakeResponse() diff --git a/internal/api/ui/login/external_provider_handler.go b/internal/api/ui/login/external_provider_handler.go index 3cd14c0a72..e03b32086f 100644 --- a/internal/api/ui/login/external_provider_handler.go +++ b/internal/api/ui/login/external_provider_handler.go @@ -319,12 +319,11 @@ func (l *Login) handleExternalLoginCallback(w http.ResponseWriter, r *http.Reque l.externalAuthFailed(w, r, authReq, nil, nil, err) return } - sp, err := provider.(*saml.Provider).GetSP() + session, err = saml.NewSession(provider.(*saml.Provider), authReq.SAMLRequestID, r) if err != nil { l.externalAuthFailed(w, r, authReq, nil, nil, err) return } - session = &saml.Session{ServiceProvider: sp, RequestID: authReq.SAMLRequestID, Request: r} case domain.IDPTypeJWT, domain.IDPTypeLDAP, domain.IDPTypeUnspecified: @@ -1029,13 +1028,19 @@ func (l *Login) samlProvider(ctx context.Context, identityProvider *query.IDPTem if err != nil { return nil, err } - opts := make([]saml.ProviderOpts, 0, 2) + opts := make([]saml.ProviderOpts, 0, 6) if identityProvider.SAMLIDPTemplate.WithSignedRequest { opts = append(opts, saml.WithSignedRequest()) } if identityProvider.SAMLIDPTemplate.Binding != "" { opts = append(opts, saml.WithBinding(identityProvider.SAMLIDPTemplate.Binding)) } + if identityProvider.SAMLIDPTemplate.NameIDFormat.Valid { + opts = append(opts, saml.WithNameIDFormat(identityProvider.SAMLIDPTemplate.NameIDFormat.V)) + } + if identityProvider.SAMLIDPTemplate.TransientMappingAttributeName != "" { + opts = append(opts, saml.WithTransientMappingAttributeName(identityProvider.SAMLIDPTemplate.TransientMappingAttributeName)) + } opts = append(opts, saml.WithEntityID(http_utils.BuildOrigin(authz.GetInstance(ctx).RequestedHost(), l.externalSecure)+"/idps/"+identityProvider.ID+"/saml/metadata"), saml.WithCustomRequestTracker( diff --git a/internal/command/idp.go b/internal/command/idp.go index a8b041c335..229d19b6e1 100644 --- a/internal/command/idp.go +++ b/internal/command/idp.go @@ -5,6 +5,7 @@ import ( "time" "github.com/zitadel/zitadel/internal/command/preparation" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/repository/idp" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -110,12 +111,14 @@ type LDAPProvider struct { } type SAMLProvider struct { - Name string - Metadata []byte - MetadataURL string - Binding string - WithSignedRequest bool - IDPOptions idp.Options + Name string + Metadata []byte + MetadataURL string + Binding string + WithSignedRequest bool + NameIDFormat *domain.SAMLNameIDFormat + TransientMappingAttributeName string + IDPOptions idp.Options } type AppleProvider struct { diff --git a/internal/command/idp_intent_test.go b/internal/command/idp_intent_test.go index 8bdbcb4716..efcc9e0ddc 100644 --- a/internal/command/idp_intent_test.go +++ b/internal/command/idp_intent_test.go @@ -6,6 +6,7 @@ import ( "testing" "github.com/crewjam/saml" + "github.com/muhlemmer/gu" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/zitadel/oidc/v3/pkg/oidc" @@ -631,6 +632,8 @@ func TestCommands_AuthFromProvider_SAML(t *testing.T) { []byte("certificate"), "", false, + gu.Ptr(domain.SAMLNameIDFormatUnspecified), + "", rep_idp.Options{}, )), ), @@ -649,6 +652,8 @@ func TestCommands_AuthFromProvider_SAML(t *testing.T) { }, []byte("-----BEGIN CERTIFICATE-----\nMIIC2zCCAcOgAwIBAgIIAy/jm1gAAdEwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UE\nChMHWklUQURFTDAeFw0yMzA4MzAwNzExMTVaFw0yNDA4MjkwNzExMTVaMBIxEDAO\nBgNVBAoTB1pJVEFERUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDE\nd3TztGgSb3LBVZn8f60NbFCyZW+F9HPiMCr9F9T45Zc0fgmMwxId0WzRD5Y/3yc1\ndHJzt+Bsxvw12aUHbIPiothqk3lINoFzl2H/cSfIW3nehKyNOUqdBQ8B4mvaqH81\njTjoJ/JTJAwzglHk6JAWjhOyx9aep1yBqYa3QASeTaW9sxkpB0Co1L2UPNhuMwZq\n8RA9NkTfmYVcVBeNqihler5MhruFtqrv+J0ftwc1stw8uCN89ADyr4Ni+e+FeWar\nQs9Bkfc6KLF/5IXa9HCsHNPaaoYPY6I6RSaG4/DKoSKIEe1/GSVG1FTpZ8trUZxv\nU+xXS6gEalXcrJsiX8aXAgMBAAGjNTAzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCx\n/dRNIj0N/16zJhZR/ahkc2AkvDXYxyr4JRT5wK9GQDNl/oaX3debRuSi/tfaXFIX\naJA6PxM4J49ZaiEpLrKfxMz5kAhjKchCBEMcH3mGt+iNZH7EOyTvHjpGrP2OZrsh\nO17yrvN3HuQxIU6roJlqtZz2iAADsoPtwOO4D7hupm9XTMkSnAmlMWOo/q46Jz89\n1sMxB+dXmH/zV0wgwh0omZfLV0u89mvdq269VhcjNBpBYSnN1ccqYWd5iwziob3I\nvaavGHGfkbvRUn/tKftYuTK30q03R+e9YbmlWZ0v695owh2e/apCzowQsCKfSVC8\nOxVyt5XkHq1tWwVyBmFp\n-----END CERTIFICATE-----\n"), "", false, + gu.Ptr(domain.SAMLNameIDFormatUnspecified), + "", rep_idp.Options{}, )), ), diff --git a/internal/command/idp_model.go b/internal/command/idp_model.go index 12bccd39f7..fa38b4a075 100644 --- a/internal/command/idp_model.go +++ b/internal/command/idp_model.go @@ -1726,13 +1726,15 @@ func (wm *AppleIDPWriteModel) GetProviderOptions() idp.Options { type SAMLIDPWriteModel struct { eventstore.WriteModel - Name string - ID string - Metadata []byte - Key *crypto.CryptoValue - Certificate []byte - Binding string - WithSignedRequest bool + Name string + ID string + Metadata []byte + Key *crypto.CryptoValue + Certificate []byte + Binding string + WithSignedRequest bool + NameIDFormat *domain.SAMLNameIDFormat + TransientMappingAttributeName string idp.Options State domain.IDPState @@ -1759,6 +1761,8 @@ func (wm *SAMLIDPWriteModel) reduceAddedEvent(e *idp.SAMLIDPAddedEvent) { wm.Certificate = e.Certificate wm.Binding = e.Binding wm.WithSignedRequest = e.WithSignedRequest + wm.NameIDFormat = e.NameIDFormat + wm.TransientMappingAttributeName = e.TransientMappingAttributeName wm.Options = e.Options wm.State = domain.IDPStateActive } @@ -1782,6 +1786,12 @@ func (wm *SAMLIDPWriteModel) reduceChangedEvent(e *idp.SAMLIDPChangedEvent) { if e.WithSignedRequest != nil { wm.WithSignedRequest = *e.WithSignedRequest } + if e.NameIDFormat != nil { + wm.NameIDFormat = e.NameIDFormat + } + if e.TransientMappingAttributeName != nil { + wm.TransientMappingAttributeName = *e.TransientMappingAttributeName + } wm.Options.ReduceChanges(e.OptionChanges) } @@ -1793,6 +1803,8 @@ func (wm *SAMLIDPWriteModel) NewChanges( secretCrypto crypto.EncryptionAlgorithm, binding string, withSignedRequest bool, + nameIDFormat *domain.SAMLNameIDFormat, + transientMappingAttributeName string, options idp.Options, ) ([]idp.SAMLIDPChanges, error) { changes := make([]idp.SAMLIDPChanges, 0) @@ -1818,6 +1830,12 @@ func (wm *SAMLIDPWriteModel) NewChanges( if wm.WithSignedRequest != withSignedRequest { changes = append(changes, idp.ChangeSAMLWithSignedRequest(withSignedRequest)) } + if wm.NameIDFormat != nameIDFormat { + changes = append(changes, idp.ChangeSAMLNameIDFormat(nameIDFormat)) + } + if wm.TransientMappingAttributeName != transientMappingAttributeName { + changes = append(changes, idp.ChangeSAMLTransientMappingAttributeName(transientMappingAttributeName)) + } opts := wm.Options.Changes(options) if !opts.IsZero() { changes = append(changes, idp.ChangeSAMLOptions(opts)) @@ -1850,6 +1868,12 @@ func (wm *SAMLIDPWriteModel) ToProvider(callbackURL string, idpAlg crypto.Encryp if wm.Binding != "" { opts = append(opts, saml2.WithBinding(wm.Binding)) } + if wm.NameIDFormat != nil { + opts = append(opts, saml2.WithNameIDFormat(*wm.NameIDFormat)) + } + if wm.TransientMappingAttributeName != "" { + opts = append(opts, saml2.WithTransientMappingAttributeName(wm.TransientMappingAttributeName)) + } opts = append(opts, saml2.WithCustomRequestTracker( requesttracker.New( addRequest, diff --git a/internal/command/instance_idp.go b/internal/command/instance_idp.go index ed8d458e18..539136a08d 100644 --- a/internal/command/instance_idp.go +++ b/internal/command/instance_idp.go @@ -1763,6 +1763,8 @@ func (c *Commands) prepareAddInstanceSAMLProvider(a *instance.Aggregate, writeMo cert, provider.Binding, provider.WithSignedRequest, + provider.NameIDFormat, + provider.TransientMappingAttributeName, provider.IDPOptions, ), }, nil @@ -1811,6 +1813,8 @@ func (c *Commands) prepareUpdateInstanceSAMLProvider(a *instance.Aggregate, writ c.idpConfigEncryption, provider.Binding, provider.WithSignedRequest, + provider.NameIDFormat, + provider.TransientMappingAttributeName, provider.IDPOptions, ) if err != nil || event == nil { @@ -1854,6 +1858,8 @@ func (c *Commands) prepareRegenerateInstanceSAMLProviderCertificate(a *instance. c.idpConfigEncryption, writeModel.Binding, writeModel.WithSignedRequest, + writeModel.NameIDFormat, + writeModel.TransientMappingAttributeName, writeModel.Options, ) if err != nil || event == nil { diff --git a/internal/command/instance_idp_model.go b/internal/command/instance_idp_model.go index 6759442553..5c895b1fc7 100644 --- a/internal/command/instance_idp_model.go +++ b/internal/command/instance_idp_model.go @@ -5,6 +5,7 @@ import ( "time" "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/idp" "github.com/zitadel/zitadel/internal/repository/instance" @@ -915,6 +916,8 @@ func (wm *InstanceSAMLIDPWriteModel) NewChangedEvent( secretCrypto crypto.EncryptionAlgorithm, binding string, withSignedRequest bool, + nameIDFormat *domain.SAMLNameIDFormat, + transientMappingAttributeName string, options idp.Options, ) (*instance.SAMLIDPChangedEvent, error) { changes, err := wm.SAMLIDPWriteModel.NewChanges( @@ -925,6 +928,8 @@ func (wm *InstanceSAMLIDPWriteModel) NewChangedEvent( secretCrypto, binding, withSignedRequest, + nameIDFormat, + transientMappingAttributeName, options, ) if err != nil || len(changes) == 0 { diff --git a/internal/command/instance_idp_test.go b/internal/command/instance_idp_test.go index 3ff14610dc..0f7998a632 100644 --- a/internal/command/instance_idp_test.go +++ b/internal/command/instance_idp_test.go @@ -6,6 +6,7 @@ import ( "testing" "time" + "github.com/muhlemmer/gu" "github.com/stretchr/testify/assert" openid "github.com/zitadel/oidc/v3/pkg/oidc" "go.uber.org/mock/gomock" @@ -23,7 +24,7 @@ import ( func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -45,7 +46,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -61,7 +62,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -79,7 +80,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -98,7 +99,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { "invalid auth endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -118,7 +119,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { "invalid token endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -139,7 +140,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { "invalid user endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -161,7 +162,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { "invalid id attribute", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -184,7 +185,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewOAuthIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -229,7 +230,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewOAuthIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -287,7 +288,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -308,7 +309,7 @@ func TestCommandSide_AddInstanceGenericOAuthIDP(t *testing.T) { func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -329,7 +330,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -344,7 +345,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -360,7 +361,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -378,7 +379,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { "invalid auth endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -397,7 +398,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { "invalid token endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -417,7 +418,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { "invalid user endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -438,7 +439,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { "invalid id attribute", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -460,7 +461,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -483,7 +484,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewOAuthIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -525,7 +526,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewOAuthIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -607,7 +608,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceGenericOAuthProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -626,7 +627,7 @@ func TestCommandSide_UpdateInstanceGenericOAuthIDP(t *testing.T) { func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -648,7 +649,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -664,7 +665,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { { "invalid issuer", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -682,7 +683,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -701,7 +702,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -721,7 +722,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewOIDCIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -761,7 +762,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewOIDCIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -815,7 +816,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -836,7 +837,7 @@ func TestCommandSide_AddInstanceGenericOIDCIDP(t *testing.T) { func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -857,7 +858,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -872,7 +873,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -888,7 +889,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { { "invalid issuer", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -906,7 +907,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -925,7 +926,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -945,7 +946,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewOIDCIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -982,7 +983,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewOIDCIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1058,7 +1059,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceGenericOIDCProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -1077,7 +1078,7 @@ func TestCommandSide_UpdateInstanceGenericOIDCIDP(t *testing.T) { func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -1099,7 +1100,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -1114,7 +1115,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -1131,7 +1132,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { { "invalid client secret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -1149,7 +1150,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -1169,7 +1170,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { { name: "migrate ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewOIDCIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1227,7 +1228,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { { name: "migrate ok full", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewOIDCIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1300,7 +1301,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.MigrateInstanceGenericOIDCToAzureADProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -1319,7 +1320,7 @@ func TestCommandSide_MigrateInstanceGenericOIDCToAzureADProvider(t *testing.T) { func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -1340,7 +1341,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -1355,7 +1356,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -1372,7 +1373,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -1391,7 +1392,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) { { name: "migrate ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewOIDCIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1443,7 +1444,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) { { name: "migrate ok full", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewOIDCIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1508,7 +1509,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.MigrateInstanceGenericOIDCToGoogleProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -1527,7 +1528,7 @@ func TestCommandSide_MigrateInstanceOIDCToGoogleIDP(t *testing.T) { func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -1549,7 +1550,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -1565,7 +1566,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -1583,7 +1584,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) { { "invalid client secret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -1602,7 +1603,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewAzureADIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1641,7 +1642,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewAzureADIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1695,7 +1696,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -1716,7 +1717,7 @@ func TestCommandSide_AddInstanceAzureADIDP(t *testing.T) { func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -1737,7 +1738,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -1752,7 +1753,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -1768,7 +1769,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -1786,7 +1787,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -1805,7 +1806,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewAzureADIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1841,7 +1842,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewAzureADIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -1917,7 +1918,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceAzureADProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -1936,7 +1937,7 @@ func TestCommandSide_UpdateInstanceAzureADIDP(t *testing.T) { func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -1958,7 +1959,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -1974,7 +1975,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) { { "invalid client secret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -1992,7 +1993,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGitHubIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2028,7 +2029,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGitHubIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2078,7 +2079,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -2099,7 +2100,7 @@ func TestCommandSide_AddInstanceGitHubIDP(t *testing.T) { func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -2120,7 +2121,7 @@ func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -2135,7 +2136,7 @@ func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -2151,7 +2152,7 @@ func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -2169,7 +2170,7 @@ func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGitHubIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2202,7 +2203,7 @@ func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGitHubIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2272,7 +2273,7 @@ func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceGitHubProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -2291,7 +2292,7 @@ func TestCommandSide_UpdateInstanceGitHubIDP(t *testing.T) { func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -2313,7 +2314,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2329,7 +2330,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2347,7 +2348,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2366,7 +2367,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid auth endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2386,7 +2387,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid token endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2407,7 +2408,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid user endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2429,7 +2430,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGitHubEnterpriseIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2472,7 +2473,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGitHubEnterpriseIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2528,7 +2529,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -2549,7 +2550,7 @@ func TestCommandSide_AddInstanceGitHubEnterpriseIDP(t *testing.T) { func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -2570,7 +2571,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -2585,7 +2586,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -2601,7 +2602,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -2619,7 +2620,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid auth endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -2638,7 +2639,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid token endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -2658,7 +2659,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { "invalid user endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -2679,7 +2680,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -2701,7 +2702,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGitHubEnterpriseIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2741,7 +2742,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGitHubEnterpriseIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2820,7 +2821,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceGitHubEnterpriseProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -2839,7 +2840,7 @@ func TestCommandSide_UpdateInstanceGitHubEnterpriseIDP(t *testing.T) { func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -2861,7 +2862,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2877,7 +2878,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2895,7 +2896,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGitLabIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2931,7 +2932,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGitLabIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -2980,7 +2981,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -3001,7 +3002,7 @@ func TestCommandSide_AddInstanceGitLabIDP(t *testing.T) { func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -3022,7 +3023,7 @@ func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -3037,7 +3038,7 @@ func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -3053,7 +3054,7 @@ func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -3071,7 +3072,7 @@ func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGitLabIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3104,7 +3105,7 @@ func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGitLabIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3172,7 +3173,7 @@ func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceGitLabProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -3191,7 +3192,7 @@ func TestCommandSide_UpdateInstanceGitLabIDP(t *testing.T) { func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -3213,7 +3214,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3229,7 +3230,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { { "invalid issuer", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3247,7 +3248,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3266,7 +3267,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3286,7 +3287,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGitLabSelfHostedIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3325,7 +3326,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGitLabSelfHostedIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3377,7 +3378,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -3398,7 +3399,7 @@ func TestCommandSide_AddInstanceGitLabSelfHostedIDP(t *testing.T) { func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -3419,7 +3420,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -3434,7 +3435,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -3450,7 +3451,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { { "invalid issuer", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -3468,7 +3469,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -3487,7 +3488,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -3507,7 +3508,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGitLabSelfHostedIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3543,7 +3544,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGitLabSelfHostedIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3616,7 +3617,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceGitLabSelfHostedProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -3635,7 +3636,7 @@ func TestCommandSide_UpdateInstanceGitLabSelfHostedIDP(t *testing.T) { func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -3657,7 +3658,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3673,7 +3674,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3691,7 +3692,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGoogleIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3727,7 +3728,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewGoogleIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3776,7 +3777,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -3797,7 +3798,7 @@ func TestCommandSide_AddInstanceGoogleIDP(t *testing.T) { func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -3818,7 +3819,7 @@ func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -3833,7 +3834,7 @@ func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -3849,7 +3850,7 @@ func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -3867,7 +3868,7 @@ func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGoogleIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3900,7 +3901,7 @@ func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewGoogleIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -3968,7 +3969,7 @@ func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceGoogleProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -3987,7 +3988,7 @@ func TestCommandSide_UpdateInstanceGoogleIDP(t *testing.T) { func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -4009,7 +4010,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4025,7 +4026,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { "invalid baseDN", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4043,7 +4044,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { "invalid bindDN", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4062,7 +4063,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { "invalid bindPassword", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4082,7 +4083,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { "invalid userBase", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4103,7 +4104,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { "invalid servers", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4125,7 +4126,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { "invalid userObjectClasses", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4148,7 +4149,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { "invalid userFilters", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4172,7 +4173,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewLDAPIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -4223,7 +4224,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewLDAPIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -4315,7 +4316,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -4336,7 +4337,7 @@ func TestCommandSide_AddInstanceLDAPIDP(t *testing.T) { func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -4357,7 +4358,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4372,7 +4373,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4388,7 +4389,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { "invalid baseDN", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4406,7 +4407,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { "invalid bindDN", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4425,7 +4426,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { "invalid userbase", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4445,7 +4446,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { "invalid servers", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4466,7 +4467,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { "invalid userObjectClasses", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4488,7 +4489,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { "invalid userFilters", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4511,7 +4512,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -4538,7 +4539,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewLDAPIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -4586,7 +4587,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewLDAPIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -4705,7 +4706,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceLDAPProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -4724,7 +4725,7 @@ func TestCommandSide_UpdateInstanceLDAPIDP(t *testing.T) { func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -4746,7 +4747,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4762,7 +4763,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { { "invalid teamID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4780,7 +4781,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { { "invalid keyID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4799,7 +4800,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { { "invalid privateKey", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4819,7 +4820,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewAppleIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -4859,7 +4860,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewAppleIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -4912,7 +4913,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -4933,7 +4934,7 @@ func TestCommandSide_AddInstanceAppleIDP(t *testing.T) { func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -4954,7 +4955,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4969,7 +4970,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -4985,7 +4986,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { { "invalid teamID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -5003,7 +5004,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { { "invalid keyID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -5022,7 +5023,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -5042,7 +5043,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewAppleIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -5079,7 +5080,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewAppleIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -5153,7 +5154,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceAppleProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -5172,7 +5173,7 @@ func TestCommandSide_UpdateInstanceAppleIDP(t *testing.T) { func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm certificateAndKeyGenerator func(id string) ([]byte, []byte, error) @@ -5195,7 +5196,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -5211,7 +5212,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { { "invalid metadata", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -5229,7 +5230,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewSAMLIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -5245,6 +5246,8 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { []byte("certificate"), "", false, + nil, + "", idp.Options{}, ), ), @@ -5268,7 +5271,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( instance.NewSAMLIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -5284,6 +5287,8 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { []byte("certificate"), "binding", true, + gu.Ptr(domain.SAMLNameIDFormatTransient), + "customAttribute", idp.Options{ IsCreationAllowed: true, IsLinkingAllowed: true, @@ -5300,10 +5305,12 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { args: args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), provider: SAMLProvider{ - Name: "name", - Metadata: []byte("metadata"), - Binding: "binding", - WithSignedRequest: true, + Name: "name", + Metadata: []byte("metadata"), + Binding: "binding", + WithSignedRequest: true, + NameIDFormat: gu.Ptr(domain.SAMLNameIDFormatTransient), + TransientMappingAttributeName: "customAttribute", IDPOptions: idp.Options{ IsCreationAllowed: true, IsLinkingAllowed: true, @@ -5321,7 +5328,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, samlCertificateAndKeyGenerator: tt.fields.certificateAndKeyGenerator, @@ -5343,7 +5350,7 @@ func TestCommandSide_AddInstanceSAMLIDP(t *testing.T) { func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -5364,7 +5371,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -5379,7 +5386,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -5395,7 +5402,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { { "invalid metadata", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -5413,7 +5420,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -5432,7 +5439,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewSAMLIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -5448,6 +5455,8 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { []byte("certificate"), "", false, + nil, + "", idp.Options{}, )), ), @@ -5468,7 +5477,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewSAMLIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -5484,6 +5493,8 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { []byte("certificate"), "binding", false, + gu.Ptr(domain.SAMLNameIDFormatUnspecified), + "", idp.Options{}, )), ), @@ -5497,6 +5508,8 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { idp.ChangeSAMLMetadata([]byte("new metadata")), idp.ChangeSAMLBinding("new binding"), idp.ChangeSAMLWithSignedRequest(true), + idp.ChangeSAMLNameIDFormat(gu.Ptr(domain.SAMLNameIDFormatTransient)), + idp.ChangeSAMLTransientMappingAttributeName("customAttribute"), idp.ChangeSAMLOptions(idp.OptionChanges{ IsCreationAllowed: &t, IsLinkingAllowed: &t, @@ -5515,10 +5528,12 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { ctx: authz.WithInstanceID(context.Background(), "instance1"), id: "id1", provider: SAMLProvider{ - Name: "new name", - Metadata: []byte("new metadata"), - Binding: "new binding", - WithSignedRequest: true, + Name: "new name", + Metadata: []byte("new metadata"), + Binding: "new binding", + WithSignedRequest: true, + NameIDFormat: gu.Ptr(domain.SAMLNameIDFormatTransient), + TransientMappingAttributeName: "customAttribute", IDPOptions: idp.Options{ IsCreationAllowed: true, IsLinkingAllowed: true, @@ -5535,7 +5550,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateInstanceSAMLProvider(tt.args.ctx, tt.args.id, tt.args.provider) @@ -5554,7 +5569,7 @@ func TestCommandSide_UpdateInstanceGenericSAMLIDP(t *testing.T) { func TestCommandSide_RegenerateInstanceSAMLProviderCertificate(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm certificateAndKeyGenerator func(id string) ([]byte, []byte, error) } @@ -5575,7 +5590,7 @@ func TestCommandSide_RegenerateInstanceSAMLProviderCertificate(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: authz.WithInstanceID(context.Background(), "instance1"), @@ -5589,7 +5604,7 @@ func TestCommandSide_RegenerateInstanceSAMLProviderCertificate(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -5604,7 +5619,7 @@ func TestCommandSide_RegenerateInstanceSAMLProviderCertificate(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( instance.NewSAMLIDPAddedEvent(context.Background(), &instance.NewAggregate("instance1").Aggregate, @@ -5620,6 +5635,8 @@ func TestCommandSide_RegenerateInstanceSAMLProviderCertificate(t *testing.T) { []byte("certificate"), "binding", false, + gu.Ptr(domain.SAMLNameIDFormatUnspecified), + "", idp.Options{}, )), ), @@ -5658,7 +5675,7 @@ func TestCommandSide_RegenerateInstanceSAMLProviderCertificate(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, samlCertificateAndKeyGenerator: tt.fields.certificateAndKeyGenerator, } diff --git a/internal/command/org_idp.go b/internal/command/org_idp.go index f9d83ff9c5..597783c78f 100644 --- a/internal/command/org_idp.go +++ b/internal/command/org_idp.go @@ -1746,6 +1746,8 @@ func (c *Commands) prepareAddOrgSAMLProvider(a *org.Aggregate, writeModel *OrgSA cert, provider.Binding, provider.WithSignedRequest, + provider.NameIDFormat, + provider.TransientMappingAttributeName, provider.IDPOptions, ), }, nil @@ -1794,6 +1796,8 @@ func (c *Commands) prepareUpdateOrgSAMLProvider(a *org.Aggregate, writeModel *Or c.idpConfigEncryption, provider.Binding, provider.WithSignedRequest, + provider.NameIDFormat, + provider.TransientMappingAttributeName, provider.IDPOptions, ) if err != nil || event == nil { @@ -1837,6 +1841,8 @@ func (c *Commands) prepareRegenerateOrgSAMLProviderCertificate(a *org.Aggregate, c.idpConfigEncryption, writeModel.Binding, writeModel.WithSignedRequest, + writeModel.NameIDFormat, + writeModel.TransientMappingAttributeName, writeModel.Options, ) if err != nil || event == nil { diff --git a/internal/command/org_idp_model.go b/internal/command/org_idp_model.go index 2d8bc8f8f1..df00096095 100644 --- a/internal/command/org_idp_model.go +++ b/internal/command/org_idp_model.go @@ -5,6 +5,7 @@ import ( "time" "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/idp" "github.com/zitadel/zitadel/internal/repository/org" @@ -927,6 +928,8 @@ func (wm *OrgSAMLIDPWriteModel) NewChangedEvent( secretCrypto crypto.EncryptionAlgorithm, binding string, withSignedRequest bool, + nameIDFormat *domain.SAMLNameIDFormat, + transientMappingAttributeName string, options idp.Options, ) (*org.SAMLIDPChangedEvent, error) { changes, err := wm.SAMLIDPWriteModel.NewChanges( @@ -937,6 +940,8 @@ func (wm *OrgSAMLIDPWriteModel) NewChangedEvent( secretCrypto, binding, withSignedRequest, + nameIDFormat, + transientMappingAttributeName, options, ) if err != nil || len(changes) == 0 { diff --git a/internal/command/org_idp_test.go b/internal/command/org_idp_test.go index ebb8682125..bcda24df2d 100644 --- a/internal/command/org_idp_test.go +++ b/internal/command/org_idp_test.go @@ -6,6 +6,7 @@ import ( "testing" "time" + "github.com/muhlemmer/gu" "github.com/stretchr/testify/assert" openid "github.com/zitadel/oidc/v3/pkg/oidc" "go.uber.org/mock/gomock" @@ -22,7 +23,7 @@ import ( func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -45,7 +46,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -62,7 +63,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -81,7 +82,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -101,7 +102,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { "invalid auth endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -122,7 +123,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { "invalid token endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -144,7 +145,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { "invalid user endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -167,7 +168,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { "invalid id attribute", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -191,7 +192,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewOAuthIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -237,7 +238,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewOAuthIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -296,7 +297,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -317,7 +318,7 @@ func TestCommandSide_AddOrgGenericOAuthIDP(t *testing.T) { func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -339,7 +340,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -355,7 +356,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -372,7 +373,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -391,7 +392,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { "invalid auth endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -411,7 +412,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { "invalid token endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -432,7 +433,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { "invalid user endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -454,7 +455,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { "invalid id attribute", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -477,7 +478,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -501,7 +502,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewOAuthIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -544,7 +545,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewOAuthIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -627,7 +628,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgGenericOAuthProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -646,7 +647,7 @@ func TestCommandSide_UpdateOrgGenericOAuthIDP(t *testing.T) { func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -669,7 +670,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -686,7 +687,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { { "invalid issuer", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -705,7 +706,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -725,7 +726,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -746,7 +747,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewOIDCIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -787,7 +788,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewOIDCIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -842,7 +843,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -863,7 +864,7 @@ func TestCommandSide_AddOrgGenericOIDCIDP(t *testing.T) { func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -885,7 +886,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -901,7 +902,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -918,7 +919,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { { "invalid issuer", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -937,7 +938,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -957,7 +958,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -978,7 +979,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewOIDCIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1016,7 +1017,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewOIDCIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1093,7 +1094,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgGenericOIDCProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -1112,7 +1113,7 @@ func TestCommandSide_UpdateOrgGenericOIDCIDP(t *testing.T) { func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -1134,7 +1135,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -1150,7 +1151,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -1168,7 +1169,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { { "invalid client secret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -1187,7 +1188,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -1208,7 +1209,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { { name: "migrate ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewOIDCIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1267,7 +1268,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { { name: "migrate full ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewOIDCIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1338,7 +1339,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.MigrateOrgGenericOIDCToAzureADProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -1357,7 +1358,7 @@ func TestCommandSide_MigrateOrgGenericOIDCToAzureADProvider(t *testing.T) { func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -1379,7 +1380,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -1396,7 +1397,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -1415,7 +1416,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) { { "not found", fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -1435,7 +1436,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) { { name: "migrate ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewOIDCIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1488,7 +1489,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) { { name: "migrate full ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewOIDCIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1554,7 +1555,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.MigrateOrgGenericOIDCToGoogleProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -1573,7 +1574,7 @@ func TestCommandSide_MigrateOrgOIDCToGoogleIDP(t *testing.T) { func TestCommandSide_AddOrgAzureADIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -1596,7 +1597,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -1613,7 +1614,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -1632,7 +1633,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) { { "invalid client secret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -1652,7 +1653,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewAzureADIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1692,7 +1693,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewAzureADIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1747,7 +1748,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -1768,7 +1769,7 @@ func TestCommandSide_AddOrgAzureADIDP(t *testing.T) { func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -1790,7 +1791,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -1806,7 +1807,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -1823,7 +1824,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -1842,7 +1843,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -1862,7 +1863,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewAzureADIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1899,7 +1900,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewAzureADIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -1976,7 +1977,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgAzureADProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -1995,7 +1996,7 @@ func TestCommandSide_UpdateOrgAzureADIDP(t *testing.T) { func TestCommandSide_AddOrgGitHubIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -2018,7 +2019,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2035,7 +2036,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) { { "invalid client secret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2054,7 +2055,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGitHubIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -2091,7 +2092,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGitHubIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -2142,7 +2143,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -2163,7 +2164,7 @@ func TestCommandSide_AddOrgGitHubIDP(t *testing.T) { func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -2185,7 +2186,7 @@ func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -2201,7 +2202,7 @@ func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) { { "invalid client id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -2218,7 +2219,7 @@ func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -2237,7 +2238,7 @@ func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGitHubIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -2271,7 +2272,7 @@ func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGitHubIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -2342,7 +2343,7 @@ func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgGitHubProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -2361,7 +2362,7 @@ func TestCommandSide_UpdateOrgGitHubIDP(t *testing.T) { func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -2384,7 +2385,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2401,7 +2402,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2420,7 +2421,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2440,7 +2441,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid auth endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2461,7 +2462,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid token endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2483,7 +2484,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid user endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2506,7 +2507,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGitHubEnterpriseIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -2550,7 +2551,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGitHubEnterpriseIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -2607,7 +2608,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -2628,7 +2629,7 @@ func TestCommandSide_AddOrgGitHubEnterpriseIDP(t *testing.T) { func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -2650,7 +2651,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -2666,7 +2667,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -2683,7 +2684,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -2702,7 +2703,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid auth endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -2722,7 +2723,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid token endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -2743,7 +2744,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { "invalid user endpoint", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -2765,7 +2766,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -2788,7 +2789,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGitHubEnterpriseIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -2829,7 +2830,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGitHubEnterpriseIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -2909,7 +2910,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgGitHubEnterpriseProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -2928,7 +2929,7 @@ func TestCommandSide_UpdateOrgGitHubEnterpriseIDP(t *testing.T) { func TestCommandSide_AddOrgGitLabIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -2951,7 +2952,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2968,7 +2969,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -2987,7 +2988,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGitLabIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3024,7 +3025,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGitLabIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3074,7 +3075,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -3095,7 +3096,7 @@ func TestCommandSide_AddOrgGitLabIDP(t *testing.T) { func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -3117,7 +3118,7 @@ func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -3133,7 +3134,7 @@ func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -3150,7 +3151,7 @@ func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -3169,7 +3170,7 @@ func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGitLabIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3203,7 +3204,7 @@ func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGitLabIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3272,7 +3273,7 @@ func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgGitLabProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -3291,7 +3292,7 @@ func TestCommandSide_UpdateOrgGitLabIDP(t *testing.T) { func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -3314,7 +3315,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3331,7 +3332,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { { "invalid issuer", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3350,7 +3351,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3370,7 +3371,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3391,7 +3392,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGitLabSelfHostedIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3431,7 +3432,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGitLabSelfHostedIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3484,7 +3485,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -3505,7 +3506,7 @@ func TestCommandSide_AddOrgGitLabSelfHostedIDP(t *testing.T) { func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -3527,7 +3528,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -3543,7 +3544,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -3560,7 +3561,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { { "invalid issuer", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -3579,7 +3580,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -3599,7 +3600,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -3620,7 +3621,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGitLabSelfHostedIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3657,7 +3658,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGitLabSelfHostedIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3731,7 +3732,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgGitLabSelfHostedProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -3750,7 +3751,7 @@ func TestCommandSide_UpdateOrgGitLabSelfHostedIDP(t *testing.T) { func TestCommandSide_AddOrgGoogleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -3773,7 +3774,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3790,7 +3791,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) { { "invalid clientSecret", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -3809,7 +3810,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGoogleIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3846,7 +3847,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewGoogleIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -3896,7 +3897,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -3917,7 +3918,7 @@ func TestCommandSide_AddOrgGoogleIDP(t *testing.T) { func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -3939,7 +3940,7 @@ func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -3955,7 +3956,7 @@ func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -3972,7 +3973,7 @@ func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -3991,7 +3992,7 @@ func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGoogleIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -4025,7 +4026,7 @@ func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewGoogleIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -4094,7 +4095,7 @@ func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgGoogleProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -4113,7 +4114,7 @@ func TestCommandSide_UpdateOrgGoogleIDP(t *testing.T) { func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -4136,7 +4137,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4153,7 +4154,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { "invalid baseDN", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4172,7 +4173,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { "invalid binddn", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4192,7 +4193,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { "invalid password", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4213,7 +4214,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { "invalid userbase", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4235,7 +4236,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { "invalid servers", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4258,7 +4259,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { "invalid userObjectClasses", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4282,7 +4283,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { "invalid userFilters", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4307,7 +4308,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewLDAPIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -4359,7 +4360,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewLDAPIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -4452,7 +4453,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -4473,7 +4474,7 @@ func TestCommandSide_AddOrgLDAPIDP(t *testing.T) { func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -4495,7 +4496,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -4511,7 +4512,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -4528,7 +4529,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { "invalid baseDN", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -4547,7 +4548,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { "invalid binddn", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -4567,7 +4568,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { "invalid userbase", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -4588,7 +4589,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { "invalid servers", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -4610,7 +4611,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { "invalid userObjectClasses", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -4633,7 +4634,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { "invalid userFilters", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -4657,7 +4658,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -4685,7 +4686,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewLDAPIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -4733,7 +4734,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewLDAPIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -4853,7 +4854,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgLDAPProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -4872,7 +4873,7 @@ func TestCommandSide_UpdateOrgLDAPIDP(t *testing.T) { func TestCommandSide_AddOrgAppleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm } @@ -4895,7 +4896,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4912,7 +4913,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) { { "invalid teamID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4931,7 +4932,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) { { "invalid keyID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4951,7 +4952,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) { { "invalid privateKey", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -4972,7 +4973,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewAppleIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5013,7 +5014,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewAppleIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5067,7 +5068,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, } @@ -5088,7 +5089,7 @@ func TestCommandSide_AddOrgAppleIDP(t *testing.T) { func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -5110,7 +5111,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -5126,7 +5127,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { { "invalid clientID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -5143,7 +5144,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { { "invalid teamID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -5162,7 +5163,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { { "invalid keyID", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -5182,7 +5183,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -5203,7 +5204,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewAppleIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5241,7 +5242,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewAppleIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5316,7 +5317,7 @@ func TestCommandSide_UpdateOrgAppleIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgAppleProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -5339,7 +5340,7 @@ func stringPointer(s string) *string { func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore idGenerator id.Generator secretCrypto crypto.EncryptionAlgorithm certificateAndKeyGenerator func(id string) ([]byte, []byte, error) @@ -5363,7 +5364,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -5380,7 +5381,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { { "invalid metadata", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "id1"), }, args{ @@ -5399,7 +5400,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { { name: "ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewSAMLIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5415,6 +5416,8 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { []byte("certificate"), "", false, + nil, + "", idp.Options{}, ), ), @@ -5438,7 +5441,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { { name: "ok all set", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), expectPush( org.NewSAMLIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5454,6 +5457,8 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { []byte("certificate"), "binding", true, + gu.Ptr(domain.SAMLNameIDFormatTransient), + "customAttribute", idp.Options{ IsCreationAllowed: true, IsLinkingAllowed: true, @@ -5471,10 +5476,12 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { ctx: context.Background(), resourceOwner: "org1", provider: SAMLProvider{ - Name: "name", - Metadata: []byte("metadata"), - Binding: "binding", - WithSignedRequest: true, + Name: "name", + Metadata: []byte("metadata"), + Binding: "binding", + WithSignedRequest: true, + NameIDFormat: gu.Ptr(domain.SAMLNameIDFormatTransient), + TransientMappingAttributeName: "customAttribute", IDPOptions: idp.Options{ IsCreationAllowed: true, IsLinkingAllowed: true, @@ -5492,7 +5499,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idGenerator: tt.fields.idGenerator, idpConfigEncryption: tt.fields.secretCrypto, samlCertificateAndKeyGenerator: tt.fields.certificateAndKeyGenerator, @@ -5514,7 +5521,7 @@ func TestCommandSide_AddOrgSAMLIDP(t *testing.T) { func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm } type args struct { @@ -5536,7 +5543,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -5552,7 +5559,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { { "invalid name", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -5569,7 +5576,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { { "invalid metadata", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -5588,7 +5595,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -5610,7 +5617,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { { name: "no changes", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewSAMLIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5626,6 +5633,8 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { []byte("certificate"), "", false, + nil, + "", idp.Options{}, )), ), @@ -5647,7 +5656,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewSAMLIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5663,6 +5672,8 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { []byte("certificate"), "binding", false, + gu.Ptr(domain.SAMLNameIDFormatUnspecified), + "", idp.Options{}, )), ), @@ -5676,6 +5687,8 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { idp.ChangeSAMLMetadata([]byte("new metadata")), idp.ChangeSAMLBinding("new binding"), idp.ChangeSAMLWithSignedRequest(true), + idp.ChangeSAMLNameIDFormat(gu.Ptr(domain.SAMLNameIDFormatTransient)), + idp.ChangeSAMLTransientMappingAttributeName("customAttribute"), idp.ChangeSAMLOptions(idp.OptionChanges{ IsCreationAllowed: &t, IsLinkingAllowed: &t, @@ -5695,10 +5708,12 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { resourceOwner: "org1", id: "id1", provider: SAMLProvider{ - Name: "new name", - Metadata: []byte("new metadata"), - Binding: "new binding", - WithSignedRequest: true, + Name: "new name", + Metadata: []byte("new metadata"), + Binding: "new binding", + WithSignedRequest: true, + NameIDFormat: gu.Ptr(domain.SAMLNameIDFormatTransient), + TransientMappingAttributeName: "customAttribute", IDPOptions: idp.Options{ IsCreationAllowed: true, IsLinkingAllowed: true, @@ -5715,7 +5730,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, } got, err := c.UpdateOrgSAMLProvider(tt.args.ctx, tt.args.resourceOwner, tt.args.id, tt.args.provider) @@ -5734,7 +5749,7 @@ func TestCommandSide_UpdateOrgSAMLIDP(t *testing.T) { func TestCommandSide_RegenerateOrgSAMLProviderCertificate(t *testing.T) { type fields struct { - eventstore *eventstore.Eventstore + eventstore func(*testing.T) *eventstore.Eventstore secretCrypto crypto.EncryptionAlgorithm certificateAndKeyGenerator func(id string) ([]byte, []byte, error) } @@ -5756,7 +5771,7 @@ func TestCommandSide_RegenerateOrgSAMLProviderCertificate(t *testing.T) { { "invalid id", fields{ - eventstore: eventstoreExpect(t), + eventstore: expectEventstore(), }, args{ ctx: context.Background(), @@ -5771,7 +5786,7 @@ func TestCommandSide_RegenerateOrgSAMLProviderCertificate(t *testing.T) { { name: "not found", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter(), ), }, @@ -5789,7 +5804,7 @@ func TestCommandSide_RegenerateOrgSAMLProviderCertificate(t *testing.T) { { name: "change ok", fields: fields{ - eventstore: eventstoreExpect(t, + eventstore: expectEventstore( expectFilter( eventFromEventPusher( org.NewSAMLIDPAddedEvent(context.Background(), &org.NewAggregate("org1").Aggregate, @@ -5805,6 +5820,8 @@ func TestCommandSide_RegenerateOrgSAMLProviderCertificate(t *testing.T) { []byte("certificate"), "binding", false, + gu.Ptr(domain.SAMLNameIDFormatUnspecified), + "", idp.Options{}, )), ), @@ -5844,7 +5861,7 @@ func TestCommandSide_RegenerateOrgSAMLProviderCertificate(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &Commands{ - eventstore: tt.fields.eventstore, + eventstore: tt.fields.eventstore(t), idpConfigEncryption: tt.fields.secretCrypto, samlCertificateAndKeyGenerator: tt.fields.certificateAndKeyGenerator, } diff --git a/internal/domain/idp.go b/internal/domain/idp.go index 3df11fa0d7..e2571f6b0d 100644 --- a/internal/domain/idp.go +++ b/internal/domain/idp.go @@ -134,3 +134,12 @@ const ( AutoLinkingOptionUsername AutoLinkingOptionEmail ) + +type SAMLNameIDFormat uint8 + +const ( + SAMLNameIDFormatUnspecified SAMLNameIDFormat = iota + SAMLNameIDFormatEmailAddress + SAMLNameIDFormatPersistent + SAMLNameIDFormatTransient +) diff --git a/internal/idp/providers/saml/mapper.go b/internal/idp/providers/saml/mapper.go index 506d9b3a03..eef16dfbb5 100644 --- a/internal/idp/providers/saml/mapper.go +++ b/internal/idp/providers/saml/mapper.go @@ -1,7 +1,6 @@ package saml import ( - "github.com/crewjam/saml" "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/domain" @@ -20,8 +19,8 @@ func NewUser() *UserMapper { return &UserMapper{Attributes: map[string][]string{}} } -func (u *UserMapper) SetID(id *saml.NameID) { - u.ID = id.Value +func (u *UserMapper) SetID(id string) { + u.ID = id } // GetID is an implementation of the [idp.User] interface. diff --git a/internal/idp/providers/saml/saml.go b/internal/idp/providers/saml/saml.go index fc08f6e808..702e1481e3 100644 --- a/internal/idp/providers/saml/saml.go +++ b/internal/idp/providers/saml/saml.go @@ -11,6 +11,7 @@ import ( "github.com/crewjam/saml" "github.com/crewjam/saml/samlsp" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/idp" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -26,7 +27,9 @@ type Provider struct { spOptions *samlsp.Options - binding string + binding string + nameIDFormat saml.NameIDFormat + transientMappingAttributeName string isLinkingAllowed bool isCreationAllowed bool @@ -77,6 +80,18 @@ func WithBinding(binding string) ProviderOpts { } } +func WithNameIDFormat(format domain.SAMLNameIDFormat) ProviderOpts { + return func(p *Provider) { + p.nameIDFormat = nameIDFormatFromDomain(format) + } +} + +func WithTransientMappingAttributeName(attribute string) ProviderOpts { + return func(p *Provider) { + p.transientMappingAttributeName = attribute + } +} + func WithCustomRequestTracker(tracker samlsp.RequestTracker) ProviderOpts { return func(p *Provider) { p.requestTracker = tracker @@ -124,6 +139,8 @@ func New( name: name, spOptions: &opts, Certificate: certificate, + // the library uses transient as default, which does not make sense for federating accounts + nameIDFormat: saml.PersistentNameIDFormat, } for _, option := range options { option(provider) @@ -156,10 +173,7 @@ func (p *Provider) GetSP() (*samlsp.Middleware, error) { if err != nil { return nil, zerrors.ThrowInternal(err, "SAML-qee09ffuq5", "Errors.Intent.IDPInvalid") } - // the library uses transient as default, which we currently can't handle (https://github.com/zitadel/zitadel/discussions/7421) - // for the moment we'll use persistent (for those who actually use it from the saml request) and add an option - // later on to specify on the provider: https://github.com/zitadel/zitadel/issues/7743 - sp.ServiceProvider.AuthnNameIDFormat = saml.PersistentNameIDFormat + sp.ServiceProvider.AuthnNameIDFormat = p.nameIDFormat if p.requestTracker != nil { sp.RequestTracker = p.requestTracker } @@ -180,3 +194,22 @@ func (p *Provider) BeginAuth(ctx context.Context, state string, _ ...idp.Paramet state: state, }, nil } + +func (p *Provider) TransientMappingAttributeName() string { + return p.transientMappingAttributeName +} + +func nameIDFormatFromDomain(format domain.SAMLNameIDFormat) saml.NameIDFormat { + switch format { + case domain.SAMLNameIDFormatUnspecified: + return saml.UnspecifiedNameIDFormat + case domain.SAMLNameIDFormatEmailAddress: + return saml.EmailAddressNameIDFormat + case domain.SAMLNameIDFormatPersistent: + return saml.PersistentNameIDFormat + case domain.SAMLNameIDFormatTransient: + return saml.TransientNameIDFormat + default: + return saml.UnspecifiedNameIDFormat + } +} diff --git a/internal/idp/providers/saml/saml_test.go b/internal/idp/providers/saml/saml_test.go index 28dc921681..dc8e8e2115 100644 --- a/internal/idp/providers/saml/saml_test.go +++ b/internal/idp/providers/saml/saml_test.go @@ -3,10 +3,12 @@ package saml import ( "testing" + "github.com/crewjam/saml" "github.com/crewjam/saml/samlsp" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/idp/providers/saml/requesttracker" ) @@ -20,16 +22,18 @@ func TestProvider_Options(t *testing.T) { options []ProviderOpts } type want struct { - err bool - name string - linkingAllowed bool - creationAllowed bool - autoCreation bool - autoUpdate bool - binding string - withSignedRequest bool - requesttracker samlsp.RequestTracker - entityID string + err bool + name string + linkingAllowed bool + creationAllowed bool + autoCreation bool + autoUpdate bool + binding string + nameIDFormat saml.NameIDFormat + transientMappingAttributeName string + withSignedRequest bool + requesttracker samlsp.RequestTracker + entityID string } tests := []struct { name string @@ -103,10 +107,11 @@ func TestProvider_Options(t *testing.T) { creationAllowed: false, autoCreation: false, autoUpdate: false, + nameIDFormat: saml.PersistentNameIDFormat, }, }, { - name: "all true", + name: "all set / true", fields: fields{ name: "saml", key: []byte("-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAxHd087RoEm9ywVWZ/H+tDWxQsmVvhfRz4jAq/RfU+OWXNH4J\njMMSHdFs0Q+WP98nNXRyc7fgbMb8NdmlB2yD4qLYapN5SDaBc5dh/3EnyFt53oSs\njTlKnQUPAeJr2qh/NY046CfyUyQMM4JR5OiQFo4TssfWnqdcgamGt0AEnk2lvbMZ\nKQdAqNS9lDzYbjMGavEQPTZE35mFXFQXjaooZXq+TIa7hbaq7/idH7cHNbLcPLgj\nfPQA8q+DYvnvhXlmq0LPQZH3Oiixf+SF2vRwrBzT2mqGD2OiOkUmhuPwyqEiiBHt\nfxklRtRU6WfLa1Gcb1PsV0uoBGpV3KybIl/GlwIDAQABAoIBAEQjDduLgOCL6Gem\n0X3hpdnW6/HC/jed/Sa//9jBECq2LYeWAqff64ON40hqOHi0YvvGA/+gEOSI6mWe\nsv5tIxxRz+6+cLybsq+tG96kluCE4TJMHy/nY7orS/YiWbd+4odnEApr+D3fbZ/b\nnZ1fDsHTyn8hkYx6jLmnWsJpIHDp7zxD76y7k2Bbg6DZrCGiVxngiLJk23dvz79W\np03lHLM7XE92aFwXQmhfxHGxrbuoB/9eY4ai5IHp36H4fw0vL6NXdNQAo/bhe0p9\nAYB7y0ZumF8Hg0Z/BmMeEzLy6HrYB+VE8cO93pNjhSyH+p2yDB/BlUyTiRLQAoM0\nVTmOZXECgYEA7NGlzpKNhyQEJihVqt0MW0LhKIO/xbBn+XgYfX6GpqPa/ucnMx5/\nVezpl3gK8IU4wPUhAyXXAHJiqNBcEeyxrw0MXLujDVMJgYaLysCLJdvMVgoY08mS\nK5IQivpbozpf4+0y3mOnA+Sy1kbfxv2X8xiWLODRQW3f3q/xoklwOR8CgYEA1GEe\nfaibOFTQAYcIVj77KXtBfYZsX3EGAyfAN9O7cKHq5oaxVstwnF47WxpuVtoKZxCZ\nbNm9D5WvQ9b+Ztpioe42tzwE7Bff/Osj868GcDdRPK7nFlh9N2yVn/D514dOYVwR\n4MBr1KrJzgRWt4QqS4H+to1GzudDTSNlG7gnK4kCgYBUi6AbOHzoYzZL/RhgcJwp\ntJ23nhmH1Su5h2OO4e3mbhcP66w19sxU+8iFN+kH5zfUw26utgKk+TE5vXExQQRK\nT2k7bg2PAzcgk80ybD0BHhA8I0yrx4m0nmfjhe/TPVLgh10iwgbtP+eM0i6v1vc5\nZWyvxu9N4ZEL6lpkqr0y1wKBgG/NAIQd8jhhTW7Aav8cAJQBsqQl038avJOEpYe+\nCnpsgoAAf/K0/f8TDCQVceh+t+MxtdK7fO9rWOxZjWsPo8Si5mLnUaAHoX4/OpnZ\nlYYVWMqdOEFnK+O1Yb7k2GFBdV2DXlX2dc1qavntBsls5ecB89id3pyk2aUN8Pf6\npYQhAoGAMGtrHFely9wyaxI0RTCyfmJbWZHGVGkv6ELK8wneJjdjl82XOBUGCg5q\naRCrTZ3dPitKwrUa6ibJCIFCIziiriBmjDvTHzkMvoJEap2TVxYNDR6IfINVsQ57\nlOsiC4A2uGq4Lbfld+gjoplJ5GX6qXtTgZ6m7eo0y7U6zm2tkN0=\n-----END RSA PRIVATE KEY-----\n"), @@ -121,18 +126,22 @@ func TestProvider_Options(t *testing.T) { WithSignedRequest(), WithCustomRequestTracker(&requesttracker.RequestTracker{}), WithEntityID("entityID"), + WithNameIDFormat(domain.SAMLNameIDFormatTransient), + WithTransientMappingAttributeName("attribute"), }, }, want: want{ - name: "saml", - linkingAllowed: true, - creationAllowed: true, - autoCreation: true, - autoUpdate: true, - binding: "binding", - withSignedRequest: true, - requesttracker: &requesttracker.RequestTracker{}, - entityID: "entityID", + name: "saml", + linkingAllowed: true, + creationAllowed: true, + autoCreation: true, + autoUpdate: true, + binding: "binding", + entityID: "entityID", + nameIDFormat: saml.TransientNameIDFormat, + transientMappingAttributeName: "attribute", + withSignedRequest: true, + requesttracker: &requesttracker.RequestTracker{}, }, }, } @@ -152,6 +161,8 @@ func TestProvider_Options(t *testing.T) { a.Equal(tt.want.autoCreation, provider.IsAutoCreation()) a.Equal(tt.want.autoUpdate, provider.IsAutoUpdate()) a.Equal(tt.want.binding, provider.binding) + a.Equal(tt.want.nameIDFormat, provider.nameIDFormat) + a.Equal(tt.want.transientMappingAttributeName, provider.transientMappingAttributeName) a.Equal(tt.want.withSignedRequest, provider.spOptions.SignRequest) a.Equal(tt.want.requesttracker, provider.requestTracker) a.Equal(tt.want.entityID, provider.spOptions.EntityID) diff --git a/internal/idp/providers/saml/session.go b/internal/idp/providers/saml/session.go index af5ec0caf7..577e6a7649 100644 --- a/internal/idp/providers/saml/session.go +++ b/internal/idp/providers/saml/session.go @@ -17,8 +17,9 @@ var _ idp.Session = (*Session)(nil) // Session is the [idp.Session] implementation for the SAML provider. type Session struct { - ServiceProvider *samlsp.Middleware - state string + ServiceProvider *samlsp.Middleware + state string + TransientMappingAttributeName string RequestID string Request *http.Request @@ -26,6 +27,19 @@ type Session struct { Assertion *saml.Assertion } +func NewSession(provider *Provider, requestID string, request *http.Request) (*Session, error) { + sp, err := provider.GetSP() + if err != nil { + return nil, err + } + return &Session{ + ServiceProvider: sp, + TransientMappingAttributeName: provider.TransientMappingAttributeName(), + RequestID: requestID, + Request: request, + }, nil +} + // GetAuth implements the [idp.Session] interface. func (s *Session) GetAuth(ctx context.Context) (string, bool) { url, _ := url.Parse(s.state) @@ -56,8 +70,17 @@ func (s *Session) FetchUser(ctx context.Context) (user idp.User, err error) { return nil, zerrors.ThrowInvalidArgument(err, "SAML-nuo0vphhh9", "Errors.Intent.ResponseInvalid") } + nameID := s.Assertion.Subject.NameID userMapper := NewUser() - userMapper.SetID(s.Assertion.Subject.NameID) + // use the nameID as default mapping id + userMapper.SetID(nameID.Value) + if nameID.Format == string(saml.TransientNameIDFormat) { + mappingID, err := s.transientMappingID() + if err != nil { + return nil, err + } + userMapper.SetID(mappingID) + } for _, statement := range s.Assertion.AttributeStatements { for _, attribute := range statement.Attributes { values := make([]string, len(attribute.Values)) @@ -70,6 +93,21 @@ func (s *Session) FetchUser(ctx context.Context) (user idp.User, err error) { return userMapper, nil } +func (s *Session) transientMappingID() (string, error) { + for _, statement := range s.Assertion.AttributeStatements { + for _, attribute := range statement.Attributes { + if attribute.Name != s.TransientMappingAttributeName { + continue + } + if len(attribute.Values) != 1 { + return "", zerrors.ThrowInvalidArgument(nil, "SAML-Soij4", "Errors.Intent.MissingSingleMappingAttribute") + } + return attribute.Values[0].Value, nil + } + } + return "", zerrors.ThrowInvalidArgument(nil, "SAML-swwg2", "Errors.Intent.MissingSingleMappingAttribute") +} + type TempResponseWriter struct { header http.Header content *bytes.Buffer diff --git a/internal/idp/providers/saml/session_test.go b/internal/idp/providers/saml/session_test.go index 3ab33a8558..f162234385 100644 --- a/internal/idp/providers/saml/session_test.go +++ b/internal/idp/providers/saml/session_test.go @@ -27,7 +27,6 @@ func TestSession_FetchUser(t *testing.T) { options []ProviderOpts } type args struct { - intentID string requestID string request *http.Request } @@ -143,6 +142,7 @@ func TestSession_FetchUser(t *testing.T) { WithBinding(saml.HTTPRedirectBinding), WithSignedRequest(), WithCustomRequestTracker(&requesttracker.RequestTracker{}), + WithTransientMappingAttributeName("urn:oid:1.3.6.1.4.1.5923.1.1.1.6"), }, rootURL: "http://localhost:8080/idps/228968792372281708/", }, @@ -166,6 +166,76 @@ func TestSession_FetchUser(t *testing.T) { }, }, }, + { + name: "post with user param (transient with custom mapping)", + fields: fields{ + name: "saml", + key: []byte("-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAxHd087RoEm9ywVWZ/H+tDWxQsmVvhfRz4jAq/RfU+OWXNH4J\njMMSHdFs0Q+WP98nNXRyc7fgbMb8NdmlB2yD4qLYapN5SDaBc5dh/3EnyFt53oSs\njTlKnQUPAeJr2qh/NY046CfyUyQMM4JR5OiQFo4TssfWnqdcgamGt0AEnk2lvbMZ\nKQdAqNS9lDzYbjMGavEQPTZE35mFXFQXjaooZXq+TIa7hbaq7/idH7cHNbLcPLgj\nfPQA8q+DYvnvhXlmq0LPQZH3Oiixf+SF2vRwrBzT2mqGD2OiOkUmhuPwyqEiiBHt\nfxklRtRU6WfLa1Gcb1PsV0uoBGpV3KybIl/GlwIDAQABAoIBAEQjDduLgOCL6Gem\n0X3hpdnW6/HC/jed/Sa//9jBECq2LYeWAqff64ON40hqOHi0YvvGA/+gEOSI6mWe\nsv5tIxxRz+6+cLybsq+tG96kluCE4TJMHy/nY7orS/YiWbd+4odnEApr+D3fbZ/b\nnZ1fDsHTyn8hkYx6jLmnWsJpIHDp7zxD76y7k2Bbg6DZrCGiVxngiLJk23dvz79W\np03lHLM7XE92aFwXQmhfxHGxrbuoB/9eY4ai5IHp36H4fw0vL6NXdNQAo/bhe0p9\nAYB7y0ZumF8Hg0Z/BmMeEzLy6HrYB+VE8cO93pNjhSyH+p2yDB/BlUyTiRLQAoM0\nVTmOZXECgYEA7NGlzpKNhyQEJihVqt0MW0LhKIO/xbBn+XgYfX6GpqPa/ucnMx5/\nVezpl3gK8IU4wPUhAyXXAHJiqNBcEeyxrw0MXLujDVMJgYaLysCLJdvMVgoY08mS\nK5IQivpbozpf4+0y3mOnA+Sy1kbfxv2X8xiWLODRQW3f3q/xoklwOR8CgYEA1GEe\nfaibOFTQAYcIVj77KXtBfYZsX3EGAyfAN9O7cKHq5oaxVstwnF47WxpuVtoKZxCZ\nbNm9D5WvQ9b+Ztpioe42tzwE7Bff/Osj868GcDdRPK7nFlh9N2yVn/D514dOYVwR\n4MBr1KrJzgRWt4QqS4H+to1GzudDTSNlG7gnK4kCgYBUi6AbOHzoYzZL/RhgcJwp\ntJ23nhmH1Su5h2OO4e3mbhcP66w19sxU+8iFN+kH5zfUw26utgKk+TE5vXExQQRK\nT2k7bg2PAzcgk80ybD0BHhA8I0yrx4m0nmfjhe/TPVLgh10iwgbtP+eM0i6v1vc5\nZWyvxu9N4ZEL6lpkqr0y1wKBgG/NAIQd8jhhTW7Aav8cAJQBsqQl038avJOEpYe+\nCnpsgoAAf/K0/f8TDCQVceh+t+MxtdK7fO9rWOxZjWsPo8Si5mLnUaAHoX4/OpnZ\nlYYVWMqdOEFnK+O1Yb7k2GFBdV2DXlX2dc1qavntBsls5ecB89id3pyk2aUN8Pf6\npYQhAoGAMGtrHFely9wyaxI0RTCyfmJbWZHGVGkv6ELK8wneJjdjl82XOBUGCg5q\naRCrTZ3dPitKwrUa6ibJCIFCIziiriBmjDvTHzkMvoJEap2TVxYNDR6IfINVsQ57\nlOsiC4A2uGq4Lbfld+gjoplJ5GX6qXtTgZ6m7eo0y7U6zm2tkN0=\n-----END RSA PRIVATE KEY-----\n"), + certificate: []byte("-----BEGIN CERTIFICATE-----\nMIIC2zCCAcOgAwIBAgIIAy/jm1gAAdEwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UE\nChMHWklUQURFTDAeFw0yMzA4MzAwNzExMTVaFw0yNDA4MjkwNzExMTVaMBIxEDAO\nBgNVBAoTB1pJVEFERUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDE\nd3TztGgSb3LBVZn8f60NbFCyZW+F9HPiMCr9F9T45Zc0fgmMwxId0WzRD5Y/3yc1\ndHJzt+Bsxvw12aUHbIPiothqk3lINoFzl2H/cSfIW3nehKyNOUqdBQ8B4mvaqH81\njTjoJ/JTJAwzglHk6JAWjhOyx9aep1yBqYa3QASeTaW9sxkpB0Co1L2UPNhuMwZq\n8RA9NkTfmYVcVBeNqihler5MhruFtqrv+J0ftwc1stw8uCN89ADyr4Ni+e+FeWar\nQs9Bkfc6KLF/5IXa9HCsHNPaaoYPY6I6RSaG4/DKoSKIEe1/GSVG1FTpZ8trUZxv\nU+xXS6gEalXcrJsiX8aXAgMBAAGjNTAzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCx\n/dRNIj0N/16zJhZR/ahkc2AkvDXYxyr4JRT5wK9GQDNl/oaX3debRuSi/tfaXFIX\naJA6PxM4J49ZaiEpLrKfxMz5kAhjKchCBEMcH3mGt+iNZH7EOyTvHjpGrP2OZrsh\nO17yrvN3HuQxIU6roJlqtZz2iAADsoPtwOO4D7hupm9XTMkSnAmlMWOo/q46Jz89\n1sMxB+dXmH/zV0wgwh0omZfLV0u89mvdq269VhcjNBpBYSnN1ccqYWd5iwziob3I\nvaavGHGfkbvRUn/tKftYuTK30q03R+e9YbmlWZ0v695owh2e/apCzowQsCKfSVC8\nOxVyt5XkHq1tWwVyBmFp\n-----END CERTIFICATE-----\n"), + metadata: []byte("\n \n \n \n \n MIIDBzCCAe+gAwIBAgIJAPr/Mrlc8EGhMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNTEyMjgxOTE5NDVaFw0yNTEyMjUxOTE5NDVaMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANDoWzLos4LWxTn8Gyu2lEbl4WcelUbgLN5zYm4ron8Ahs+rvcsu2zkdD/s6jdGJI8WqJKhYK2u61ygnXgAZqC6ggtFPnBpizcDzjgND2g+aucSoUODHt67f0fQuAmupN/zp5MZysJ6IHLJnYLNpfJYk96lRz9ODnO1Mpqtr9PWxm+pz7nzq5F0vRepkgpcRxv6ufQBjlrFytccyEVdXrvFtkjXcnhVVNSR4kHuOOMS6D7pebSJ1mrCmshbD5SX1jXPBKFPAjozYX6PxqLxUx1Y4faFEf4MBBVcInyB4oURNB2s59hEEi2jq9izNE7EbEK6BY5sEhoCPl9m32zE6ljkCAwEAAaNQME4wHQYDVR0OBBYEFB9ZklC1Ork2zl56zg08ei7ss/+iMB8GA1UdIwQYMBaAFB9ZklC1Ork2zl56zg08ei7ss/+iMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAVoTSQ5pAirw8OR9FZ1bRSuTDhY9uxzl/OL7lUmsv2cMNeCB3BRZqm3mFt+cwN8GsH6f3uvNONIhgFpTGN5LEcXQz89zJEzB+qaHqmbFpHQl/sx2B8ezNgT/882H2IH00dXESEfy/+1gHg2pxjGnhRBN6el/gSaDiySIMKbilDrffuvxiCfbpPN0NRRiPJhd2ay9KuL/RxQRl1gl9cHaWiouWWba1bSBb2ZPhv2rPMUsFo98ntkGCObDX6Y1SpkqmoTbrsbGFsTG2DLxnvr4GdN1BSr0Uu/KV3adj47WkXVPeMYQti/bQmxQB8tRFhrw80qakTLUzreO96WzlBBMtY=\n \n \n \n \n \n \n MIIDBzCCAe+gAwIBAgIJAPr/Mrlc8EGhMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNTEyMjgxOTE5NDVaFw0yNTEyMjUxOTE5NDVaMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANDoWzLos4LWxTn8Gyu2lEbl4WcelUbgLN5zYm4ron8Ahs+rvcsu2zkdD/s6jdGJI8WqJKhYK2u61ygnXgAZqC6ggtFPnBpizcDzjgND2g+aucSoUODHt67f0fQuAmupN/zp5MZysJ6IHLJnYLNpfJYk96lRz9ODnO1Mpqtr9PWxm+pz7nzq5F0vRepkgpcRxv6ufQBjlrFytccyEVdXrvFtkjXcnhVVNSR4kHuOOMS6D7pebSJ1mrCmshbD5SX1jXPBKFPAjozYX6PxqLxUx1Y4faFEf4MBBVcInyB4oURNB2s59hEEi2jq9izNE7EbEK6BY5sEhoCPl9m32zE6ljkCAwEAAaNQME4wHQYDVR0OBBYEFB9ZklC1Ork2zl56zg08ei7ss/+iMB8GA1UdIwQYMBaAFB9ZklC1Ork2zl56zg08ei7ss/+iMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAVoTSQ5pAirw8OR9FZ1bRSuTDhY9uxzl/OL7lUmsv2cMNeCB3BRZqm3mFt+cwN8GsH6f3uvNONIhgFpTGN5LEcXQz89zJEzB+qaHqmbFpHQl/sx2B8ezNgT/882H2IH00dXESEfy/+1gHg2pxjGnhRBN6el/gSaDiySIMKbilDrffuvxiCfbpPN0NRRiPJhd2ay9KuL/RxQRl1gl9cHaWiouWWba1bSBb2ZPhv2rPMUsFo98ntkGCObDX6Y1SpkqmoTbrsbGFsTG2DLxnvr4GdN1BSr0Uu/KV3adj47WkXVPeMYQti/bQmxQB8tRFhrw80qakTLUzreO96WzlBBMtY=\n \n \n \n \n \n \n \n urn:oasis:names:tc:SAML:2.0:nameid-format:transient\n \n \n \n"), + options: []ProviderOpts{ + WithLinkingAllowed(), + WithCreationAllowed(), + WithAutoCreation(), + WithAutoUpdate(), + WithBinding(saml.HTTPRedirectBinding), + WithSignedRequest(), + WithCustomRequestTracker(&requesttracker.RequestTracker{}), + WithTransientMappingAttributeName("urn:oid:0.9.2342.19200300.100.1.1"), + }, + rootURL: "http://localhost:8080/idps/228968792372281708/", + }, + args: args{ + request: httpPostFormRequest(t, + "http://localhost:8080/idps/228968792372281708/saml/acs", + "232881438356144492", + "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnhzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSIgSUQ9ImlkLTA4ZTA3MTFhYzYwZjE2Mzc2MTdhYjZhNDZkZDk0ZTZkMWQ3MDgzMWQiIEluUmVzcG9uc2VUbz0iaWQtYjIyYzkwZGI4OGJmMDFkODJmZmIwYTdiNmZlMjVhYzlmY2IyYzY3OSIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMjMtMDktMjFUMTM6NDk6MjMuOTM4WiIgRGVzdGluYXRpb249Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9pZHBzLzIyODk2ODc5MjM3MjI4MTcwOC9zYW1sL2FjcyI+PHNhbWw6SXNzdWVyIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6ZW50aXR5Ij5odHRwOi8vbG9jYWxob3N0OjgwMDAvbWV0YWRhdGE8L3NhbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQtMDhlMDcxMWFjNjBmMTYzNzYxN2FiNmE0NmRkOTRlNmQxZDcwODMxZCI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiLz48ZHM6RGlnZXN0VmFsdWU+OWF2ektOOWhpazE4ZkFRdnZNZzJBZFoyYm9VPTwvZHM6RGlnZXN0VmFsdWU+PC9kczpSZWZlcmVuY2U+PC9kczpTaWduZWRJbmZvPjxkczpTaWduYXR1cmVWYWx1ZT5VMkFJOFNzMng5TDAwV3RkaVFlbldCSVFCcGJLNnU4ZU9XVGE2WExKR0lWMWg4d3VOdURqM2luVGpMVUhITkNUSHhTdTFXSE9OSW1CL3QwWlE1Z3EvYXlkcVVqaEVkNG50LysyaXBKelZjZHVHUG5nYjlMWjJ5R1Rsd1JiQkcyMzd4eCtlRWhUMUcrTUFGa3BtbnUrei9RN09vUjdQWHVZOWt6NTRCb0tVM1htK1UyWm9GVy9pVjhId01kYTJMajVLT0pjcnppSWVtNHF0dHlIZXBqcjI3NUhPM2hybzgvVW0xMm8wdk10OUhwaHJua0RNVzgzM3Q5c0k2aW5GRndiOUJkdm5ORkVxYkhCZ2RsemR5T0NqaWdreVNlTzZQNzhQQlhUTWlhM3RVaGxEL0dlZ2hmbTJ4NVI1Q2QrOXJ5RktjYlBKLzlUaFhwbTlIYUJ4R1RZNEE9PTwvZHM6U2lnbmF0dXJlVmFsdWU+PGRzOktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJREJ6Q0NBZStnQXdJQkFnSUpBUHIvTXJsYzhFR2hNQTBHQ1NxR1NJYjNEUUVCQlFVQU1Cb3hHREFXQmdOVkJBTU1EM2QzZHk1bGVHRnRjR3hsTG1OdmJUQWVGdzB4TlRFeU1qZ3hPVEU1TkRWYUZ3MHlOVEV5TWpVeE9URTVORFZhTUJveEdEQVdCZ05WQkFNTUQzZDNkeTVsZUdGdGNHeGxMbU52YlRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTkRvV3pMb3M0TFd4VG44R3l1MmxFYmw0V2NlbFViZ0xONXpZbTRyb244QWhzK3J2Y3N1MnprZEQvczZqZEdKSThXcUpLaFlLMnU2MXlnblhnQVpxQzZnZ3RGUG5CcGl6Y0R6amdORDJnK2F1Y1NvVU9ESHQ2N2YwZlF1QW11cE4venA1TVp5c0o2SUhMSm5ZTE5wZkpZazk2bFJ6OU9Ebk8xTXBxdHI5UFd4bStwejduenE1RjB2UmVwa2dwY1J4djZ1ZlFCamxyRnl0Y2N5RVZkWHJ2RnRralhjbmhWVk5TUjRrSHVPT01TNkQ3cGViU0oxbXJDbXNoYkQ1U1gxalhQQktGUEFqb3pZWDZQeHFMeFV4MVk0ZmFGRWY0TUJCVmNJbnlCNG9VUk5CMnM1OWhFRWkyanE5aXpORTdFYkVLNkJZNXNFaG9DUGw5bTMyekU2bGprQ0F3RUFBYU5RTUU0d0hRWURWUjBPQkJZRUZCOVprbEMxT3JrMnpsNTZ6ZzA4ZWk3c3MvK2lNQjhHQTFVZEl3UVlNQmFBRkI5WmtsQzFPcmsyemw1NnpnMDhlaTdzcy8raU1Bd0dBMVVkRXdRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFRkJRQURnZ0VCQUFWb1RTUTVwQWlydzhPUjlGWjFiUlN1VERoWTl1eHpsL09MN2xVbXN2MmNNTmVDQjNCUlpxbTNtRnQrY3dOOEdzSDZmM3V2Tk9OSWhnRnBUR041TEVjWFF6ODl6SkV6QitxYUhxbWJGcEhRbC9zeDJCOGV6TmdULzg4MkgySUgwMGRYRVNFZnkvKzFnSGcycHhqR25oUkJONmVsL2dTYURpeVNJTUtiaWxEcmZmdXZ4aUNmYnBQTjBOUlJpUEpoZDJheTlLdUwvUnhRUmwxZ2w5Y0hhV2lvdVdXYmExYlNCYjJaUGh2MnJQTVVzRm85OG50a0dDT2JEWDZZMVNwa3Ftb1RicnNiR0ZzVEcyREx4bnZyNEdkTjFCU3IwVXUvS1YzYWRqNDdXa1hWUGVNWVF0aS9iUW14UUI4dFJGaHJ3ODBxYWtUTFV6cmVPOTZXemxCQk10WT08L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48c2FtbDpBc3NlcnRpb24geG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9ImlkLTQ1ZTcyMTkyNjU4NmNkZGUzNDQ2NmI0MzQ5NDg4YjA5MDZhNTU3OGIiIElzc3VlSW5zdGFudD0iMjAyMy0wOS0yMVQxMzo0OToyMy45NDFaIiBWZXJzaW9uPSIyLjAiPjxzYW1sOklzc3VlciBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OmVudGl0eSI+aHR0cDovL2xvY2FsaG9zdDo4MDAwL21ldGFkYXRhPC9zYW1sOklzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjcnNhLXNoYTEiLz48ZHM6UmVmZXJlbmNlIFVSST0iI2lkLTQ1ZTcyMTkyNjU4NmNkZGUzNDQ2NmI0MzQ5NDg4YjA5MDZhNTU3OGIiPjxkczpUcmFuc2Zvcm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48L2RzOlRyYW5zZm9ybXM+PGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNzaGExIi8+PGRzOkRpZ2VzdFZhbHVlPmVHeTMzcWpjZjYrT3R4YlVpVm5DUjFNdnlaaz08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+cDBEekU3Q0lTVTVNQjNvclpReGtUWHFsQXJRMjlFb0tXOUZuVWx5aUhYWGtmK2lXNGZ5SW9wYjcrTUk1VUk5TjVTQVdiVzV4U0R3NFJMMWNDaVNxdWJyU29pRi83MXdiM29naWlQOHhyYmJiajY3RHZMcUU3OVJDQXdySDlEU0FlZFlReVBOQ0tFQ0U0L3NvdnFEeUg5OTAwZEI4aTQ3VHdQRkhIclBlWE8wUGVoR0NWNTVEeTZJdC92Ull1VFRqU0tiVTczV014c1A5Mk9yVEdqamN1Smx1bFdSclBxNDk0aEpNMFJxV3gwN2RoWHJEbzlJY1JpK2RCOVhRN3UwbGJicEthQ0p6R2RiUG9JanJ1ZDhaWnh2djdiaDFtV1lEeGFodExvd2I1eGtDWlQrNFMybklrSWgwNEoxUURsZm1WSVdlRWljVW5odXpIcVBkU1RldklnPT08L2RzOlNpZ25hdHVyZVZhbHVlPjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSURCekNDQWUrZ0F3SUJBZ0lKQVByL01ybGM4RUdoTUEwR0NTcUdTSWIzRFFFQkJRVUFNQm94R0RBV0JnTlZCQU1NRDNkM2R5NWxlR0Z0Y0d4bExtTnZiVEFlRncweE5URXlNamd4T1RFNU5EVmFGdzB5TlRFeU1qVXhPVEU1TkRWYU1Cb3hHREFXQmdOVkJBTU1EM2QzZHk1bGVHRnRjR3hsTG1OdmJUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5Eb1d6TG9zNExXeFRuOEd5dTJsRWJsNFdjZWxVYmdMTjV6WW00cm9uOEFocytydmNzdTJ6a2REL3M2amRHSkk4V3FKS2hZSzJ1NjF5Z25YZ0FacUM2Z2d0RlBuQnBpemNEempnTkQyZythdWNTb1VPREh0NjdmMGZRdUFtdXBOL3pwNU1aeXNKNklITEpuWUxOcGZKWWs5NmxSejlPRG5PMU1wcXRyOVBXeG0rcHo3bnpxNUYwdlJlcGtncGNSeHY2dWZRQmpsckZ5dGNjeUVWZFhydkZ0a2pYY25oVlZOU1I0a0h1T09NUzZEN3BlYlNKMW1yQ21zaGJENVNYMWpYUEJLRlBBam96WVg2UHhxTHhVeDFZNGZhRkVmNE1CQlZjSW55QjRvVVJOQjJzNTloRUVpMmpxOWl6TkU3RWJFSzZCWTVzRWhvQ1BsOW0zMnpFNmxqa0NBd0VBQWFOUU1FNHdIUVlEVlIwT0JCWUVGQjlaa2xDMU9yazJ6bDU2emcwOGVpN3NzLytpTUI4R0ExVWRJd1FZTUJhQUZCOVprbEMxT3JrMnpsNTZ6ZzA4ZWk3c3MvK2lNQXdHQTFVZEV3UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUZCUUFEZ2dFQkFBVm9UU1E1cEFpcnc4T1I5RloxYlJTdVREaFk5dXh6bC9PTDdsVW1zdjJjTU5lQ0IzQlJacW0zbUZ0K2N3TjhHc0g2ZjN1dk5PTkloZ0ZwVEdONUxFY1hRejg5ekpFekIrcWFIcW1iRnBIUWwvc3gyQjhlek5nVC84ODJIMklIMDBkWEVTRWZ5LysxZ0hnMnB4akduaFJCTjZlbC9nU2FEaXlTSU1LYmlsRHJmZnV2eGlDZmJwUE4wTlJSaVBKaGQyYXk5S3VML1J4UVJsMWdsOWNIYVdpb3VXV2JhMWJTQmIyWlBodjJyUE1Vc0ZvOThudGtHQ09iRFg2WTFTcGtxbW9UYnJzYkdGc1RHMkRMeG52cjRHZE4xQlNyMFV1L0tWM2FkajQ3V2tYVlBlTVlRdGkvYlFteFFCOHRSRmhydzgwcWFrVExVenJlTzk2V3psQkJNdFk9PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWw6U3ViamVjdD48c2FtbDpOYW1lSUQgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDp0cmFuc2llbnQiIE5hbWVRdWFsaWZpZXI9Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9tZXRhZGF0YSIgU1BOYW1lUXVhbGlmaWVyPSJodHRwOi8vbG9jYWxob3N0OjgwODAvaWRwcy8yMjg5Njg3OTIzNzIyODE3MDgvc2FtbC9tZXRhZGF0YSI+YWxpY2VAZXhhbXBsZS5jb208L3NhbWw6TmFtZUlEPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDpTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBBZGRyZXNzPSJbOjoxXTo1OTMzNCIgSW5SZXNwb25zZVRvPSJpZC1iMjJjOTBkYjg4YmYwMWQ4MmZmYjBhN2I2ZmUyNWFjOWZjYjJjNjc5IiBOb3RPbk9yQWZ0ZXI9IjIwMjMtMDktMjFUMTM6NTA6NTMuOTM4WiIgUmVjaXBpZW50PSJodHRwOi8vbG9jYWxob3N0OjgwODAvaWRwcy8yMjg5Njg3OTIzNzIyODE3MDgvc2FtbC9hY3MiLz48L3NhbWw6U3ViamVjdENvbmZpcm1hdGlvbj48L3NhbWw6U3ViamVjdD48c2FtbDpDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAyMy0wOS0yMVQxMzo0OToxNC4yOThaIiBOb3RPbk9yQWZ0ZXI9IjIwMjMtMDktMjFUMTM6NTA6NDQuMjk4WiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48c2FtbDpBdWRpZW5jZT5odHRwOi8vbG9jYWxob3N0OjgwODAvaWRwcy8yMjg5Njg3OTIzNzIyODE3MDgvc2FtbC9tZXRhZGF0YTwvc2FtbDpBdWRpZW5jZT48L3NhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWw6Q29uZGl0aW9ucz48c2FtbDpBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMjMtMDktMjFUMTM6NDc6MzUuMTAzWiIgU2Vzc2lvbkluZGV4PSI0YzM5YjE5NTQyYzdjZTFjMzllOWMwNWJlMTdhNzJhNmQ4OGU1NWE3ZGFiYWRhZWQ3ODYxMDBiOWUzODBmYTA4Ij48c2FtbDpTdWJqZWN0TG9jYWxpdHkgQWRkcmVzcz0iWzo6MV06NTkzMzQiLz48c2FtbDpBdXRobkNvbnRleHQ+PHNhbWw6QXV0aG5Db250ZXh0Q2xhc3NSZWY+dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmRQcm90ZWN0ZWRUcmFuc3BvcnQ8L3NhbWw6QXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9zYW1sOkF1dGhuQ29udGV4dD48L3NhbWw6QXV0aG5TdGF0ZW1lbnQ+PHNhbWw6QXR0cmlidXRlU3RhdGVtZW50PjxzYW1sOkF0dHJpYnV0ZSBGcmllbmRseU5hbWU9InVpZCIgTmFtZT0idXJuOm9pZDowLjkuMjM0Mi4xOTIwMDMwMC4xMDAuMS4xIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+YWxpY2U8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgRnJpZW5kbHlOYW1lPSJlZHVQZXJzb25QcmluY2lwYWxOYW1lIiBOYW1lPSJ1cm46b2lkOjEuMy42LjEuNC4xLjU5MjMuMS4xLjEuNiIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPmFsaWNlQGV4YW1wbGUuY29tPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIEZyaWVuZGx5TmFtZT0ic24iIE5hbWU9InVybjpvaWQ6Mi41LjQuNCIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPlNtaXRoPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIEZyaWVuZGx5TmFtZT0iZ2l2ZW5OYW1lIiBOYW1lPSJ1cm46b2lkOjIuNS40LjQyIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+QWxpY2U8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgRnJpZW5kbHlOYW1lPSJjbiIgTmFtZT0idXJuOm9pZDoyLjUuNC4zIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+QWxpY2UgU21pdGg8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgRnJpZW5kbHlOYW1lPSJlZHVQZXJzb25BZmZpbGlhdGlvbiIgTmFtZT0idXJuOm9pZDoxLjMuNi4xLjQuMS41OTIzLjEuMS4xLjEiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6c3RyaW5nIj5BZG1pbmlzdHJhdG9yczwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6c3RyaW5nIj5Vc2Vyczwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjwvc2FtbDpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PC9zYW1sOkFzc2VydGlvbj48L3NhbWxwOlJlc3BvbnNlPg==", + ), + requestID: "id-b22c90db88bf01d82ffb0a7b6fe25ac9fcb2c679", + }, + want: want{ + id: "alice", + attributes: map[string][]string{ + "urn:oid:0.9.2342.19200300.100.1.1": {"alice"}, + "urn:oid:1.3.6.1.4.1.5923.1.1.1.6": {"alice@example.com"}, + "urn:oid:2.5.4.4": {"Smith"}, + "urn:oid:2.5.4.42": {"Alice"}, + "urn:oid:2.5.4.3": {"Alice Smith"}, + "urn:oid:1.3.6.1.4.1.5923.1.1.1.1": {"Administrators", "Users"}, + }, + }, + }, + { + name: "post with user param (transient with wrong existing custom mapping)", + fields: fields{ + name: "saml", + key: []byte("-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAxHd087RoEm9ywVWZ/H+tDWxQsmVvhfRz4jAq/RfU+OWXNH4J\njMMSHdFs0Q+WP98nNXRyc7fgbMb8NdmlB2yD4qLYapN5SDaBc5dh/3EnyFt53oSs\njTlKnQUPAeJr2qh/NY046CfyUyQMM4JR5OiQFo4TssfWnqdcgamGt0AEnk2lvbMZ\nKQdAqNS9lDzYbjMGavEQPTZE35mFXFQXjaooZXq+TIa7hbaq7/idH7cHNbLcPLgj\nfPQA8q+DYvnvhXlmq0LPQZH3Oiixf+SF2vRwrBzT2mqGD2OiOkUmhuPwyqEiiBHt\nfxklRtRU6WfLa1Gcb1PsV0uoBGpV3KybIl/GlwIDAQABAoIBAEQjDduLgOCL6Gem\n0X3hpdnW6/HC/jed/Sa//9jBECq2LYeWAqff64ON40hqOHi0YvvGA/+gEOSI6mWe\nsv5tIxxRz+6+cLybsq+tG96kluCE4TJMHy/nY7orS/YiWbd+4odnEApr+D3fbZ/b\nnZ1fDsHTyn8hkYx6jLmnWsJpIHDp7zxD76y7k2Bbg6DZrCGiVxngiLJk23dvz79W\np03lHLM7XE92aFwXQmhfxHGxrbuoB/9eY4ai5IHp36H4fw0vL6NXdNQAo/bhe0p9\nAYB7y0ZumF8Hg0Z/BmMeEzLy6HrYB+VE8cO93pNjhSyH+p2yDB/BlUyTiRLQAoM0\nVTmOZXECgYEA7NGlzpKNhyQEJihVqt0MW0LhKIO/xbBn+XgYfX6GpqPa/ucnMx5/\nVezpl3gK8IU4wPUhAyXXAHJiqNBcEeyxrw0MXLujDVMJgYaLysCLJdvMVgoY08mS\nK5IQivpbozpf4+0y3mOnA+Sy1kbfxv2X8xiWLODRQW3f3q/xoklwOR8CgYEA1GEe\nfaibOFTQAYcIVj77KXtBfYZsX3EGAyfAN9O7cKHq5oaxVstwnF47WxpuVtoKZxCZ\nbNm9D5WvQ9b+Ztpioe42tzwE7Bff/Osj868GcDdRPK7nFlh9N2yVn/D514dOYVwR\n4MBr1KrJzgRWt4QqS4H+to1GzudDTSNlG7gnK4kCgYBUi6AbOHzoYzZL/RhgcJwp\ntJ23nhmH1Su5h2OO4e3mbhcP66w19sxU+8iFN+kH5zfUw26utgKk+TE5vXExQQRK\nT2k7bg2PAzcgk80ybD0BHhA8I0yrx4m0nmfjhe/TPVLgh10iwgbtP+eM0i6v1vc5\nZWyvxu9N4ZEL6lpkqr0y1wKBgG/NAIQd8jhhTW7Aav8cAJQBsqQl038avJOEpYe+\nCnpsgoAAf/K0/f8TDCQVceh+t+MxtdK7fO9rWOxZjWsPo8Si5mLnUaAHoX4/OpnZ\nlYYVWMqdOEFnK+O1Yb7k2GFBdV2DXlX2dc1qavntBsls5ecB89id3pyk2aUN8Pf6\npYQhAoGAMGtrHFely9wyaxI0RTCyfmJbWZHGVGkv6ELK8wneJjdjl82XOBUGCg5q\naRCrTZ3dPitKwrUa6ibJCIFCIziiriBmjDvTHzkMvoJEap2TVxYNDR6IfINVsQ57\nlOsiC4A2uGq4Lbfld+gjoplJ5GX6qXtTgZ6m7eo0y7U6zm2tkN0=\n-----END RSA PRIVATE KEY-----\n"), + certificate: []byte("-----BEGIN CERTIFICATE-----\nMIIC2zCCAcOgAwIBAgIIAy/jm1gAAdEwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UE\nChMHWklUQURFTDAeFw0yMzA4MzAwNzExMTVaFw0yNDA4MjkwNzExMTVaMBIxEDAO\nBgNVBAoTB1pJVEFERUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDE\nd3TztGgSb3LBVZn8f60NbFCyZW+F9HPiMCr9F9T45Zc0fgmMwxId0WzRD5Y/3yc1\ndHJzt+Bsxvw12aUHbIPiothqk3lINoFzl2H/cSfIW3nehKyNOUqdBQ8B4mvaqH81\njTjoJ/JTJAwzglHk6JAWjhOyx9aep1yBqYa3QASeTaW9sxkpB0Co1L2UPNhuMwZq\n8RA9NkTfmYVcVBeNqihler5MhruFtqrv+J0ftwc1stw8uCN89ADyr4Ni+e+FeWar\nQs9Bkfc6KLF/5IXa9HCsHNPaaoYPY6I6RSaG4/DKoSKIEe1/GSVG1FTpZ8trUZxv\nU+xXS6gEalXcrJsiX8aXAgMBAAGjNTAzMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCx\n/dRNIj0N/16zJhZR/ahkc2AkvDXYxyr4JRT5wK9GQDNl/oaX3debRuSi/tfaXFIX\naJA6PxM4J49ZaiEpLrKfxMz5kAhjKchCBEMcH3mGt+iNZH7EOyTvHjpGrP2OZrsh\nO17yrvN3HuQxIU6roJlqtZz2iAADsoPtwOO4D7hupm9XTMkSnAmlMWOo/q46Jz89\n1sMxB+dXmH/zV0wgwh0omZfLV0u89mvdq269VhcjNBpBYSnN1ccqYWd5iwziob3I\nvaavGHGfkbvRUn/tKftYuTK30q03R+e9YbmlWZ0v695owh2e/apCzowQsCKfSVC8\nOxVyt5XkHq1tWwVyBmFp\n-----END CERTIFICATE-----\n"), + metadata: []byte("\n \n \n \n \n MIIDBzCCAe+gAwIBAgIJAPr/Mrlc8EGhMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNTEyMjgxOTE5NDVaFw0yNTEyMjUxOTE5NDVaMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANDoWzLos4LWxTn8Gyu2lEbl4WcelUbgLN5zYm4ron8Ahs+rvcsu2zkdD/s6jdGJI8WqJKhYK2u61ygnXgAZqC6ggtFPnBpizcDzjgND2g+aucSoUODHt67f0fQuAmupN/zp5MZysJ6IHLJnYLNpfJYk96lRz9ODnO1Mpqtr9PWxm+pz7nzq5F0vRepkgpcRxv6ufQBjlrFytccyEVdXrvFtkjXcnhVVNSR4kHuOOMS6D7pebSJ1mrCmshbD5SX1jXPBKFPAjozYX6PxqLxUx1Y4faFEf4MBBVcInyB4oURNB2s59hEEi2jq9izNE7EbEK6BY5sEhoCPl9m32zE6ljkCAwEAAaNQME4wHQYDVR0OBBYEFB9ZklC1Ork2zl56zg08ei7ss/+iMB8GA1UdIwQYMBaAFB9ZklC1Ork2zl56zg08ei7ss/+iMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAVoTSQ5pAirw8OR9FZ1bRSuTDhY9uxzl/OL7lUmsv2cMNeCB3BRZqm3mFt+cwN8GsH6f3uvNONIhgFpTGN5LEcXQz89zJEzB+qaHqmbFpHQl/sx2B8ezNgT/882H2IH00dXESEfy/+1gHg2pxjGnhRBN6el/gSaDiySIMKbilDrffuvxiCfbpPN0NRRiPJhd2ay9KuL/RxQRl1gl9cHaWiouWWba1bSBb2ZPhv2rPMUsFo98ntkGCObDX6Y1SpkqmoTbrsbGFsTG2DLxnvr4GdN1BSr0Uu/KV3adj47WkXVPeMYQti/bQmxQB8tRFhrw80qakTLUzreO96WzlBBMtY=\n \n \n \n \n \n \n MIIDBzCCAe+gAwIBAgIJAPr/Mrlc8EGhMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNTEyMjgxOTE5NDVaFw0yNTEyMjUxOTE5NDVaMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANDoWzLos4LWxTn8Gyu2lEbl4WcelUbgLN5zYm4ron8Ahs+rvcsu2zkdD/s6jdGJI8WqJKhYK2u61ygnXgAZqC6ggtFPnBpizcDzjgND2g+aucSoUODHt67f0fQuAmupN/zp5MZysJ6IHLJnYLNpfJYk96lRz9ODnO1Mpqtr9PWxm+pz7nzq5F0vRepkgpcRxv6ufQBjlrFytccyEVdXrvFtkjXcnhVVNSR4kHuOOMS6D7pebSJ1mrCmshbD5SX1jXPBKFPAjozYX6PxqLxUx1Y4faFEf4MBBVcInyB4oURNB2s59hEEi2jq9izNE7EbEK6BY5sEhoCPl9m32zE6ljkCAwEAAaNQME4wHQYDVR0OBBYEFB9ZklC1Ork2zl56zg08ei7ss/+iMB8GA1UdIwQYMBaAFB9ZklC1Ork2zl56zg08ei7ss/+iMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAVoTSQ5pAirw8OR9FZ1bRSuTDhY9uxzl/OL7lUmsv2cMNeCB3BRZqm3mFt+cwN8GsH6f3uvNONIhgFpTGN5LEcXQz89zJEzB+qaHqmbFpHQl/sx2B8ezNgT/882H2IH00dXESEfy/+1gHg2pxjGnhRBN6el/gSaDiySIMKbilDrffuvxiCfbpPN0NRRiPJhd2ay9KuL/RxQRl1gl9cHaWiouWWba1bSBb2ZPhv2rPMUsFo98ntkGCObDX6Y1SpkqmoTbrsbGFsTG2DLxnvr4GdN1BSr0Uu/KV3adj47WkXVPeMYQti/bQmxQB8tRFhrw80qakTLUzreO96WzlBBMtY=\n \n \n \n \n \n \n \n urn:oasis:names:tc:SAML:2.0:nameid-format:transient\n \n \n \n"), + options: []ProviderOpts{ + WithLinkingAllowed(), + WithCreationAllowed(), + WithAutoCreation(), + WithAutoUpdate(), + WithBinding(saml.HTTPRedirectBinding), + WithSignedRequest(), + WithCustomRequestTracker(&requesttracker.RequestTracker{}), + WithTransientMappingAttributeName("customAttribute"), + }, + rootURL: "http://localhost:8080/idps/228968792372281708/", + }, + args: args{ + request: httpPostFormRequest(t, + "http://localhost:8080/idps/228968792372281708/saml/acs", + "232881438356144492", + "PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnhzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSIgSUQ9ImlkLTA4ZTA3MTFhYzYwZjE2Mzc2MTdhYjZhNDZkZDk0ZTZkMWQ3MDgzMWQiIEluUmVzcG9uc2VUbz0iaWQtYjIyYzkwZGI4OGJmMDFkODJmZmIwYTdiNmZlMjVhYzlmY2IyYzY3OSIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMjMtMDktMjFUMTM6NDk6MjMuOTM4WiIgRGVzdGluYXRpb249Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9pZHBzLzIyODk2ODc5MjM3MjI4MTcwOC9zYW1sL2FjcyI+PHNhbWw6SXNzdWVyIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6ZW50aXR5Ij5odHRwOi8vbG9jYWxob3N0OjgwMDAvbWV0YWRhdGE8L3NhbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPjxkczpSZWZlcmVuY2UgVVJJPSIjaWQtMDhlMDcxMWFjNjBmMTYzNzYxN2FiNmE0NmRkOTRlNmQxZDcwODMxZCI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiLz48ZHM6RGlnZXN0VmFsdWU+OWF2ektOOWhpazE4ZkFRdnZNZzJBZFoyYm9VPTwvZHM6RGlnZXN0VmFsdWU+PC9kczpSZWZlcmVuY2U+PC9kczpTaWduZWRJbmZvPjxkczpTaWduYXR1cmVWYWx1ZT5VMkFJOFNzMng5TDAwV3RkaVFlbldCSVFCcGJLNnU4ZU9XVGE2WExKR0lWMWg4d3VOdURqM2luVGpMVUhITkNUSHhTdTFXSE9OSW1CL3QwWlE1Z3EvYXlkcVVqaEVkNG50LysyaXBKelZjZHVHUG5nYjlMWjJ5R1Rsd1JiQkcyMzd4eCtlRWhUMUcrTUFGa3BtbnUrei9RN09vUjdQWHVZOWt6NTRCb0tVM1htK1UyWm9GVy9pVjhId01kYTJMajVLT0pjcnppSWVtNHF0dHlIZXBqcjI3NUhPM2hybzgvVW0xMm8wdk10OUhwaHJua0RNVzgzM3Q5c0k2aW5GRndiOUJkdm5ORkVxYkhCZ2RsemR5T0NqaWdreVNlTzZQNzhQQlhUTWlhM3RVaGxEL0dlZ2hmbTJ4NVI1Q2QrOXJ5RktjYlBKLzlUaFhwbTlIYUJ4R1RZNEE9PTwvZHM6U2lnbmF0dXJlVmFsdWU+PGRzOktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJREJ6Q0NBZStnQXdJQkFnSUpBUHIvTXJsYzhFR2hNQTBHQ1NxR1NJYjNEUUVCQlFVQU1Cb3hHREFXQmdOVkJBTU1EM2QzZHk1bGVHRnRjR3hsTG1OdmJUQWVGdzB4TlRFeU1qZ3hPVEU1TkRWYUZ3MHlOVEV5TWpVeE9URTVORFZhTUJveEdEQVdCZ05WQkFNTUQzZDNkeTVsZUdGdGNHeGxMbU52YlRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTkRvV3pMb3M0TFd4VG44R3l1MmxFYmw0V2NlbFViZ0xONXpZbTRyb244QWhzK3J2Y3N1MnprZEQvczZqZEdKSThXcUpLaFlLMnU2MXlnblhnQVpxQzZnZ3RGUG5CcGl6Y0R6amdORDJnK2F1Y1NvVU9ESHQ2N2YwZlF1QW11cE4venA1TVp5c0o2SUhMSm5ZTE5wZkpZazk2bFJ6OU9Ebk8xTXBxdHI5UFd4bStwejduenE1RjB2UmVwa2dwY1J4djZ1ZlFCamxyRnl0Y2N5RVZkWHJ2RnRralhjbmhWVk5TUjRrSHVPT01TNkQ3cGViU0oxbXJDbXNoYkQ1U1gxalhQQktGUEFqb3pZWDZQeHFMeFV4MVk0ZmFGRWY0TUJCVmNJbnlCNG9VUk5CMnM1OWhFRWkyanE5aXpORTdFYkVLNkJZNXNFaG9DUGw5bTMyekU2bGprQ0F3RUFBYU5RTUU0d0hRWURWUjBPQkJZRUZCOVprbEMxT3JrMnpsNTZ6ZzA4ZWk3c3MvK2lNQjhHQTFVZEl3UVlNQmFBRkI5WmtsQzFPcmsyemw1NnpnMDhlaTdzcy8raU1Bd0dBMVVkRXdRRk1BTUJBZjh3RFFZSktvWklodmNOQVFFRkJRQURnZ0VCQUFWb1RTUTVwQWlydzhPUjlGWjFiUlN1VERoWTl1eHpsL09MN2xVbXN2MmNNTmVDQjNCUlpxbTNtRnQrY3dOOEdzSDZmM3V2Tk9OSWhnRnBUR041TEVjWFF6ODl6SkV6QitxYUhxbWJGcEhRbC9zeDJCOGV6TmdULzg4MkgySUgwMGRYRVNFZnkvKzFnSGcycHhqR25oUkJONmVsL2dTYURpeVNJTUtiaWxEcmZmdXZ4aUNmYnBQTjBOUlJpUEpoZDJheTlLdUwvUnhRUmwxZ2w5Y0hhV2lvdVdXYmExYlNCYjJaUGh2MnJQTVVzRm85OG50a0dDT2JEWDZZMVNwa3Ftb1RicnNiR0ZzVEcyREx4bnZyNEdkTjFCU3IwVXUvS1YzYWRqNDdXa1hWUGVNWVF0aS9iUW14UUI4dFJGaHJ3ODBxYWtUTFV6cmVPOTZXemxCQk10WT08L2RzOlg1MDlDZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25hdHVyZT48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48c2FtbDpBc3NlcnRpb24geG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9ImlkLTQ1ZTcyMTkyNjU4NmNkZGUzNDQ2NmI0MzQ5NDg4YjA5MDZhNTU3OGIiIElzc3VlSW5zdGFudD0iMjAyMy0wOS0yMVQxMzo0OToyMy45NDFaIiBWZXJzaW9uPSIyLjAiPjxzYW1sOklzc3VlciBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OmVudGl0eSI+aHR0cDovL2xvY2FsaG9zdDo4MDAwL21ldGFkYXRhPC9zYW1sOklzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjcnNhLXNoYTEiLz48ZHM6UmVmZXJlbmNlIFVSST0iI2lkLTQ1ZTcyMTkyNjU4NmNkZGUzNDQ2NmI0MzQ5NDg4YjA5MDZhNTU3OGIiPjxkczpUcmFuc2Zvcm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48L2RzOlRyYW5zZm9ybXM+PGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNzaGExIi8+PGRzOkRpZ2VzdFZhbHVlPmVHeTMzcWpjZjYrT3R4YlVpVm5DUjFNdnlaaz08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+cDBEekU3Q0lTVTVNQjNvclpReGtUWHFsQXJRMjlFb0tXOUZuVWx5aUhYWGtmK2lXNGZ5SW9wYjcrTUk1VUk5TjVTQVdiVzV4U0R3NFJMMWNDaVNxdWJyU29pRi83MXdiM29naWlQOHhyYmJiajY3RHZMcUU3OVJDQXdySDlEU0FlZFlReVBOQ0tFQ0U0L3NvdnFEeUg5OTAwZEI4aTQ3VHdQRkhIclBlWE8wUGVoR0NWNTVEeTZJdC92Ull1VFRqU0tiVTczV014c1A5Mk9yVEdqamN1Smx1bFdSclBxNDk0aEpNMFJxV3gwN2RoWHJEbzlJY1JpK2RCOVhRN3UwbGJicEthQ0p6R2RiUG9JanJ1ZDhaWnh2djdiaDFtV1lEeGFodExvd2I1eGtDWlQrNFMybklrSWgwNEoxUURsZm1WSVdlRWljVW5odXpIcVBkU1RldklnPT08L2RzOlNpZ25hdHVyZVZhbHVlPjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSURCekNDQWUrZ0F3SUJBZ0lKQVByL01ybGM4RUdoTUEwR0NTcUdTSWIzRFFFQkJRVUFNQm94R0RBV0JnTlZCQU1NRDNkM2R5NWxlR0Z0Y0d4bExtTnZiVEFlRncweE5URXlNamd4T1RFNU5EVmFGdzB5TlRFeU1qVXhPVEU1TkRWYU1Cb3hHREFXQmdOVkJBTU1EM2QzZHk1bGVHRnRjR3hsTG1OdmJUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5Eb1d6TG9zNExXeFRuOEd5dTJsRWJsNFdjZWxVYmdMTjV6WW00cm9uOEFocytydmNzdTJ6a2REL3M2amRHSkk4V3FKS2hZSzJ1NjF5Z25YZ0FacUM2Z2d0RlBuQnBpemNEempnTkQyZythdWNTb1VPREh0NjdmMGZRdUFtdXBOL3pwNU1aeXNKNklITEpuWUxOcGZKWWs5NmxSejlPRG5PMU1wcXRyOVBXeG0rcHo3bnpxNUYwdlJlcGtncGNSeHY2dWZRQmpsckZ5dGNjeUVWZFhydkZ0a2pYY25oVlZOU1I0a0h1T09NUzZEN3BlYlNKMW1yQ21zaGJENVNYMWpYUEJLRlBBam96WVg2UHhxTHhVeDFZNGZhRkVmNE1CQlZjSW55QjRvVVJOQjJzNTloRUVpMmpxOWl6TkU3RWJFSzZCWTVzRWhvQ1BsOW0zMnpFNmxqa0NBd0VBQWFOUU1FNHdIUVlEVlIwT0JCWUVGQjlaa2xDMU9yazJ6bDU2emcwOGVpN3NzLytpTUI4R0ExVWRJd1FZTUJhQUZCOVprbEMxT3JrMnpsNTZ6ZzA4ZWk3c3MvK2lNQXdHQTFVZEV3UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUZCUUFEZ2dFQkFBVm9UU1E1cEFpcnc4T1I5RloxYlJTdVREaFk5dXh6bC9PTDdsVW1zdjJjTU5lQ0IzQlJacW0zbUZ0K2N3TjhHc0g2ZjN1dk5PTkloZ0ZwVEdONUxFY1hRejg5ekpFekIrcWFIcW1iRnBIUWwvc3gyQjhlek5nVC84ODJIMklIMDBkWEVTRWZ5LysxZ0hnMnB4akduaFJCTjZlbC9nU2FEaXlTSU1LYmlsRHJmZnV2eGlDZmJwUE4wTlJSaVBKaGQyYXk5S3VML1J4UVJsMWdsOWNIYVdpb3VXV2JhMWJTQmIyWlBodjJyUE1Vc0ZvOThudGtHQ09iRFg2WTFTcGtxbW9UYnJzYkdGc1RHMkRMeG52cjRHZE4xQlNyMFV1L0tWM2FkajQ3V2tYVlBlTVlRdGkvYlFteFFCOHRSRmhydzgwcWFrVExVenJlTzk2V3psQkJNdFk9PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWw6U3ViamVjdD48c2FtbDpOYW1lSUQgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDp0cmFuc2llbnQiIE5hbWVRdWFsaWZpZXI9Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9tZXRhZGF0YSIgU1BOYW1lUXVhbGlmaWVyPSJodHRwOi8vbG9jYWxob3N0OjgwODAvaWRwcy8yMjg5Njg3OTIzNzIyODE3MDgvc2FtbC9tZXRhZGF0YSI+YWxpY2VAZXhhbXBsZS5jb208L3NhbWw6TmFtZUlEPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDpTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBBZGRyZXNzPSJbOjoxXTo1OTMzNCIgSW5SZXNwb25zZVRvPSJpZC1iMjJjOTBkYjg4YmYwMWQ4MmZmYjBhN2I2ZmUyNWFjOWZjYjJjNjc5IiBOb3RPbk9yQWZ0ZXI9IjIwMjMtMDktMjFUMTM6NTA6NTMuOTM4WiIgUmVjaXBpZW50PSJodHRwOi8vbG9jYWxob3N0OjgwODAvaWRwcy8yMjg5Njg3OTIzNzIyODE3MDgvc2FtbC9hY3MiLz48L3NhbWw6U3ViamVjdENvbmZpcm1hdGlvbj48L3NhbWw6U3ViamVjdD48c2FtbDpDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAyMy0wOS0yMVQxMzo0OToxNC4yOThaIiBOb3RPbk9yQWZ0ZXI9IjIwMjMtMDktMjFUMTM6NTA6NDQuMjk4WiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48c2FtbDpBdWRpZW5jZT5odHRwOi8vbG9jYWxob3N0OjgwODAvaWRwcy8yMjg5Njg3OTIzNzIyODE3MDgvc2FtbC9tZXRhZGF0YTwvc2FtbDpBdWRpZW5jZT48L3NhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWw6Q29uZGl0aW9ucz48c2FtbDpBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMjMtMDktMjFUMTM6NDc6MzUuMTAzWiIgU2Vzc2lvbkluZGV4PSI0YzM5YjE5NTQyYzdjZTFjMzllOWMwNWJlMTdhNzJhNmQ4OGU1NWE3ZGFiYWRhZWQ3ODYxMDBiOWUzODBmYTA4Ij48c2FtbDpTdWJqZWN0TG9jYWxpdHkgQWRkcmVzcz0iWzo6MV06NTkzMzQiLz48c2FtbDpBdXRobkNvbnRleHQ+PHNhbWw6QXV0aG5Db250ZXh0Q2xhc3NSZWY+dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmRQcm90ZWN0ZWRUcmFuc3BvcnQ8L3NhbWw6QXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9zYW1sOkF1dGhuQ29udGV4dD48L3NhbWw6QXV0aG5TdGF0ZW1lbnQ+PHNhbWw6QXR0cmlidXRlU3RhdGVtZW50PjxzYW1sOkF0dHJpYnV0ZSBGcmllbmRseU5hbWU9InVpZCIgTmFtZT0idXJuOm9pZDowLjkuMjM0Mi4xOTIwMDMwMC4xMDAuMS4xIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+YWxpY2U8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgRnJpZW5kbHlOYW1lPSJlZHVQZXJzb25QcmluY2lwYWxOYW1lIiBOYW1lPSJ1cm46b2lkOjEuMy42LjEuNC4xLjU5MjMuMS4xLjEuNiIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPmFsaWNlQGV4YW1wbGUuY29tPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIEZyaWVuZGx5TmFtZT0ic24iIE5hbWU9InVybjpvaWQ6Mi41LjQuNCIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhzaTp0eXBlPSJ4czpzdHJpbmciPlNtaXRoPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIEZyaWVuZGx5TmFtZT0iZ2l2ZW5OYW1lIiBOYW1lPSJ1cm46b2lkOjIuNS40LjQyIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+QWxpY2U8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgRnJpZW5kbHlOYW1lPSJjbiIgTmFtZT0idXJuOm9pZDoyLjUuNC4zIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOnN0cmluZyI+QWxpY2UgU21pdGg8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgRnJpZW5kbHlOYW1lPSJlZHVQZXJzb25BZmZpbGlhdGlvbiIgTmFtZT0idXJuOm9pZDoxLjMuNi4xLjQuMS41OTIzLjEuMS4xLjEiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6c3RyaW5nIj5BZG1pbmlzdHJhdG9yczwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6c3RyaW5nIj5Vc2Vyczwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjwvc2FtbDpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PC9zYW1sOkFzc2VydGlvbj48L3NhbWxwOlJlc3BvbnNlPg==", + ), + requestID: "id-b22c90db88bf01d82ffb0a7b6fe25ac9fcb2c679", + }, + want: want{ + err: zerrors.ThrowInvalidArgument(nil, "SAML-swwg2", "Errors.Intent.MissingSingleMappingAttribute"), + }, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { @@ -174,15 +244,9 @@ func TestSession_FetchUser(t *testing.T) { provider, err := New(tt.fields.name, tt.fields.rootURL, tt.fields.metadata, tt.fields.certificate, tt.fields.key, tt.fields.options...) require.NoError(t, err) - sp, err := provider.GetSP() + session, err := NewSession(provider, tt.args.requestID, tt.args.request) require.NoError(t, err) - session := &Session{ - ServiceProvider: sp, - state: tt.args.intentID, - RequestID: tt.args.requestID, - Request: tt.args.request, - } // set to time of response for validation saml.TimeNow = func() time.Time { time, _ := time.Parse(time.RFC3339, "2023-09-21T13:47:40.0Z") diff --git a/internal/integration/client.go b/internal/integration/client.go index 21410bec92..72f50e9988 100644 --- a/internal/integration/client.go +++ b/internal/integration/client.go @@ -380,12 +380,13 @@ func (s *Tester) AddSAMLProvider(t *testing.T, ctx context.Context) string { return id } -func (s *Tester) AddSAMLRedirectProvider(t *testing.T, ctx context.Context) string { +func (s *Tester) AddSAMLRedirectProvider(t *testing.T, ctx context.Context, transientMappingAttributeName string) string { ctx = authz.WithInstance(ctx, s.Instance) id, _, err := s.Server.Commands.AddInstanceSAMLProvider(ctx, command.SAMLProvider{ - Name: "saml-idp-redirect", - Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", - Metadata: []byte("\n \n \n \n \n MIIDBzCCAe+gAwIBAgIJAPr/Mrlc8EGhMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNTEyMjgxOTE5NDVaFw0yNTEyMjUxOTE5NDVaMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANDoWzLos4LWxTn8Gyu2lEbl4WcelUbgLN5zYm4ron8Ahs+rvcsu2zkdD/s6jdGJI8WqJKhYK2u61ygnXgAZqC6ggtFPnBpizcDzjgND2g+aucSoUODHt67f0fQuAmupN/zp5MZysJ6IHLJnYLNpfJYk96lRz9ODnO1Mpqtr9PWxm+pz7nzq5F0vRepkgpcRxv6ufQBjlrFytccyEVdXrvFtkjXcnhVVNSR4kHuOOMS6D7pebSJ1mrCmshbD5SX1jXPBKFPAjozYX6PxqLxUx1Y4faFEf4MBBVcInyB4oURNB2s59hEEi2jq9izNE7EbEK6BY5sEhoCPl9m32zE6ljkCAwEAAaNQME4wHQYDVR0OBBYEFB9ZklC1Ork2zl56zg08ei7ss/+iMB8GA1UdIwQYMBaAFB9ZklC1Ork2zl56zg08ei7ss/+iMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAVoTSQ5pAirw8OR9FZ1bRSuTDhY9uxzl/OL7lUmsv2cMNeCB3BRZqm3mFt+cwN8GsH6f3uvNONIhgFpTGN5LEcXQz89zJEzB+qaHqmbFpHQl/sx2B8ezNgT/882H2IH00dXESEfy/+1gHg2pxjGnhRBN6el/gSaDiySIMKbilDrffuvxiCfbpPN0NRRiPJhd2ay9KuL/RxQRl1gl9cHaWiouWWba1bSBb2ZPhv2rPMUsFo98ntkGCObDX6Y1SpkqmoTbrsbGFsTG2DLxnvr4GdN1BSr0Uu/KV3adj47WkXVPeMYQti/bQmxQB8tRFhrw80qakTLUzreO96WzlBBMtY=\n \n \n \n \n \n \n MIIDBzCCAe+gAwIBAgIJAPr/Mrlc8EGhMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNTEyMjgxOTE5NDVaFw0yNTEyMjUxOTE5NDVaMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANDoWzLos4LWxTn8Gyu2lEbl4WcelUbgLN5zYm4ron8Ahs+rvcsu2zkdD/s6jdGJI8WqJKhYK2u61ygnXgAZqC6ggtFPnBpizcDzjgND2g+aucSoUODHt67f0fQuAmupN/zp5MZysJ6IHLJnYLNpfJYk96lRz9ODnO1Mpqtr9PWxm+pz7nzq5F0vRepkgpcRxv6ufQBjlrFytccyEVdXrvFtkjXcnhVVNSR4kHuOOMS6D7pebSJ1mrCmshbD5SX1jXPBKFPAjozYX6PxqLxUx1Y4faFEf4MBBVcInyB4oURNB2s59hEEi2jq9izNE7EbEK6BY5sEhoCPl9m32zE6ljkCAwEAAaNQME4wHQYDVR0OBBYEFB9ZklC1Ork2zl56zg08ei7ss/+iMB8GA1UdIwQYMBaAFB9ZklC1Ork2zl56zg08ei7ss/+iMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAVoTSQ5pAirw8OR9FZ1bRSuTDhY9uxzl/OL7lUmsv2cMNeCB3BRZqm3mFt+cwN8GsH6f3uvNONIhgFpTGN5LEcXQz89zJEzB+qaHqmbFpHQl/sx2B8ezNgT/882H2IH00dXESEfy/+1gHg2pxjGnhRBN6el/gSaDiySIMKbilDrffuvxiCfbpPN0NRRiPJhd2ay9KuL/RxQRl1gl9cHaWiouWWba1bSBb2ZPhv2rPMUsFo98ntkGCObDX6Y1SpkqmoTbrsbGFsTG2DLxnvr4GdN1BSr0Uu/KV3adj47WkXVPeMYQti/bQmxQB8tRFhrw80qakTLUzreO96WzlBBMtY=\n \n \n \n \n \n \n \n urn:oasis:names:tc:SAML:2.0:nameid-format:transient\n \n \n"), + Name: "saml-idp-redirect", + Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", + Metadata: []byte("\n \n \n \n \n MIIDBzCCAe+gAwIBAgIJAPr/Mrlc8EGhMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNTEyMjgxOTE5NDVaFw0yNTEyMjUxOTE5NDVaMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANDoWzLos4LWxTn8Gyu2lEbl4WcelUbgLN5zYm4ron8Ahs+rvcsu2zkdD/s6jdGJI8WqJKhYK2u61ygnXgAZqC6ggtFPnBpizcDzjgND2g+aucSoUODHt67f0fQuAmupN/zp5MZysJ6IHLJnYLNpfJYk96lRz9ODnO1Mpqtr9PWxm+pz7nzq5F0vRepkgpcRxv6ufQBjlrFytccyEVdXrvFtkjXcnhVVNSR4kHuOOMS6D7pebSJ1mrCmshbD5SX1jXPBKFPAjozYX6PxqLxUx1Y4faFEf4MBBVcInyB4oURNB2s59hEEi2jq9izNE7EbEK6BY5sEhoCPl9m32zE6ljkCAwEAAaNQME4wHQYDVR0OBBYEFB9ZklC1Ork2zl56zg08ei7ss/+iMB8GA1UdIwQYMBaAFB9ZklC1Ork2zl56zg08ei7ss/+iMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAVoTSQ5pAirw8OR9FZ1bRSuTDhY9uxzl/OL7lUmsv2cMNeCB3BRZqm3mFt+cwN8GsH6f3uvNONIhgFpTGN5LEcXQz89zJEzB+qaHqmbFpHQl/sx2B8ezNgT/882H2IH00dXESEfy/+1gHg2pxjGnhRBN6el/gSaDiySIMKbilDrffuvxiCfbpPN0NRRiPJhd2ay9KuL/RxQRl1gl9cHaWiouWWba1bSBb2ZPhv2rPMUsFo98ntkGCObDX6Y1SpkqmoTbrsbGFsTG2DLxnvr4GdN1BSr0Uu/KV3adj47WkXVPeMYQti/bQmxQB8tRFhrw80qakTLUzreO96WzlBBMtY=\n \n \n \n \n \n \n MIIDBzCCAe+gAwIBAgIJAPr/Mrlc8EGhMA0GCSqGSIb3DQEBBQUAMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNTEyMjgxOTE5NDVaFw0yNTEyMjUxOTE5NDVaMBoxGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANDoWzLos4LWxTn8Gyu2lEbl4WcelUbgLN5zYm4ron8Ahs+rvcsu2zkdD/s6jdGJI8WqJKhYK2u61ygnXgAZqC6ggtFPnBpizcDzjgND2g+aucSoUODHt67f0fQuAmupN/zp5MZysJ6IHLJnYLNpfJYk96lRz9ODnO1Mpqtr9PWxm+pz7nzq5F0vRepkgpcRxv6ufQBjlrFytccyEVdXrvFtkjXcnhVVNSR4kHuOOMS6D7pebSJ1mrCmshbD5SX1jXPBKFPAjozYX6PxqLxUx1Y4faFEf4MBBVcInyB4oURNB2s59hEEi2jq9izNE7EbEK6BY5sEhoCPl9m32zE6ljkCAwEAAaNQME4wHQYDVR0OBBYEFB9ZklC1Ork2zl56zg08ei7ss/+iMB8GA1UdIwQYMBaAFB9ZklC1Ork2zl56zg08ei7ss/+iMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAVoTSQ5pAirw8OR9FZ1bRSuTDhY9uxzl/OL7lUmsv2cMNeCB3BRZqm3mFt+cwN8GsH6f3uvNONIhgFpTGN5LEcXQz89zJEzB+qaHqmbFpHQl/sx2B8ezNgT/882H2IH00dXESEfy/+1gHg2pxjGnhRBN6el/gSaDiySIMKbilDrffuvxiCfbpPN0NRRiPJhd2ay9KuL/RxQRl1gl9cHaWiouWWba1bSBb2ZPhv2rPMUsFo98ntkGCObDX6Y1SpkqmoTbrsbGFsTG2DLxnvr4GdN1BSr0Uu/KV3adj47WkXVPeMYQti/bQmxQB8tRFhrw80qakTLUzreO96WzlBBMtY=\n \n \n \n \n \n \n \n urn:oasis:names:tc:SAML:2.0:nameid-format:transient\n \n \n"), + TransientMappingAttributeName: transientMappingAttributeName, IDPOptions: idp.Options{ IsLinkingAllowed: true, IsCreationAllowed: true, diff --git a/internal/query/idp_template.go b/internal/query/idp_template.go index 361389f995..2b835f0e69 100644 --- a/internal/query/idp_template.go +++ b/internal/query/idp_template.go @@ -155,12 +155,14 @@ type AppleIDPTemplate struct { } type SAMLIDPTemplate struct { - IDPID string - Metadata []byte - Key *crypto.CryptoValue - Certificate []byte - Binding string - WithSignedRequest bool + IDPID string + Metadata []byte + Key *crypto.CryptoValue + Certificate []byte + Binding string + WithSignedRequest bool + NameIDFormat sql.Null[domain.SAMLNameIDFormat] + TransientMappingAttributeName string } var ( @@ -700,6 +702,14 @@ var ( name: projection.SAMLWithSignedRequestCol, table: samlIdpTemplateTable, } + SAMLNameIDFormatCol = Column{ + name: projection.SAMLNameIDFormatCol, + table: samlIdpTemplateTable, + } + SAMLTransientMappingAttributeNameCol = Column{ + name: projection.SAMLTransientMappingAttributeName, + table: samlIdpTemplateTable, + } ) // IDPTemplateByID searches for the requested id @@ -883,6 +893,8 @@ func prepareIDPTemplateByIDQuery(ctx context.Context, db prepareDatabase) (sq.Se SAMLCertificateCol.identifier(), SAMLBindingCol.identifier(), SAMLWithSignedRequestCol.identifier(), + SAMLNameIDFormatCol.identifier(), + SAMLTransientMappingAttributeNameCol.identifier(), // ldap LDAPIDCol.identifier(), LDAPServersCol.identifier(), @@ -997,6 +1009,8 @@ func prepareIDPTemplateByIDQuery(ctx context.Context, db prepareDatabase) (sq.Se var samlCertificate []byte samlBinding := sql.NullString{} samlWithSignedRequest := sql.NullBool{} + samlNameIDFormat := sql.Null[domain.SAMLNameIDFormat]{} + samlTransientMappingAttributeName := sql.NullString{} ldapID := sql.NullString{} ldapServers := database.TextArray[string]{} @@ -1109,6 +1123,8 @@ func prepareIDPTemplateByIDQuery(ctx context.Context, db prepareDatabase) (sq.Se &samlCertificate, &samlBinding, &samlWithSignedRequest, + &samlNameIDFormat, + &samlTransientMappingAttributeName, // ldap &ldapID, &ldapServers, @@ -1237,12 +1253,14 @@ func prepareIDPTemplateByIDQuery(ctx context.Context, db prepareDatabase) (sq.Se } if samlID.Valid { idpTemplate.SAMLIDPTemplate = &SAMLIDPTemplate{ - IDPID: samlID.String, - Metadata: samlMetadata, - Key: samlKey, - Certificate: samlCertificate, - Binding: samlBinding.String, - WithSignedRequest: samlWithSignedRequest.Bool, + IDPID: samlID.String, + Metadata: samlMetadata, + Key: samlKey, + Certificate: samlCertificate, + Binding: samlBinding.String, + WithSignedRequest: samlWithSignedRequest.Bool, + NameIDFormat: samlNameIDFormat, + TransientMappingAttributeName: samlTransientMappingAttributeName.String, } } if ldapID.Valid { @@ -1370,6 +1388,8 @@ func prepareIDPTemplatesQuery(ctx context.Context, db prepareDatabase) (sq.Selec SAMLCertificateCol.identifier(), SAMLBindingCol.identifier(), SAMLWithSignedRequestCol.identifier(), + SAMLNameIDFormatCol.identifier(), + SAMLTransientMappingAttributeNameCol.identifier(), // ldap LDAPIDCol.identifier(), LDAPServersCol.identifier(), @@ -1489,6 +1509,8 @@ func prepareIDPTemplatesQuery(ctx context.Context, db prepareDatabase) (sq.Selec var samlCertificate []byte samlBinding := sql.NullString{} samlWithSignedRequest := sql.NullBool{} + samlNameIDFormat := sql.Null[domain.SAMLNameIDFormat]{} + samlTransientMappingAttributeName := sql.NullString{} ldapID := sql.NullString{} ldapServers := database.TextArray[string]{} @@ -1601,6 +1623,8 @@ func prepareIDPTemplatesQuery(ctx context.Context, db prepareDatabase) (sq.Selec &samlCertificate, &samlBinding, &samlWithSignedRequest, + &samlNameIDFormat, + &samlTransientMappingAttributeName, // ldap &ldapID, &ldapServers, @@ -1728,12 +1752,14 @@ func prepareIDPTemplatesQuery(ctx context.Context, db prepareDatabase) (sq.Selec } if samlID.Valid { idpTemplate.SAMLIDPTemplate = &SAMLIDPTemplate{ - IDPID: samlID.String, - Metadata: samlMetadata, - Key: samlKey, - Certificate: samlCertificate, - Binding: samlBinding.String, - WithSignedRequest: samlWithSignedRequest.Bool, + IDPID: samlID.String, + Metadata: samlMetadata, + Key: samlKey, + Certificate: samlCertificate, + Binding: samlBinding.String, + WithSignedRequest: samlWithSignedRequest.Bool, + NameIDFormat: samlNameIDFormat, + TransientMappingAttributeName: samlTransientMappingAttributeName.String, } } if ldapID.Valid { diff --git a/internal/query/idp_template_test.go b/internal/query/idp_template_test.go index 72e5d9f8c8..c5bee3a000 100644 --- a/internal/query/idp_template_test.go +++ b/internal/query/idp_template_test.go @@ -95,6 +95,8 @@ var ( ` projections.idp_templates6_saml.certificate,` + ` projections.idp_templates6_saml.binding,` + ` projections.idp_templates6_saml.with_signed_request,` + + ` projections.idp_templates6_saml.name_id_format,` + + ` projections.idp_templates6_saml.transient_mapping_attribute_name,` + // ldap ` projections.idp_templates6_ldap2.idp_id,` + ` projections.idp_templates6_ldap2.servers,` + @@ -220,6 +222,8 @@ var ( "certificate", "binding", "with_signed_request", + "name_id_format", + "transient_mapping_attribute_name", // ldap config "idp_id", "servers", @@ -331,6 +335,8 @@ var ( ` projections.idp_templates6_saml.certificate,` + ` projections.idp_templates6_saml.binding,` + ` projections.idp_templates6_saml.with_signed_request,` + + ` projections.idp_templates6_saml.name_id_format,` + + ` projections.idp_templates6_saml.transient_mapping_attribute_name,` + // ldap ` projections.idp_templates6_ldap2.idp_id,` + ` projections.idp_templates6_ldap2.servers,` + @@ -457,6 +463,8 @@ var ( "certificate", "binding", "with_signed_request", + "name_id_format", + "transient_mapping_attribute_name", // ldap config "idp_id", "servers", @@ -608,6 +616,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -756,6 +766,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -902,6 +914,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -1047,6 +1061,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -1191,6 +1207,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -1335,6 +1353,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -1480,6 +1500,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -1624,6 +1646,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, "binding", false, + domain.SAMLNameIDFormatTransient, + "customAttribute", // ldap config nil, nil, @@ -1674,12 +1698,14 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { IsAutoUpdate: true, AutoLinking: domain.AutoLinkingOptionUsername, SAMLIDPTemplate: &SAMLIDPTemplate{ - IDPID: "idp-id", - Metadata: []byte("metadata"), - Key: nil, - Certificate: nil, - Binding: "binding", - WithSignedRequest: false, + IDPID: "idp-id", + Metadata: []byte("metadata"), + Key: nil, + Certificate: nil, + Binding: "binding", + WithSignedRequest: false, + NameIDFormat: sql.Null[domain.SAMLNameIDFormat]{V: domain.SAMLNameIDFormatTransient, Valid: true}, + TransientMappingAttributeName: "customAttribute", }, }, }, @@ -1770,6 +1796,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config "idp-id", database.TextArray[string]{"server"}, @@ -1934,6 +1962,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -2080,6 +2110,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -2254,6 +2286,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config "idp-id", database.TextArray[string]{"server"}, @@ -2427,6 +2461,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -2574,6 +2610,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config "idp-id-ldap", database.TextArray[string]{"server"}, @@ -2686,6 +2724,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, "binding", false, + domain.SAMLNameIDFormatTransient, + "customAttribute", // ldap config nil, nil, @@ -2798,6 +2838,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -2910,6 +2952,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -3022,6 +3066,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -3134,6 +3180,8 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { nil, nil, nil, + nil, + nil, // ldap config nil, nil, @@ -3232,12 +3280,14 @@ func Test_IDPTemplateTemplatesPrepares(t *testing.T) { IsAutoUpdate: true, AutoLinking: domain.AutoLinkingOptionUsername, SAMLIDPTemplate: &SAMLIDPTemplate{ - IDPID: "idp-id-saml", - Metadata: []byte("metadata"), - Key: nil, - Certificate: nil, - Binding: "binding", - WithSignedRequest: false, + IDPID: "idp-id-saml", + Metadata: []byte("metadata"), + Key: nil, + Certificate: nil, + Binding: "binding", + WithSignedRequest: false, + NameIDFormat: sql.Null[domain.SAMLNameIDFormat]{V: domain.SAMLNameIDFormatTransient, Valid: true}, + TransientMappingAttributeName: "customAttribute", }, }, { diff --git a/internal/query/projection/idp_template.go b/internal/query/projection/idp_template.go index 1ecd9d654f..a9d38cfebb 100644 --- a/internal/query/projection/idp_template.go +++ b/internal/query/projection/idp_template.go @@ -161,13 +161,15 @@ const ( ApplePrivateKeyCol = "private_key" AppleScopesCol = "scopes" - SAMLIDCol = "idp_id" - SAMLInstanceIDCol = "instance_id" - SAMLMetadataCol = "metadata" - SAMLKeyCol = "key" - SAMLCertificateCol = "certificate" - SAMLBindingCol = "binding" - SAMLWithSignedRequestCol = "with_signed_request" + SAMLIDCol = "idp_id" + SAMLInstanceIDCol = "instance_id" + SAMLMetadataCol = "metadata" + SAMLKeyCol = "key" + SAMLCertificateCol = "certificate" + SAMLBindingCol = "binding" + SAMLWithSignedRequestCol = "with_signed_request" + SAMLNameIDFormatCol = "name_id_format" + SAMLTransientMappingAttributeName = "transient_mapping_attribute_name" ) type idpTemplateProjection struct{} @@ -367,6 +369,8 @@ func (*idpTemplateProjection) Init() *old_handler.Check { handler.NewColumn(SAMLCertificateCol, handler.ColumnTypeBytes), handler.NewColumn(SAMLBindingCol, handler.ColumnTypeText, handler.Nullable()), handler.NewColumn(SAMLWithSignedRequestCol, handler.ColumnTypeBool, handler.Nullable()), + handler.NewColumn(SAMLNameIDFormatCol, handler.ColumnTypeEnum, handler.Nullable()), + handler.NewColumn(SAMLTransientMappingAttributeName, handler.ColumnTypeText, handler.Nullable()), }, handler.NewPrimaryKey(SAMLInstanceIDCol, SAMLIDCol), IDPTemplateSAMLSuffix, @@ -1967,6 +1971,20 @@ func (p *idpTemplateProjection) reduceSAMLIDPAdded(event eventstore.Event) (*han return nil, zerrors.ThrowInvalidArgumentf(nil, "HANDL-9s02m1", "reduce.wrong.event.type %v", []eventstore.EventType{org.SAMLIDPAddedEventType, instance.SAMLIDPAddedEventType}) } + columns := []handler.Column{ + handler.NewCol(SAMLIDCol, idpEvent.ID), + handler.NewCol(SAMLInstanceIDCol, idpEvent.Aggregate().InstanceID), + handler.NewCol(SAMLMetadataCol, idpEvent.Metadata), + handler.NewCol(SAMLKeyCol, idpEvent.Key), + handler.NewCol(SAMLCertificateCol, idpEvent.Certificate), + handler.NewCol(SAMLBindingCol, idpEvent.Binding), + handler.NewCol(SAMLWithSignedRequestCol, idpEvent.WithSignedRequest), + handler.NewCol(SAMLTransientMappingAttributeName, idpEvent.TransientMappingAttributeName), + } + if idpEvent.NameIDFormat != nil { + columns = append(columns, handler.NewCol(SAMLNameIDFormatCol, *idpEvent.NameIDFormat)) + } + return handler.NewMultiStatement( &idpEvent, handler.AddCreateStatement( @@ -1989,15 +2007,7 @@ func (p *idpTemplateProjection) reduceSAMLIDPAdded(event eventstore.Event) (*han }, ), handler.AddCreateStatement( - []handler.Column{ - handler.NewCol(SAMLIDCol, idpEvent.ID), - handler.NewCol(SAMLInstanceIDCol, idpEvent.Aggregate().InstanceID), - handler.NewCol(SAMLMetadataCol, idpEvent.Metadata), - handler.NewCol(SAMLKeyCol, idpEvent.Key), - handler.NewCol(SAMLCertificateCol, idpEvent.Certificate), - handler.NewCol(SAMLBindingCol, idpEvent.Binding), - handler.NewCol(SAMLWithSignedRequestCol, idpEvent.WithSignedRequest), - }, + columns, handler.WithTableSuffix(IDPTemplateSAMLSuffix), ), ), nil @@ -2490,5 +2500,11 @@ func reduceSAMLIDPChangedColumns(idpEvent idp.SAMLIDPChangedEvent) []handler.Col if idpEvent.WithSignedRequest != nil { SAMLCols = append(SAMLCols, handler.NewCol(SAMLWithSignedRequestCol, *idpEvent.WithSignedRequest)) } + if idpEvent.NameIDFormat != nil { + SAMLCols = append(SAMLCols, handler.NewCol(SAMLNameIDFormatCol, *idpEvent.NameIDFormat)) + } + if idpEvent.TransientMappingAttributeName != nil { + SAMLCols = append(SAMLCols, handler.NewCol(SAMLTransientMappingAttributeName, *idpEvent.TransientMappingAttributeName)) + } return SAMLCols } diff --git a/internal/query/projection/idp_template_test.go b/internal/query/projection/idp_template_test.go index d463054af7..6f096a94ce 100644 --- a/internal/query/projection/idp_template_test.go +++ b/internal/query/projection/idp_template_test.go @@ -2774,6 +2774,8 @@ func TestIDPTemplateProjection_reducesSAML(t *testing.T) { }, "certificate": `+stringToJSONByte("certificate")+`, "binding": "binding", + "nameIDFormat": 3, + "transientMappingAttributeName": "customAttribute", "withSignedRequest": true, "isCreationAllowed": true, "isLinkingAllowed": true, @@ -2810,7 +2812,7 @@ func TestIDPTemplateProjection_reducesSAML(t *testing.T) { }, }, { - expectedStmt: "INSERT INTO projections.idp_templates6_saml (idp_id, instance_id, metadata, key, certificate, binding, with_signed_request) VALUES ($1, $2, $3, $4, $5, $6, $7)", + expectedStmt: "INSERT INTO projections.idp_templates6_saml (idp_id, instance_id, metadata, key, certificate, binding, with_signed_request, transient_mapping_attribute_name, name_id_format) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)", expectedArgs: []interface{}{ "idp-id", "instance-id", @@ -2819,6 +2821,8 @@ func TestIDPTemplateProjection_reducesSAML(t *testing.T) { anyArg{}, "binding", true, + "customAttribute", + domain.SAMLNameIDFormatTransient, }, }, }, @@ -2842,6 +2846,8 @@ func TestIDPTemplateProjection_reducesSAML(t *testing.T) { }, "certificate": `+stringToJSONByte("certificate")+`, "binding": "binding", + "nameIDFormat": 3, + "transientMappingAttributeName": "customAttribute", "withSignedRequest": true, "isCreationAllowed": true, "isLinkingAllowed": true, @@ -2878,7 +2884,7 @@ func TestIDPTemplateProjection_reducesSAML(t *testing.T) { }, }, { - expectedStmt: "INSERT INTO projections.idp_templates6_saml (idp_id, instance_id, metadata, key, certificate, binding, with_signed_request) VALUES ($1, $2, $3, $4, $5, $6, $7)", + expectedStmt: "INSERT INTO projections.idp_templates6_saml (idp_id, instance_id, metadata, key, certificate, binding, with_signed_request, transient_mapping_attribute_name, name_id_format) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)", expectedArgs: []interface{}{ "idp-id", "instance-id", @@ -2887,6 +2893,8 @@ func TestIDPTemplateProjection_reducesSAML(t *testing.T) { anyArg{}, "binding", true, + "customAttribute", + domain.SAMLNameIDFormatTransient, }, }, }, diff --git a/internal/repository/idp/saml.go b/internal/repository/idp/saml.go index 37534da203..da6a52b1be 100644 --- a/internal/repository/idp/saml.go +++ b/internal/repository/idp/saml.go @@ -2,6 +2,7 @@ package idp import ( "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -9,13 +10,15 @@ import ( type SAMLIDPAddedEvent struct { eventstore.BaseEvent `json:"-"` - ID string `json:"id"` - Name string `json:"name,omitempty"` - Metadata []byte `json:"metadata,omitempty"` - Key *crypto.CryptoValue `json:"key,omitempty"` - Certificate []byte `json:"certificate,omitempty"` - Binding string `json:"binding,omitempty"` - WithSignedRequest bool `json:"withSignedRequest,omitempty"` + ID string `json:"id"` + Name string `json:"name,omitempty"` + Metadata []byte `json:"metadata,omitempty"` + Key *crypto.CryptoValue `json:"key,omitempty"` + Certificate []byte `json:"certificate,omitempty"` + Binding string `json:"binding,omitempty"` + WithSignedRequest bool `json:"withSignedRequest,omitempty"` + NameIDFormat *domain.SAMLNameIDFormat `json:"nameIDFormat,omitempty"` + TransientMappingAttributeName string `json:"transientMappingAttributeName,omitempty"` Options } @@ -28,18 +31,22 @@ func NewSAMLIDPAddedEvent( certificate []byte, binding string, withSignedRequest bool, + nameIDFormat *domain.SAMLNameIDFormat, + transientMappingAttributeName string, options Options, ) *SAMLIDPAddedEvent { return &SAMLIDPAddedEvent{ - BaseEvent: *base, - ID: id, - Name: name, - Metadata: metadata, - Key: key, - Certificate: certificate, - Binding: binding, - WithSignedRequest: withSignedRequest, - Options: options, + BaseEvent: *base, + ID: id, + Name: name, + Metadata: metadata, + Key: key, + Certificate: certificate, + Binding: binding, + WithSignedRequest: withSignedRequest, + NameIDFormat: nameIDFormat, + TransientMappingAttributeName: transientMappingAttributeName, + Options: options, } } @@ -67,13 +74,15 @@ func SAMLIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) { type SAMLIDPChangedEvent struct { eventstore.BaseEvent `json:"-"` - ID string `json:"id"` - Name *string `json:"name,omitempty"` - Metadata []byte `json:"metadata,omitempty"` - Key *crypto.CryptoValue `json:"key,omitempty"` - Certificate []byte `json:"certificate,omitempty"` - Binding *string `json:"binding,omitempty"` - WithSignedRequest *bool `json:"withSignedRequest,omitempty"` + ID string `json:"id"` + Name *string `json:"name,omitempty"` + Metadata []byte `json:"metadata,omitempty"` + Key *crypto.CryptoValue `json:"key,omitempty"` + Certificate []byte `json:"certificate,omitempty"` + Binding *string `json:"binding,omitempty"` + WithSignedRequest *bool `json:"withSignedRequest,omitempty"` + NameIDFormat *domain.SAMLNameIDFormat `json:"nameIDFormat,omitempty"` + TransientMappingAttributeName *string `json:"transientMappingAttributeName,omitempty"` OptionChanges } @@ -133,6 +142,18 @@ func ChangeSAMLWithSignedRequest(withSignedRequest bool) func(*SAMLIDPChangedEve } } +func ChangeSAMLNameIDFormat(nameIDFormat *domain.SAMLNameIDFormat) func(*SAMLIDPChangedEvent) { + return func(e *SAMLIDPChangedEvent) { + e.NameIDFormat = nameIDFormat + } +} + +func ChangeSAMLTransientMappingAttributeName(name string) func(*SAMLIDPChangedEvent) { + return func(e *SAMLIDPChangedEvent) { + e.TransientMappingAttributeName = &name + } +} + func ChangeSAMLOptions(options OptionChanges) func(*SAMLIDPChangedEvent) { return func(e *SAMLIDPChangedEvent) { e.OptionChanges = options diff --git a/internal/repository/instance/idp.go b/internal/repository/instance/idp.go index 3bda1542d0..d2f90ab4eb 100644 --- a/internal/repository/instance/idp.go +++ b/internal/repository/instance/idp.go @@ -5,6 +5,7 @@ import ( "time" "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/idp" ) @@ -1016,6 +1017,8 @@ func NewSAMLIDPAddedEvent( certificate []byte, binding string, withSignedRequest bool, + nameIDFormat *domain.SAMLNameIDFormat, + transientMappingAttributeName string, options idp.Options, ) *SAMLIDPAddedEvent { return &SAMLIDPAddedEvent{ @@ -1032,6 +1035,8 @@ func NewSAMLIDPAddedEvent( certificate, binding, withSignedRequest, + nameIDFormat, + transientMappingAttributeName, options, ), } diff --git a/internal/repository/org/idp.go b/internal/repository/org/idp.go index 5f28d44811..a2bc5c7abd 100644 --- a/internal/repository/org/idp.go +++ b/internal/repository/org/idp.go @@ -5,6 +5,7 @@ import ( "time" "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" "github.com/zitadel/zitadel/internal/repository/idp" ) @@ -1017,6 +1018,8 @@ func NewSAMLIDPAddedEvent( certificate []byte, binding string, withSignedRequest bool, + nameIDFormat *domain.SAMLNameIDFormat, + transientMappingAttributeName string, options idp.Options, ) *SAMLIDPAddedEvent { @@ -1034,6 +1037,8 @@ func NewSAMLIDPAddedEvent( certificate, binding, withSignedRequest, + nameIDFormat, + transientMappingAttributeName, options, ), } diff --git a/internal/static/i18n/bg.yaml b/internal/static/i18n/bg.yaml index 91085035de..175775e73e 100644 --- a/internal/static/i18n/bg.yaml +++ b/internal/static/i18n/bg.yaml @@ -534,6 +534,7 @@ Errors: IDPMissing: IDP липсва в заявката IDPInvalid: IDP невалиден за заявката ResponseInvalid: Отговорът на IDP е невалиден + MissingSingleMappingAttribute: Не съдържа атрибута за съпоставяне или има повече от една стойност SuccessURLMissing: В заявката липсва URL адрес за успех FailureURLMissing: В заявката липсва URL адрес за грешка StateMissing: В заявката липсва параметър състояние diff --git a/internal/static/i18n/cs.yaml b/internal/static/i18n/cs.yaml index 6a375443bb..9f737b8142 100644 --- a/internal/static/i18n/cs.yaml +++ b/internal/static/i18n/cs.yaml @@ -514,6 +514,7 @@ Errors: IDPMissing: V požadavku chybí IDP ID IDPInvalid: IDP je pro požadavek neplatné ResponseInvalid: Odpověď IDP je neplatná + MissingSingleMappingAttribute: Neobsahuje atribut mapování nebo má více než jednu hodnotu SuccessURLMissing: V požadavku chybí úspěšná URL FailureURLMissing: V požadavku chybí URL selhání StateMissing: V požadavku chybí parametr stavu diff --git a/internal/static/i18n/de.yaml b/internal/static/i18n/de.yaml index 0a1aae5d4a..74f159ec28 100644 --- a/internal/static/i18n/de.yaml +++ b/internal/static/i18n/de.yaml @@ -516,6 +516,7 @@ Errors: IDPMissing: IDP ID fehlt im Request IDPInvalid: IDP ungültig für die Anfrage ResponseInvalid: IDP-Antwort ist ungültig + MissingSingleMappingAttribute: Enthält das Zuordnungsattribut nicht oder hat mehr als einen Wert SuccessURLMissing: Success URL fehlt im Request FailureURLMissing: Failure URL fehlt im Request StateMissing: State parameter fehlt im Request diff --git a/internal/static/i18n/en.yaml b/internal/static/i18n/en.yaml index 12a7151c9a..1c3d141088 100644 --- a/internal/static/i18n/en.yaml +++ b/internal/static/i18n/en.yaml @@ -516,6 +516,7 @@ Errors: IDPMissing: IDP ID is missing in the request IDPInvalid: IDP invalid for the request ResponseInvalid: IDP response is invalid + MissingSingleMappingAttribute: IDP response does not contain the mapping attribute or has more than one value SuccessURLMissing: Success URL is missing in the request FailureURLMissing: Failure URL is missing in the request StateMissing: State parameter is missing in the request diff --git a/internal/static/i18n/es.yaml b/internal/static/i18n/es.yaml index 5fc15409bb..3ffb229d7e 100644 --- a/internal/static/i18n/es.yaml +++ b/internal/static/i18n/es.yaml @@ -516,6 +516,7 @@ Errors: IDPMissing: Falta IDP en la solicitud IDPInvalid: IDP no válido para la solicitud ResponseInvalid: La respuesta del IDP no es válida + MissingSingleMappingAttribute: No contiene el atributo de asignación o tiene más de un valor SuccessURLMissing: Falta la URL de éxito en la solicitud FailureURLMissing: Falta la URL de error en la solicitud StateMissing: Falta un parámetro de estado en la solicitud diff --git a/internal/static/i18n/fr.yaml b/internal/static/i18n/fr.yaml index 6d0592111f..41d10dbc28 100644 --- a/internal/static/i18n/fr.yaml +++ b/internal/static/i18n/fr.yaml @@ -516,6 +516,7 @@ Errors: IDPMissing: IDP manquant dans la requête IDPInvalid: IDP non valide pour la demande ResponseInvalid: La réponse de l'IDP n'est pas valide + MissingSingleMappingAttribute: Ne contient pas l'attribut de mappage ou a plus d'une valeur SuccessURLMissing: Success URL absent de la requête FailureURLMissing: Failure URL absent de la requête StateMissing: Paramètre d'état manquant dans la requête diff --git a/internal/static/i18n/it.yaml b/internal/static/i18n/it.yaml index 0a1e8e76aa..9e5541b13e 100644 --- a/internal/static/i18n/it.yaml +++ b/internal/static/i18n/it.yaml @@ -516,6 +516,7 @@ Errors: IDPMissing: IDP mancante nella richiesta IDPInvalid: IDP non valido per la richiesta ResponseInvalid: La risposta dell'IDP non è valida + MissingSingleMappingAttribute: Non contiene l'attributo di mapping o ha più di un valore SuccessURLMissing: URL di successo mancante nella richiesta FailureURLMissing: URL di errore mancante nella richiesta StateMissing: parametro di stato mancante nella richiesta diff --git a/internal/static/i18n/ja.yaml b/internal/static/i18n/ja.yaml index be42786b08..ed922e4814 100644 --- a/internal/static/i18n/ja.yaml +++ b/internal/static/i18n/ja.yaml @@ -505,6 +505,7 @@ Errors: IDPMissing: リクエストにIDP IDが含まれていません IDPInvalid: リクエストのIDPが無効 ResponseInvalid: IDPの回答は無効 + MissingSingleMappingAttribute: マッピング属性が含まれていない、または複数の値がある SuccessURLMissing: リクエストに成功時の URL がありません FailureURLMissing: リクエストに失敗の URL がありません StateMissing: リクエストに State パラメータがありません diff --git a/internal/static/i18n/mk.yaml b/internal/static/i18n/mk.yaml index 826b4cc4e1..db2d29dd1b 100644 --- a/internal/static/i18n/mk.yaml +++ b/internal/static/i18n/mk.yaml @@ -515,6 +515,7 @@ Errors: IDPMissing: ID на IDP недостасува во барањето6bg IDPInvalid: ВРЛ неважечки за барањето ResponseInvalid: Одговорот на ВРЛ е неважечки + MissingSingleMappingAttribute: не го содржи атрибутот за мапирање или има повеќе од една вредност SuccessURLMissing: URL за успех недостасува во барањето FailureURLMissing: URL за неуспех недостасува во барањето StateMissing: Параметарот State недостасува во барањето diff --git a/internal/static/i18n/nl.yaml b/internal/static/i18n/nl.yaml index fa7c202033..3ef228c853 100644 --- a/internal/static/i18n/nl.yaml +++ b/internal/static/i18n/nl.yaml @@ -515,6 +515,7 @@ Errors: IDPMissing: IDP ID ontbreekt in het verzoek IDPInvalid: IDP ongeldig voor het verzoek ResponseInvalid: IDP respons is ongeldig + MissingSingleMappingAttribute: Bevat kenmerk toewijzing niet of heeft meer dan één waarde SuccessURLMissing: Success URL ontbreekt in het verzoek FailureURLMissing: Failure URL ontbreekt in het verzoek StateMissing: Staat parameter ontbreekt in het verzoek diff --git a/internal/static/i18n/pl.yaml b/internal/static/i18n/pl.yaml index 35f73fbec7..69abd71e89 100644 --- a/internal/static/i18n/pl.yaml +++ b/internal/static/i18n/pl.yaml @@ -516,6 +516,7 @@ Errors: IDPMissing: Brak identyfikatora IDP w żądaniu IDPInvalid: IDP nieprawidłowe dla żądania ResponseInvalid: Odpowiedź IDP jest nieprawidłowa + MissingSingleMappingAttribute: Nie zawiera atrybutu mapowania lub ma więcej niż jedną wartość SuccessURLMissing: Brak adresu URL powodzenia w żądaniu FailureURLMissing: Brak adresu URL niepowodzenia w żądaniu StateMissing: Brak parametru stanu w żądaniu diff --git a/internal/static/i18n/pt.yaml b/internal/static/i18n/pt.yaml index a9e3f4c1f6..da5a6a7614 100644 --- a/internal/static/i18n/pt.yaml +++ b/internal/static/i18n/pt.yaml @@ -515,6 +515,7 @@ Errors: IDPMissing: O ID do IDP está faltando na solicitação IDPInvalid: IDP inválido para o pedido ResponseInvalid: A resposta da PDI é inválida + MissingSingleMappingAttribute: Não contém o atributo de mapeamento ou tem mais de um valor SuccessURLMissing: A URL de sucesso está faltando na solicitação FailureURLMissing: A URL de falha está faltando na solicitação StateMissing: O parâmetro de estado está faltando na solicitação diff --git a/internal/static/i18n/ru.yaml b/internal/static/i18n/ru.yaml index 53b95ea362..9be827e3b6 100644 --- a/internal/static/i18n/ru.yaml +++ b/internal/static/i18n/ru.yaml @@ -505,6 +505,7 @@ Errors: NoChallenge: Сеанс без вызова WebAuthN Intent: IDPMissing: В запросе отсутствует идентификатор IDP + MissingSingleMappingAttribute: Не содержит атрибут сопоставления или имеет более одного значения SuccessURLMissing: В запросе отсутствует URL-адрес успешного выполнения FailureURLMissing: В запросе отсутствует URL-адрес ошибки StateMissing: В запросе отсутствует параметр State diff --git a/internal/static/i18n/zh.yaml b/internal/static/i18n/zh.yaml index fd9ed9ed19..409fb9ce71 100644 --- a/internal/static/i18n/zh.yaml +++ b/internal/static/i18n/zh.yaml @@ -516,6 +516,7 @@ Errors: IDPMissing: 请求中缺少IDP ID IDPInvalid: 请求的 IDP 无效 ResponseInvalid: IDP 响应无效 + MissingSingleMappingAttribute: 不包含映射属性或具有多个值 SuccessURLMissing: 请求中缺少成功URL FailureURLMissing: 请求中缺少失败的URL StateMissing: 请求中缺少状态参数 diff --git a/proto/zitadel/admin.proto b/proto/zitadel/admin.proto index 374ad3c88d..e05d74b435 100644 --- a/proto/zitadel/admin.proto +++ b/proto/zitadel/admin.proto @@ -6028,31 +6028,28 @@ message AddSAMLProviderRequest { string name = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; oneof metadata { option (validate.required) = true; + // Metadata of the SAML identity provider. bytes metadata_xml = 2 [ - (validate.rules).bytes.max_len = 500000, - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Metadata of the SAML identity provider"; - } + (validate.rules).bytes.max_len = 500000 ]; + // Url to the metadata of the SAML identity provider. string metadata_url = 3 [ (validate.rules).string.max_len = 200, (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { example: "\"https://test.com/saml/metadata\"" - description: "Url to the metadata of the SAML identity provider"; } ]; } - zitadel.idp.v1.SAMLBinding binding = 4 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Binding which defines the type of communication with the identity provider"; - } - ]; - bool with_signed_request = 5 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Boolean which defines if the authentication requests are signed"; - } - ]; + // Binding which defines the type of communication with the identity provider. + zitadel.idp.v1.SAMLBinding binding = 4; + // Boolean which defines if the authentication requests are signed. + bool with_signed_request = 5; zitadel.idp.v1.Options provider_options = 6; + // Optionally specify the `nameid-format` requested. + optional zitadel.idp.v1.SAMLNameIDFormat name_id_format = 7; + // Optionally specify the name of the attribute, which will be used to map the user + // in case the nameid-format returned is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`. + optional string transient_mapping_attribute_name = 8; } message AddSAMLProviderResponse { @@ -6063,33 +6060,30 @@ message AddSAMLProviderResponse { message UpdateSAMLProviderRequest { string id = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; string name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + // Metadata of the SAML identity provider. oneof metadata { option (validate.required) = true; bytes metadata_xml = 3 [ - (validate.rules).bytes.max_len = 500000, - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Metadata of the SAML identity provider"; - } + (validate.rules).bytes.max_len = 500000 ]; + // Url to the metadata of the SAML identity provider string metadata_url = 4 [ (validate.rules).string.max_len = 200, (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { example: "\"https://test.com/saml/metadata\"" - description: "Url to the metadata of the SAML identity provider"; } ]; } - zitadel.idp.v1.SAMLBinding binding = 5 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Binding which defines the type of communication with the identity provider"; - } - ]; - bool with_signed_request = 6 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Boolean which defines if the authentication requests are signed"; - } - ]; + // Binding which defines the type of communication with the identity provider. + zitadel.idp.v1.SAMLBinding binding = 5; + // Boolean which defines if the authentication requests are signed + bool with_signed_request = 6; zitadel.idp.v1.Options provider_options = 7; + // Optionally specify the `nameid-format` requested. + optional zitadel.idp.v1.SAMLNameIDFormat name_id_format = 8; + // Optionally specify the name of the attribute, which will be used to map the user + // in case the nameid-format returned is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`. + optional string transient_mapping_attribute_name = 9; } message UpdateSAMLProviderResponse { diff --git a/proto/zitadel/idp.proto b/proto/zitadel/idp.proto index 1beab90a5f..2f434f50cc 100644 --- a/proto/zitadel/idp.proto +++ b/proto/zitadel/idp.proto @@ -276,6 +276,13 @@ enum SAMLBinding { SAML_BINDING_ARTIFACT = 3; } +enum SAMLNameIDFormat { + SAML_NAME_ID_FORMAT_UNSPECIFIED = 0; + SAML_NAME_ID_FORMAT_EMAIL_ADDRESS = 1; + SAML_NAME_ID_FORMAT_PERSISTENT = 2; + SAML_NAME_ID_FORMAT_TRANSIENT = 3; +} + message ProviderConfig { Options options = 1; oneof config { @@ -452,21 +459,17 @@ message LDAPConfig { } message SAMLConfig { - bytes metadata_xml = 1 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Metadata of the SAML identity provider"; - } - ]; - zitadel.idp.v1.SAMLBinding binding = 2 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Binding which defines the type of communication with the identity provider"; - } - ]; - bool with_signed_request = 3 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Boolean which defines if the authentication requests are signed"; - } - ]; + // Metadata of the SAML identity provider. + bytes metadata_xml = 1; + // Binding which defines the type of communication with the identity provider. + zitadel.idp.v1.SAMLBinding binding = 2; + // Boolean which defines if the authentication requests are signed. + bool with_signed_request = 3; + // `nameid-format` for the SAML Request. + zitadel.idp.v1.SAMLNameIDFormat name_id_format = 4; + // Optional name of the attribute, which will be used to map the user + // in case the nameid-format returned is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`. + optional string transient_mapping_attribute_name = 5; } message AzureADConfig { diff --git a/proto/zitadel/management.proto b/proto/zitadel/management.proto index 9b59f13be4..560b37a09d 100644 --- a/proto/zitadel/management.proto +++ b/proto/zitadel/management.proto @@ -12767,31 +12767,28 @@ message AddSAMLProviderRequest { string name = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; oneof metadata { option (validate.required) = true; + // Metadata of the SAML identity provider. bytes metadata_xml = 2 [ - (validate.rules).bytes.max_len = 500000, - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Metadata of the SAML identity provider"; - } + (validate.rules).bytes.max_len = 500000 ]; + // Url to the metadata of the SAML identity provider. string metadata_url = 3 [ (validate.rules).string.max_len = 200, (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { example: "\"https://test.com/saml/metadata\"" - description: "Url to the metadata of the SAML identity provider"; } ]; } - zitadel.idp.v1.SAMLBinding binding = 4 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Binding which defines the type of communication with the identity provider"; - } - ]; - bool with_signed_request = 5 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Boolean which defines if the authentication requests are signed"; - } - ]; + // Binding which defines the type of communication with the identity provider. + zitadel.idp.v1.SAMLBinding binding = 4; + // Boolean which defines if the authentication requests are signed. + bool with_signed_request = 5; zitadel.idp.v1.Options provider_options = 6; + // Optionally specify the `nameid-format` requested. + optional zitadel.idp.v1.SAMLNameIDFormat name_id_format = 7; + // Optionally specify the name of the attribute, which will be used to map the user + // in case the nameid-format returned is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`. + optional string transient_mapping_attribute_name = 8; } message AddSAMLProviderResponse { @@ -12802,33 +12799,30 @@ message AddSAMLProviderResponse { message UpdateSAMLProviderRequest { string id = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; string name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + // Metadata of the SAML identity provider. oneof metadata { option (validate.required) = true; bytes metadata_xml = 3 [ - (validate.rules).bytes.max_len = 500000, - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Metadata of the SAML identity provider"; - } + (validate.rules).bytes.max_len = 500000 ]; + // Url to the metadata of the SAML identity provider. string metadata_url = 4 [ (validate.rules).string.max_len = 200, (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { example: "\"https://test.com/saml/metadata\"" - description: "Url to the metadata of the SAML identity provider"; } ]; } - zitadel.idp.v1.SAMLBinding binding = 5 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Binding which defines the type of communication with the identity provider"; - } - ]; - bool with_signed_request = 6 [ - (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { - description: "Boolean which defines if the authentication requests are signed"; - } - ]; + // Binding which defines the type of communication with the identity provider. + zitadel.idp.v1.SAMLBinding binding = 5; + // Boolean which defines if the authentication requests are signed. + bool with_signed_request = 6; zitadel.idp.v1.Options provider_options = 7; + // Optionally specify the `nameid-format` requested. + optional zitadel.idp.v1.SAMLNameIDFormat name_id_format = 8; + // Optionally specify the name of the attribute, which will be used to map the user + // in case the nameid-format returned is `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`. + optional string transient_mapping_attribute_name = 9; } message UpdateSAMLProviderResponse { From f5e9d4f57f5545b5b9b435e1da874a1984dd9a6e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20M=C3=B6hlmann?= Date: Thu, 23 May 2024 07:35:10 +0200 Subject: [PATCH 22/35] fix(oidc): IDP and machine user auth methods (#7992) # Which Problems Are Solved After https://github.com/zitadel/zitadel/pull/7822 was merged we discovered that v2 tokens that where obtained through an IDP using the v1 login, can't be used for zitadel API calls. - Because we used to store the AMR claim on the auth request, but internally use the domain.UserAuthMethod type. AMR has no notion of an IDP login, so that "factor" was lost during conversion. Rendering those v2 tokens invalid on the zitadel API. - A wrong check on machine user tokens falsly allowed some tokens to be valid - The client ID was set to tokens from client credentials and JWT profile, which made client queries fail in the validation middleware. The middleware expects client ID unset for machine users. # How the Problems Are Solved Store the domain.AuthMethods directly in the auth requests and session, instead of using AMR claims with lossy conversion. - IDPs have seperate auth method, which is not an AMR claim - Machine users are treated specialy, eg auth methods are not required. - Do not set the client ID for client credentials and JWT profile # Additional Changes Cleaned up mostly unused `oidc.getInfoFromRequest()`. # Additional Context - Bugs were introduced in https://github.com/zitadel/zitadel/pull/7822 and not yet part of a release. - Reported internally. --- internal/api/oidc/auth_request.go | 51 ++++--------- internal/api/oidc/auth_request_converter.go | 2 +- internal/api/oidc/token_client_credentials.go | 2 +- internal/api/oidc/token_code.go | 38 ++++++---- internal/api/oidc/token_jwt_profile.go | 6 +- .../eventsourcing/eventstore/auth_request.go | 3 + .../eventstore/token_verifier.go | 11 ++- internal/domain/auth_request.go | 15 ++++ internal/domain/user.go | 1 + internal/query/user_auth_method.go | 37 +++++++--- internal/query/user_auth_method_test.go | 72 ++++++++----------- 11 files changed, 126 insertions(+), 112 deletions(-) diff --git a/internal/api/oidc/auth_request.go b/internal/api/oidc/auth_request.go index 130b515251..1abe59dc88 100644 --- a/internal/api/oidc/auth_request.go +++ b/internal/api/oidc/auth_request.go @@ -12,7 +12,6 @@ import ( "github.com/zitadel/logging" "github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/op" - "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/api/authz" http_utils "github.com/zitadel/zitadel/internal/api/http" @@ -199,23 +198,6 @@ func (*OPStorage) panicErr(method string) error { return fmt.Errorf("OPStorage.%s should not be called anymore. This is a bug. Please report https://github.com/zitadel/zitadel/issues", method) } -func getInfoFromRequest(req op.TokenRequest) (agentID, clientID, userOrgID string, authTime time.Time, amr []string, preferredLanguage *language.Tag, reason domain.TokenReason, actor *domain.TokenActor) { - switch r := req.(type) { - case *AuthRequest: - return r.AgentID, r.ApplicationID, r.UserOrgID, r.AuthTime, r.GetAMR(), r.PreferredLanguage, domain.TokenReasonAuthRequest, nil - case *RefreshTokenRequest: - return r.UserAgentID, r.ClientID, "", r.AuthTime, r.AuthMethodsReferences, nil, domain.TokenReasonRefresh, r.Actor - case op.IDTokenRequest: - return "", r.GetClientID(), "", r.GetAuthTime(), r.GetAMR(), nil, domain.TokenReasonAuthRequest, nil - case *oidc.JWTTokenRequest: - return "", "", "", r.GetAuthTime(), nil, nil, domain.TokenReasonJWTProfile, nil - case *clientCredentialsRequest: - return "", "", "", time.Time{}, nil, nil, domain.TokenReasonClientCredentials, nil - default: - return "", "", "", time.Time{}, nil, nil, domain.TokenReasonAuthRequest, nil - } -} - func (o *OPStorage) TokenRequestByRefreshToken(ctx context.Context, refreshToken string) (_ op.RefreshTokenRequest, err error) { panic("TokenRequestByRefreshToken should not be called anymore. This is a bug. Please report https://github.com/zitadel/zitadel/issues") } @@ -511,8 +493,8 @@ func implicitFlowComplianceChecker() command.AuthRequestComplianceChecker { func (s *Server) authorizeCallbackHandler(w http.ResponseWriter, r *http.Request) { authorizer := s.Provider() - authReq, err := func() (authReq op.AuthRequest, err error) { - ctx, span := tracing.NewSpan(r.Context()) + authReq, err := func(ctx context.Context) (authReq *AuthRequest, err error) { + ctx, span := tracing.NewSpan(ctx) r = r.WithContext(ctx) defer func() { span.EndWithError(err) }() @@ -520,7 +502,7 @@ func (s *Server) authorizeCallbackHandler(w http.ResponseWriter, r *http.Request if err != nil { return nil, err } - authReq, err = authorizer.Storage().AuthRequestByID(r.Context(), id) + authReq, err = s.getAuthRequestV1ByID(ctx, id) if err != nil { return nil, err } @@ -528,13 +510,13 @@ func (s *Server) authorizeCallbackHandler(w http.ResponseWriter, r *http.Request return authReq, oidc.ErrInteractionRequired().WithDescription("Unfortunately, the user may be not logged in and/or additional interaction is required.") } return authReq, s.authResponse(authReq, authorizer, w, r) - }() + }(r.Context()) if err != nil { op.AuthRequestError(w, r, authReq, err, authorizer) } } -func (s *Server) authResponse(authReq op.AuthRequest, authorizer op.Authorizer, w http.ResponseWriter, r *http.Request) (err error) { +func (s *Server) authResponse(authReq *AuthRequest, authorizer op.Authorizer, w http.ResponseWriter, r *http.Request) (err error) { ctx, span := tracing.NewSpan(r.Context()) r = r.WithContext(ctx) defer func() { span.EndWithError(err) }() @@ -551,7 +533,7 @@ func (s *Server) authResponse(authReq op.AuthRequest, authorizer op.Authorizer, return s.authResponseToken(authReq, authorizer, client, w, r) } -func (s *Server) authResponseToken(authReq op.AuthRequest, authorizer op.Authorizer, opClient op.Client, w http.ResponseWriter, r *http.Request) (err error) { +func (s *Server) authResponseToken(authReq *AuthRequest, authorizer op.Authorizer, opClient op.Client, w http.ResponseWriter, r *http.Request) (err error) { ctx, span := tracing.NewSpan(r.Context()) r = r.WithContext(ctx) defer func() { span.EndWithError(err) }() @@ -561,23 +543,20 @@ func (s *Server) authResponseToken(authReq op.AuthRequest, authorizer op.Authori return zerrors.ThrowInternal(nil, "OIDC-waeN6", "Error.Internal") } - userAgentID, _, userOrgID, authTime, authMethodsReferences, preferredLanguage, reason, actor := getInfoFromRequest(authReq) scope := authReq.GetScopes() session, err := s.command.CreateOIDCSession(ctx, - authReq.GetSubject(), - userOrgID, + authReq.UserID, + authReq.UserOrgID, client.client.ClientID, scope, - authReq.GetAudience(), - AMRToAuthMethodTypes(authMethodsReferences), - authTime, + authReq.Audience, + authReq.AuthMethods(), + authReq.AuthTime, authReq.GetNonce(), - preferredLanguage, - &domain.UserAgent{ - FingerprintID: &userAgentID, - }, - reason, - actor, + authReq.PreferredLanguage, + authReq.BrowserInfo.ToUserAgent(), + domain.TokenReasonAuthRequest, + nil, slices.Contains(scope, oidc.ScopeOfflineAccess), ) if err != nil { diff --git a/internal/api/oidc/auth_request_converter.go b/internal/api/oidc/auth_request_converter.go index 76cbc655dc..9a1aee2aa4 100644 --- a/internal/api/oidc/auth_request_converter.go +++ b/internal/api/oidc/auth_request_converter.go @@ -94,7 +94,7 @@ func (a *AuthRequest) oidc() *domain.AuthRequestOIDC { return a.Request.(*domain.AuthRequestOIDC) } -func AuthRequestFromBusiness(authReq *domain.AuthRequest) (_ op.AuthRequest, err error) { +func AuthRequestFromBusiness(authReq *domain.AuthRequest) (_ *AuthRequest, err error) { if _, ok := authReq.Request.(*domain.AuthRequestOIDC); !ok { return nil, zerrors.ThrowInvalidArgument(nil, "OIDC-Haz7A", "auth request is not of type oidc") } diff --git a/internal/api/oidc/token_client_credentials.go b/internal/api/oidc/token_client_credentials.go index 3765d58adb..e0cb29770b 100644 --- a/internal/api/oidc/token_client_credentials.go +++ b/internal/api/oidc/token_client_credentials.go @@ -34,7 +34,7 @@ func (s *Server) ClientCredentialsExchange(ctx context.Context, r *op.ClientRequ session, err := s.command.CreateOIDCSession(ctx, client.user.ID, client.user.ResourceOwner, - r.Data.ClientID, + "", scope, domain.AddAudScopeToAudience(ctx, nil, r.Data.Scope), []domain.UserAuthMethodType{domain.UserAuthMethodTypePassword}, diff --git a/internal/api/oidc/token_code.go b/internal/api/oidc/token_code.go index add1fc1c25..85aa847579 100644 --- a/internal/api/oidc/token_code.go +++ b/internal/api/oidc/token_code.go @@ -8,6 +8,7 @@ import ( "github.com/zitadel/oidc/v3/pkg/oidc" "github.com/zitadel/oidc/v3/pkg/op" + "github.com/zitadel/zitadel/internal/api/http/middleware" "github.com/zitadel/zitadel/internal/command" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/telemetry/tracing" @@ -69,36 +70,33 @@ func (s *Server) codeExchangeV1(ctx context.Context, client *Client, req *oidc.A if req.RedirectURI != authReq.GetRedirectURI() { return nil, "", oidc.ErrInvalidGrant().WithDescription("redirect_uri does not correspond") } - userAgentID, _, userOrgID, authTime, authMethodsReferences, preferredLanguage, reason, actor := getInfoFromRequest(authReq) scope := authReq.GetScopes() session, err = s.command.CreateOIDCSession(ctx, - authReq.GetSubject(), - userOrgID, + authReq.UserID, + authReq.UserOrgID, client.client.ClientID, scope, - authReq.GetAudience(), - AMRToAuthMethodTypes(authMethodsReferences), - authTime, + authReq.Audience, + authReq.AuthMethods(), + authReq.AuthTime, authReq.GetNonce(), - preferredLanguage, - &domain.UserAgent{ - FingerprintID: &userAgentID, - }, - reason, - actor, + authReq.PreferredLanguage, + authReq.BrowserInfo.ToUserAgent(), + domain.TokenReasonAuthRequest, + nil, slices.Contains(scope, oidc.ScopeOfflineAccess), ) if err != nil { return nil, "", err } - return session, authReq.GetState(), s.repo.DeleteAuthRequest(ctx, authReq.GetID()) + return session, authReq.TransferState, s.repo.DeleteAuthRequest(ctx, authReq.ID) } // getAuthRequestV1ByCode finds the v1 auth request by code. // code needs to be the encrypted version of the ID, // this is required by the underlying repo. -func (s *Server) getAuthRequestV1ByCode(ctx context.Context, code string) (op.AuthRequest, error) { +func (s *Server) getAuthRequestV1ByCode(ctx context.Context, code string) (*AuthRequest, error) { authReq, err := s.repo.AuthRequestByCode(ctx, code) if err != nil { return nil, err @@ -106,6 +104,18 @@ func (s *Server) getAuthRequestV1ByCode(ctx context.Context, code string) (op.Au return AuthRequestFromBusiness(authReq) } +func (s *Server) getAuthRequestV1ByID(ctx context.Context, id string) (*AuthRequest, error) { + userAgentID, ok := middleware.UserAgentIDFromCtx(ctx) + if !ok { + return nil, zerrors.ThrowPreconditionFailed(nil, "OIDC-TiTu7", "no user agent id") + } + resp, err := s.repo.AuthRequestByIDCheckLoggedIn(ctx, id, userAgentID) + if err != nil { + return nil, err + } + return AuthRequestFromBusiness(resp) +} + func codeExchangeComplianceChecker(client *Client, req *oidc.AccessTokenRequest) command.AuthRequestComplianceChecker { return func(ctx context.Context, authReq *command.AuthRequestWriteModel) error { if authReq.CodeChallenge != nil || client.AuthMethod() == oidc.AuthMethodNone { diff --git a/internal/api/oidc/token_jwt_profile.go b/internal/api/oidc/token_jwt_profile.go index b53a63ca10..b23a24f77f 100644 --- a/internal/api/oidc/token_jwt_profile.go +++ b/internal/api/oidc/token_jwt_profile.go @@ -42,15 +42,15 @@ func (s *Server) JWTProfile(ctx context.Context, r *op.Request[oidc.JWTProfileGr session, err := s.command.CreateOIDCSession(ctx, user.ID, user.ResourceOwner, - jwtReq.Subject, + "", scope, domain.AddAudScopeToAudience(ctx, nil, r.Data.Scope), - nil, + []domain.UserAuthMethodType{domain.UserAuthMethodTypePrivateKey}, time.Now(), "", nil, nil, - domain.TokenReasonClientCredentials, + domain.TokenReasonJWTProfile, nil, false, ) diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request.go b/internal/auth/repository/eventsourcing/eventstore/auth_request.go index 76102a916e..9de07b742f 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request.go @@ -269,6 +269,7 @@ func (repo *AuthRequestRepo) CheckExternalUserLogin(ctx context.Context, authReq return err } + request.IDPLoginChecked = true err = repo.Command.UserIDPLoginChecked(ctx, request.UserOrgID, request.UserID, request.WithCurrentInfo(info)) if err != nil { return err @@ -516,6 +517,7 @@ func (repo *AuthRequestRepo) LinkExternalUsers(ctx context.Context, authReqID, u return err } request.LinkingUsers = nil + request.IDPLoginChecked = true return repo.AuthRequests.UpdateAuthRequest(ctx, request) } @@ -560,6 +562,7 @@ func (repo *AuthRequestRepo) AutoRegisterExternalUser(ctx context.Context, regis request.SetUserInfo(human.ID, human.Username, human.Username, human.DisplayName, "", resourceOwner) request.SelectedIDPConfigID = externalIDP.IDPConfigID request.LinkingUsers = nil + request.IDPLoginChecked = true err = repo.Command.UserIDPLoginChecked(ctx, request.UserOrgID, request.UserID, request.WithCurrentInfo(info)) if err != nil { return err diff --git a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go index d3a8201474..c02e9cb329 100644 --- a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go +++ b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go @@ -180,11 +180,18 @@ func (repo *TokenVerifierRepo) checkAuthentication(ctx context.Context, authMeth if domain.HasMFA(authMethods) { return nil } - availableAuthMethods, forceMFA, forceMFALocalOnly, err := repo.Query.ListUserAuthMethodTypesRequired(setCallerCtx(ctx, userID), userID) + requirements, err := repo.Query.ListUserAuthMethodTypesRequired(setCallerCtx(ctx, userID), userID) if err != nil { return err } - if domain.RequiresMFA(forceMFA, forceMFALocalOnly, hasIDPAuthentication(authMethods)) || domain.HasMFA(availableAuthMethods) { + if requirements.UserType == domain.UserTypeMachine { + return nil + } + if domain.RequiresMFA( + requirements.ForceMFA, + requirements.ForceMFALocalOnly, + !hasIDPAuthentication(authMethods)) || + domain.HasMFA(requirements.AuthMethods) { return zerrors.ThrowPermissionDenied(nil, "AUTHZ-Kl3p0", "mfa required") } return nil diff --git a/internal/domain/auth_request.go b/internal/domain/auth_request.go index 7bdd7bcb86..b7e463ff9a 100644 --- a/internal/domain/auth_request.go +++ b/internal/domain/auth_request.go @@ -45,6 +45,7 @@ type AuthRequest struct { LinkingUsers []*ExternalUser PossibleSteps []NextStep `json:"-"` PasswordVerified bool + IDPLoginChecked bool MFAsVerified []MFAType Audience []string AuthTime time.Time @@ -69,6 +70,20 @@ func (a *AuthRequest) PolicyOrgID() string { return a.policyOrgID } +func (a *AuthRequest) AuthMethods() []UserAuthMethodType { + list := make([]UserAuthMethodType, 0, len(a.MFAsVerified)+2) + if a.PasswordVerified { + list = append(list, UserAuthMethodTypePassword) + } + if a.IDPLoginChecked { + list = append(list, UserAuthMethodTypeIDP) + } + for _, mfa := range a.MFAsVerified { + list = append(list, mfa.UserAuthMethodType()) + } + return list +} + type ExternalUser struct { IDPConfigID string ExternalUserID string diff --git a/internal/domain/user.go b/internal/domain/user.go index 8677a997f7..3204d658da 100644 --- a/internal/domain/user.go +++ b/internal/domain/user.go @@ -43,6 +43,7 @@ const ( UserAuthMethodTypeOTPSMS UserAuthMethodTypeOTPEmail UserAuthMethodTypeOTP // generic OTP when parsing AMR from OIDC + UserAuthMethodTypePrivateKey userAuthMethodTypeCount ) diff --git a/internal/query/user_auth_method.go b/internal/query/user_auth_method.go index e39fb2a8e9..3c24948d87 100644 --- a/internal/query/user_auth_method.go +++ b/internal/query/user_auth_method.go @@ -172,11 +172,18 @@ func (q *Queries) ListActiveUserAuthMethodTypes(ctx context.Context, userID stri return userAuthMethodTypes, err } -func (q *Queries) ListUserAuthMethodTypesRequired(ctx context.Context, userID string) (userAuthMethodTypes []domain.UserAuthMethodType, forceMFA, forceMFALocalOnly bool, err error) { +type UserAuthMethodRequirements struct { + UserType domain.UserType + AuthMethods []domain.UserAuthMethodType + ForceMFA bool + ForceMFALocalOnly bool +} + +func (q *Queries) ListUserAuthMethodTypesRequired(ctx context.Context, userID string) (requirements *UserAuthMethodRequirements, err error) { ctxData := authz.GetCtxData(ctx) if ctxData.UserID != userID { if err := q.checkPermission(ctx, domain.PermissionUserRead, ctxData.OrgID, userID); err != nil { - return nil, false, false, err + return nil, err } } ctx, span := tracing.NewSpan(ctx) @@ -189,17 +196,17 @@ func (q *Queries) ListUserAuthMethodTypesRequired(ctx context.Context, userID st } stmt, args, err := query.Where(eq).ToSql() if err != nil { - return nil, false, false, zerrors.ThrowInvalidArgument(err, "QUERY-E5ut4", "Errors.Query.InvalidRequest") + return nil, zerrors.ThrowInvalidArgument(err, "QUERY-E5ut4", "Errors.Query.InvalidRequest") } err = q.client.QueryContext(ctx, func(rows *sql.Rows) error { - userAuthMethodTypes, forceMFA, forceMFALocalOnly, err = scan(rows) + requirements, err = scan(rows) return err }, stmt, args...) if err != nil { - return nil, false, false, zerrors.ThrowInternal(err, "QUERY-Dun75", "Errors.Internal") + return nil, zerrors.ThrowInternal(err, "QUERY-Dun75", "Errors.Internal") } - return userAuthMethodTypes, forceMFA, forceMFALocalOnly, nil + return requirements, nil } func NewUserAuthMethodUserIDSearchQuery(value string) (SearchQuery, error) { @@ -404,7 +411,7 @@ func prepareActiveUserAuthMethodTypesQuery(ctx context.Context, db prepareDataba } } -func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (_ []domain.UserAuthMethodType, forceMFA, forceMFALocalOnly bool, err error)) { +func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { loginPolicyQuery, err := prepareAuthMethodsForceMFAQuery() if err != nil { return sq.SelectBuilder{}, nil @@ -421,6 +428,7 @@ func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareData NotifyPasswordSetCol.identifier(), authMethodTypeTypes.identifier(), userIDPsCountCount.identifier(), + UserTypeCol.identifier(), forceMFAForce.identifier(), forceMFAForceLocalOnly.identifier()). From(userTable.identifier()). @@ -436,10 +444,11 @@ func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareData "(" + forceMFAOrgID.identifier() + " = " + UserInstanceIDCol.identifier() + " OR " + forceMFAOrgID.identifier() + " = " + UserResourceOwnerCol.identifier() + ") AND " + forceMFAInstanceID.identifier() + " = " + UserInstanceIDCol.identifier() + db.Timetravel(call.Took(ctx))). PlaceholderFormat(sq.Dollar), - func(rows *sql.Rows) ([]domain.UserAuthMethodType, bool, bool, error) { + func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { userAuthMethodTypes := make([]domain.UserAuthMethodType, 0) var passwordSet sql.NullBool var idp sql.NullInt64 + var userType sql.NullInt32 var forceMFA sql.NullBool var forceMFALocalOnly sql.NullBool for rows.Next() { @@ -448,11 +457,12 @@ func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareData &passwordSet, &authMethodType, &idp, + &userType, &forceMFA, &forceMFALocalOnly, ) if err != nil { - return nil, false, false, err + return nil, err } if authMethodType.Valid { userAuthMethodTypes = append(userAuthMethodTypes, domain.UserAuthMethodType(authMethodType.Int16)) @@ -467,10 +477,15 @@ func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareData } if err := rows.Close(); err != nil { - return nil, false, false, zerrors.ThrowInternal(err, "QUERY-W4zje", "Errors.Query.CloseRows") + return nil, zerrors.ThrowInternal(err, "QUERY-W4zje", "Errors.Query.CloseRows") } - return userAuthMethodTypes, forceMFA.Bool, forceMFALocalOnly.Bool, nil + return &UserAuthMethodRequirements{ + UserType: domain.UserType(userType.Int32), + AuthMethods: userAuthMethodTypes, + ForceMFA: forceMFA.Bool, + ForceMFALocalOnly: forceMFALocalOnly.Bool, + }, nil } } diff --git a/internal/query/user_auth_method_test.go b/internal/query/user_auth_method_test.go index a4a66cac04..578b14cec5 100644 --- a/internal/query/user_auth_method_test.go +++ b/internal/query/user_auth_method_test.go @@ -59,6 +59,7 @@ var ( prepareAuthMethodTypesRequiredStmt = `SELECT projections.users12_notifications.password_set,` + ` auth_method_types.method_type,` + ` user_idps_count.count,` + + ` projections.users12.type,` + ` auth_methods_force_mfa.force_mfa,` + ` auth_methods_force_mfa.force_mfa_local_only` + ` FROM projections.users12` + @@ -75,6 +76,7 @@ var ( ` prepareAuthMethodTypesRequiredCols = []string{ "password_set", + "type", "method_type", "idps_count", "force_mfa", @@ -317,14 +319,10 @@ func Test_UserAuthMethodPrepares(t *testing.T) { }, { name: "prepareUserAuthMethodTypesRequiredQuery no result", - prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*testUserAuthMethodTypesRequired, error)) { + prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { builder, scan := prepareUserAuthMethodTypesRequiredQuery(ctx, db) - return builder, func(rows *sql.Rows) (*testUserAuthMethodTypesRequired, error) { - authMethods, forceMFA, forceMFALocalOnly, err := scan(rows) - if err != nil { - return nil, err - } - return &testUserAuthMethodTypesRequired{authMethods: authMethods, forceMFA: forceMFA, forceMFALocalOnly: forceMFALocalOnly}, nil + return builder, func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { + return scan(rows) } }, want: want{ @@ -334,18 +332,14 @@ func Test_UserAuthMethodPrepares(t *testing.T) { nil, ), }, - object: &testUserAuthMethodTypesRequired{authMethods: []domain.UserAuthMethodType{}, forceMFA: false}, + object: &UserAuthMethodRequirements{AuthMethods: []domain.UserAuthMethodType{}, ForceMFA: false}, }, { name: "prepareUserAuthMethodTypesRequiredQuery one second factor", - prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*testUserAuthMethodTypesRequired, error)) { + prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { builder, scan := prepareUserAuthMethodTypesRequiredQuery(ctx, db) - return builder, func(rows *sql.Rows) (*testUserAuthMethodTypesRequired, error) { - authMethods, forceMFA, forceMFALocalOnly, err := scan(rows) - if err != nil { - return nil, err - } - return &testUserAuthMethodTypesRequired{authMethods: authMethods, forceMFA: forceMFA, forceMFALocalOnly: forceMFALocalOnly}, nil + return builder, func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { + return scan(rows) } }, want: want{ @@ -357,32 +351,30 @@ func Test_UserAuthMethodPrepares(t *testing.T) { true, domain.UserAuthMethodTypePasswordless, 1, + domain.UserTypeHuman, true, true, }, }, ), }, - object: &testUserAuthMethodTypesRequired{ - authMethods: []domain.UserAuthMethodType{ + object: &UserAuthMethodRequirements{ + UserType: domain.UserTypeHuman, + AuthMethods: []domain.UserAuthMethodType{ domain.UserAuthMethodTypePasswordless, domain.UserAuthMethodTypePassword, domain.UserAuthMethodTypeIDP, }, - forceMFA: true, - forceMFALocalOnly: true, + ForceMFA: true, + ForceMFALocalOnly: true, }, }, { name: "prepareUserAuthMethodTypesRequiredQuery multiple second factors", - prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*testUserAuthMethodTypesRequired, error)) { + prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { builder, scan := prepareUserAuthMethodTypesRequiredQuery(ctx, db) - return builder, func(rows *sql.Rows) (*testUserAuthMethodTypesRequired, error) { - authMethods, forceMFA, forceMFALocalOnly, err := scan(rows) - if err != nil { - return nil, err - } - return &testUserAuthMethodTypesRequired{authMethods: authMethods, forceMFA: forceMFA, forceMFALocalOnly: forceMFALocalOnly}, nil + return builder, func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { + return scan(rows) } }, want: want{ @@ -394,6 +386,7 @@ func Test_UserAuthMethodPrepares(t *testing.T) { true, domain.UserAuthMethodTypePasswordless, 1, + domain.UserTypeHuman, true, true, }, @@ -401,6 +394,7 @@ func Test_UserAuthMethodPrepares(t *testing.T) { true, domain.UserAuthMethodTypeTOTP, 1, + domain.UserTypeHuman, true, true, }, @@ -408,27 +402,24 @@ func Test_UserAuthMethodPrepares(t *testing.T) { ), }, - object: &testUserAuthMethodTypesRequired{ - authMethods: []domain.UserAuthMethodType{ + object: &UserAuthMethodRequirements{ + UserType: domain.UserTypeHuman, + AuthMethods: []domain.UserAuthMethodType{ domain.UserAuthMethodTypePasswordless, domain.UserAuthMethodTypeTOTP, domain.UserAuthMethodTypePassword, domain.UserAuthMethodTypeIDP, }, - forceMFA: true, - forceMFALocalOnly: true, + ForceMFA: true, + ForceMFALocalOnly: true, }, }, { name: "prepareUserAuthMethodTypesRequiredQuery sql err", - prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*testUserAuthMethodTypesRequired, error)) { + prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { builder, scan := prepareUserAuthMethodTypesRequiredQuery(ctx, db) - return builder, func(rows *sql.Rows) (*testUserAuthMethodTypesRequired, error) { - authMethods, forceMFA, forceMFALocalOnly, err := scan(rows) - if err != nil { - return nil, err - } - return &testUserAuthMethodTypesRequired{authMethods: authMethods, forceMFA: forceMFA, forceMFALocalOnly: forceMFALocalOnly}, nil + return builder, func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { + return scan(rows) } }, want: want{ @@ -452,10 +443,3 @@ func Test_UserAuthMethodPrepares(t *testing.T) { }) } } - -// testUserAuthMethodTypesRequired is required as assetPrepare is only able to return a single object from scan -type testUserAuthMethodTypesRequired struct { - authMethods []domain.UserAuthMethodType - forceMFA bool - forceMFALocalOnly bool -} From cfa3d013a48f0c1e44e11509f5d179e68a616147 Mon Sep 17 00:00:00 2001 From: Sujoy B <70602535+sujoysb@users.noreply.github.com> Date: Thu, 23 May 2024 04:07:36 -0400 Subject: [PATCH 23/35] feat: show max password length in complexity components (#7810) # Which Problems Are Solved There is confusing ambiguity in the error messages for setting too long passwords in different places. # How the Problems Are Solved A check for maximum password length is added so it's clear that passwords can't exceed a maximum length of 70 or 72 bytes. Password validation now provides a live updating check mark or cross mark to indicate if the maximum length requirement is met. # Additional Changes Clarified requirement descriptions on the registration page with complete sentences. # Additional Context Closes #6301 --------- Co-authored-by: Elio Bischof --- .../password-complexity-view.component.html | 8 +++++++ console/src/assets/i18n/bg.json | 4 +++- console/src/assets/i18n/cs.json | 4 +++- console/src/assets/i18n/de.json | 4 +++- console/src/assets/i18n/en.json | 8 ++++--- console/src/assets/i18n/es.json | 4 +++- console/src/assets/i18n/fr.json | 4 +++- console/src/assets/i18n/it.json | 4 +++- console/src/assets/i18n/ja.json | 4 +++- console/src/assets/i18n/mk.json | 4 +++- console/src/assets/i18n/nl.json | 4 +++- console/src/assets/i18n/pl.json | 4 +++- console/src/assets/i18n/pt.json | 4 +++- console/src/assets/i18n/ru.json | 4 +++- console/src/assets/i18n/zh.json | 4 +++- internal/api/ui/login/static/i18n/bg.yaml | 23 ++++++++++-------- internal/api/ui/login/static/i18n/cs.yaml | 14 ++++++----- internal/api/ui/login/static/i18n/de.yaml | 18 +++++++------- internal/api/ui/login/static/i18n/en.yaml | 14 ++++++----- internal/api/ui/login/static/i18n/es.yaml | 22 +++++++++-------- internal/api/ui/login/static/i18n/fr.yaml | 14 ++++++----- internal/api/ui/login/static/i18n/it.yaml | 18 +++++++------- internal/api/ui/login/static/i18n/ja.yaml | 20 +++++++++------- internal/api/ui/login/static/i18n/mk.yaml | 20 +++++++++------- internal/api/ui/login/static/i18n/nl.yaml | 16 +++++++------ internal/api/ui/login/static/i18n/pl.yaml | 20 +++++++++------- internal/api/ui/login/static/i18n/pt.yaml | 20 +++++++++------- internal/api/ui/login/static/i18n/ru.yaml | 22 +++++++++-------- internal/api/ui/login/static/i18n/zh.yaml | 20 +++++++++------- .../scripts/password_policy_check.js | 24 +++++++++++++++++++ .../templates/password_complexity_policy.html | 3 ++- 31 files changed, 223 insertions(+), 133 deletions(-) diff --git a/console/src/app/modules/password-complexity-view/password-complexity-view.component.html b/console/src/app/modules/password-complexity-view/password-complexity-view.component.html index 7183bff70e..0a5649dabb 100644 --- a/console/src/app/modules/password-complexity-view/password-complexity-view.component.html +++ b/console/src/app/modules/password-complexity-view/password-complexity-view.component.html @@ -50,4 +50,12 @@ {{ 'ERRORS.LOWERCASEMISSING' | translate }}
+
+ + + + {{ 'USER.PASSWORD.MAXLENGTHERROR' | translate: { value: 70 } }} ({{ password?.value?.length }}/{{ 70 }}) + +
diff --git a/console/src/assets/i18n/bg.json b/console/src/assets/i18n/bg.json index 7da4e58dca..4a1131920a 100644 --- a/console/src/assets/i18n/bg.json +++ b/console/src/assets/i18n/bg.json @@ -588,6 +588,7 @@ "INVALID_FORMAT": "Форматирането е невалидно.", "NOTANEMAIL": "Дадената стойност не е имейл адрес.", "MINLENGTH": "Трябва да е поне {{requiredLength}} знака дълги.", + "MAXLENGTH": "Трябва да е по-малко от {{requiredLength}} символа", "UPPERCASEMISSING": "Трябва да включва главна буква.", "LOWERCASEMISSING": "Трябва да включва малка буква.", "SYMBOLERROR": "Трябва да включва символ или препинателен знак.", @@ -873,7 +874,8 @@ "SET": "Задайте нова парола", "RESENDNOTIFICATION": "Изпратете връзка за повторно задаване на парола", "REQUIRED": "Някои задължителни полета липсват.", - "MINLENGTHERROR": "Трябва да бъде поне {{value}} знака дълги." + "MINLENGTHERROR": "Трябва да бъде поне {{value}} знака дълги.", + "MAXLENGTHERROR": "Трябва да съдържа по-малко от {{value}} знака." }, "ID": "документ за самоличност", "EMAIL": "Електронна поща", diff --git a/console/src/assets/i18n/cs.json b/console/src/assets/i18n/cs.json index 3e3f4e3ff5..f7b098c098 100644 --- a/console/src/assets/i18n/cs.json +++ b/console/src/assets/i18n/cs.json @@ -595,6 +595,7 @@ "INVALID_FORMAT": "Formát je neplatný.", "NOTANEMAIL": "Zadaná hodnota není e-mailová adresa.", "MINLENGTH": "Musí být dlouhé alespoň {{requiredLength}} znaků.", + "MAXLENGTH": "Musí být kratší než {{requiredLength}} znaků", "UPPERCASEMISSING": "Musí obsahovat velké písmeno.", "LOWERCASEMISSING": "Musí obsahovat malé písmeno.", "SYMBOLERROR": "Musí obsahovat symbol nebo interpunkční znaménko.", @@ -880,7 +881,8 @@ "SET": "Nastavit nové heslo", "RESENDNOTIFICATION": "Odeslat odkaz pro reset hesla", "REQUIRED": "Některá povinná pole nejsou vyplněna.", - "MINLENGTHERROR": "Musí být alespoň {{value}} znaků dlouhé." + "MINLENGTHERROR": "Musí být alespoň {{value}} znaků dlouhé.", + "MAXLENGTHERROR": "Musí být kratší než {{value}} znaků." }, "ID": "ID", "EMAIL": "E-mail", diff --git a/console/src/assets/i18n/de.json b/console/src/assets/i18n/de.json index a49819c241..4c595773c4 100644 --- a/console/src/assets/i18n/de.json +++ b/console/src/assets/i18n/de.json @@ -594,6 +594,7 @@ "INVALID_FORMAT": "Das Format is ungültig.", "NOTANEMAIL": "Der eingegebene Wert ist keine E-Mail Adresse.", "MINLENGTH": "Muss mindestens {{requiredLength}} Zeichen lang sein.", + "MAXLENGTH": "Muss weniger als {{requiredLength}} Zeichen enthalten", "UPPERCASEMISSING": "Muss einen Grossbuchstaben beinhalten.", "LOWERCASEMISSING": "Muss einen Kleinbuchstaben beinhalten.", "SYMBOLERROR": "Muss ein Symbol/Satzzeichen beinhalten.", @@ -879,7 +880,8 @@ "SET": "Passwort neu setzen", "RESENDNOTIFICATION": "Email zum Zurücksetzen senden", "REQUIRED": "Bitte prüfe, dass alle notwendigen Felder ausgefüllt sind.", - "MINLENGTHERROR": "Muss mindestens {{value}} Zeichen lang sein." + "MINLENGTHERROR": "Muss mindestens {{value}} Zeichen lang sein.", + "MAXLENGTHERROR": "Muss weniger als {{value}} Zeichen umfassen." }, "ID": "ID", "EMAIL": "E-Mail", diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json index 9f686bbfb1..f411faddcd 100644 --- a/console/src/assets/i18n/en.json +++ b/console/src/assets/i18n/en.json @@ -595,8 +595,9 @@ "INVALID_FORMAT": "The formatting is invalid.", "NOTANEMAIL": "The given value is not an e-mail address.", "MINLENGTH": "Must be at least {{requiredLength}} characters long.", - "UPPERCASEMISSING": "Must include an uppercase character.", - "LOWERCASEMISSING": "Must include a lowercase character.", + "MAXLENGTH": "Must be less than {{requiredLength}} characters.", + "UPPERCASEMISSING": "Must include an uppercase letter.", + "LOWERCASEMISSING": "Must include a lowercase letter.", "SYMBOLERROR": "Must include a symbol or punctuation mark.", "NUMBERERROR": "Must include a digit.", "PWNOTEQUAL": "The passwords provided do not match.", @@ -880,7 +881,8 @@ "SET": "Set New Password", "RESENDNOTIFICATION": "Send Password Reset Link", "REQUIRED": "Some required fields are missing.", - "MINLENGTHERROR": "Has to be at least {{value}} characters long." + "MINLENGTHERROR": "Must be at least {{value}} characters long.", + "MAXLENGTHERROR": "Must be less than {{value}} characters." }, "ID": "ID", "EMAIL": "E-mail", diff --git a/console/src/assets/i18n/es.json b/console/src/assets/i18n/es.json index e07c0d978c..d535f44252 100644 --- a/console/src/assets/i18n/es.json +++ b/console/src/assets/i18n/es.json @@ -595,6 +595,7 @@ "INVALID_FORMAT": "El formato no es valido.", "NOTANEMAIL": "El valor proporcionado no es una dirección de email.", "MINLENGTH": "Debe tener al menos {{requiredLength}} caracteres de longitud.", + "MAXLENGTH": "Debe tener menos de {{requiredLength}} caracteres.", "UPPERCASEMISSING": "Debe incluir un carácter en mayúscula.", "LOWERCASEMISSING": "Debe incluir un carácter en minúscula.", "SYMBOLERROR": "Debe incluir un símbolo o un signo de puntuación.", @@ -880,7 +881,8 @@ "SET": "Establecer nueva contraseña", "RESENDNOTIFICATION": "Enviar enlace para restablecer la contraseña", "REQUIRED": "Faltan algunos campos requeridos.", - "MINLENGTHERROR": "Debe tener al menos {{value}} caracteres de longitud." + "MINLENGTHERROR": "Debe tener al menos {{value}} caracteres de longitud.", + "MAXLENGTHERROR": "Debe tener menos de {{value}} caracteres" }, "ID": "ID", "EMAIL": "Email", diff --git a/console/src/assets/i18n/fr.json b/console/src/assets/i18n/fr.json index d5fbfd9c08..110f0589d3 100644 --- a/console/src/assets/i18n/fr.json +++ b/console/src/assets/i18n/fr.json @@ -594,6 +594,7 @@ "INVALID_FORMAT": "Le format n'est pas valide.", "NOTANEMAIL": "La valeur donnée n'est pas une adresse e-mail.", "MINLENGTH": "Doit comporter au moins {{length}} caractères.", + "MAXLENGTH": "Doit contenir moins de {{requiredLength}} caractères.", "UPPERCASEMISSING": "Doit inclure un caractère majuscule.", "LOWERCASEMISSING": "Doit inclure un caractère minuscule.", "SYMBOLERROR": "Doit inclure un symbole ou un signe de ponctuation.", @@ -879,7 +880,8 @@ "SET": "Définir un nouveau mot de passe", "RESENDNOTIFICATION": "Envoyer le lien de réinitialisation du mot de passe", "REQUIRED": "Certains champs obligatoires sont manquants.", - "MINLENGTHERROR": "Doit comporter au moins {{value}} caractères." + "MINLENGTHERROR": "Doit comporter au moins {{value}} caractères.", + "MAXLENGTHERROR": "Doit contenir moins de {{value}} caractères" }, "ID": "ID", "EMAIL": "E-mail", diff --git a/console/src/assets/i18n/it.json b/console/src/assets/i18n/it.json index 3d986999eb..258635148e 100644 --- a/console/src/assets/i18n/it.json +++ b/console/src/assets/i18n/it.json @@ -593,6 +593,7 @@ "INVALID_FORMAT": "Il formato non è valido.", "NOTANEMAIL": "Il valore dato non è un indirizzo e-mail.", "MINLENGTH": "Deve essere lunga almeno {{requiredLength}} caratteri.", + "MAXLENGTH": "Deve contenere meno di {{requiredLength}} caratteri.", "UPPERCASEMISSING": "Deve includere un carattere maiuscolo.", "LOWERCASEMISSING": "Deve includere un carattere minuscolo.", "SYMBOLERROR": "Deve includere un simbolo o un segno di punteggiatura.", @@ -878,7 +879,8 @@ "SET": "Imposta nuova password", "RESENDNOTIFICATION": "Invia email per la reimpostazione", "REQUIRED": "Mancano alcuni campi obbligatori.", - "MINLENGTHERROR": "Deve essere lunga almeno {{valore}} caratteri." + "MINLENGTHERROR": "Deve essere lunga almeno {{valore}} caratteri.", + "MAXLENGTHERROR": "Deve contenere meno di {{value}} caratteri" }, "ID": "ID", "EMAIL": "E-mail", diff --git a/console/src/assets/i18n/ja.json b/console/src/assets/i18n/ja.json index 82f36fa7bf..30f1f8485c 100644 --- a/console/src/assets/i18n/ja.json +++ b/console/src/assets/i18n/ja.json @@ -595,6 +595,7 @@ "INVALID_FORMAT": "不正なフォーマットです", "NOTANEMAIL": "入力された値がメールアドレスではありません。", "MINLENGTH": "{{requiredLength}} 文字以上の文字列が必要です。", + "MAXLENGTH": "{{requiredLength}}文字以下でなければなりません.", "UPPERCASEMISSING": "大文字を含める必要があります。", "LOWERCASEMISSING": "小文字を含める必要があります。", "SYMBOLERROR": "記号を含める必要があります。", @@ -880,7 +881,8 @@ "SET": "新しいパスワードを設定する", "RESENDNOTIFICATION": "パスワードリセットのリンクを送信する", "REQUIRED": "一部の必須項目が不足しています。", - "MINLENGTHERROR": "最小で{{value}}文字の長さが必要です。" + "MINLENGTHERROR": "最小で{{value}}文字の長さが必要です。", + "MAXLENGTHERROR": "{{value}}文字以下でなければなりません" }, "ID": "id", "EMAIL": "Eメール", diff --git a/console/src/assets/i18n/mk.json b/console/src/assets/i18n/mk.json index 7b0095bf5e..55f52bc24b 100644 --- a/console/src/assets/i18n/mk.json +++ b/console/src/assets/i18n/mk.json @@ -595,6 +595,7 @@ "INVALID_FORMAT": "Невалиден формат.", "NOTANEMAIL": "Внесената вредност не е е-пошта.", "MINLENGTH": "Мора да биде најмалку {{requiredLength}} карактери долга.", + "MAXLENGTH": "Мора да биде помалку од {{requiredLength}} карактери.", "UPPERCASEMISSING": "Мора да содржи голема буква.", "LOWERCASEMISSING": "Мора да содржи мала буква.", "SYMBOLERROR": "Мора да содржи симбол или знак за интерпункција.", @@ -880,7 +881,8 @@ "SET": "Постави нова лозинка", "RESENDNOTIFICATION": "Испрати линк за ресетирање на лозинката", "REQUIRED": "Некои задолжителни полиња не се пополнети.", - "MINLENGTHERROR": "Мора да биде најмалку {{value}} карактери долга." + "MINLENGTHERROR": "Мора да биде најмалку {{value}} карактери долга.", + "MAXLENGTHERROR": "Мора да биде помалку од {{value}} карактери" }, "ID": "ID", "EMAIL": "E-пошта", diff --git a/console/src/assets/i18n/nl.json b/console/src/assets/i18n/nl.json index 1e4fb7abfd..c2526c848d 100644 --- a/console/src/assets/i18n/nl.json +++ b/console/src/assets/i18n/nl.json @@ -595,6 +595,7 @@ "INVALID_FORMAT": "De opmaak is ongeldig.", "NOTANEMAIL": "De opgegeven waarde is geen e-mailadres.", "MINLENGTH": "Moet minimaal {{requiredLength}} tekens lang zijn.", + "MAXLENGTH": "Moet minder dan {{requiredLength}} tekens bevatten.", "UPPERCASEMISSING": "Moet een hoofdletter bevatten.", "LOWERCASEMISSING": "Moet een kleine letter bevatten.", "SYMBOLERROR": "Moet een symbool of leesteken bevatten.", @@ -880,7 +881,8 @@ "SET": "Stel nieuw wachtwoord in", "RESENDNOTIFICATION": "Stuur wachtwoord reset link", "REQUIRED": "Sommige verplichte velden ontbreken.", - "MINLENGTHERROR": "Moet minstens {{value}} tekens lang zijn." + "MINLENGTHERROR": "Moet minstens {{value}} tekens lang zijn.", + "MAXLENGTHERROR": "Moet minder dan {{value}} tekens bevatten" }, "ID": "ID", "EMAIL": "E-mail", diff --git a/console/src/assets/i18n/pl.json b/console/src/assets/i18n/pl.json index cab3498076..65e13ce71f 100644 --- a/console/src/assets/i18n/pl.json +++ b/console/src/assets/i18n/pl.json @@ -594,6 +594,7 @@ "INVALID_FORMAT": "Format jest nieprawidłowy.", "NOTANEMAIL": "Podana wartość nie jest adresem e-mail.", "MINLENGTH": "Musi mieć co najmniej {{requiredLength}} znaków.", + "MAXLENGTH": "Musi zawierać mniej niż {{requiredLength}} znaków.", "UPPERCASEMISSING": "Musi zawierać wielką literę.", "LOWERCASEMISSING": "Musi zawierać małą literę.", "SYMBOLERROR": "Musi zawierać symbol lub znak interpunkcyjny.", @@ -879,7 +880,8 @@ "SET": "Ustaw nowe hasło", "RESENDNOTIFICATION": "Wyślij link resetowania hasła", "REQUIRED": "Brakuje niektórych wymaganych pól.", - "MINLENGTHERROR": "Musi mieć co najmniej {{value}} znaków." + "MINLENGTHERROR": "Musi mieć co najmniej {{value}} znaków.", + "MAXLENGTHERROR": "Musi zawierać mniej niż {{value}} znaków" }, "ID": "ID", "EMAIL": "E-mail", diff --git a/console/src/assets/i18n/pt.json b/console/src/assets/i18n/pt.json index 1c9d5a3c36..aee0da5a02 100644 --- a/console/src/assets/i18n/pt.json +++ b/console/src/assets/i18n/pt.json @@ -595,6 +595,7 @@ "INVALID_FORMAT": "O formato é inválido.", "NOTANEMAIL": "O valor fornecido não é um endereço de e-mail.", "MINLENGTH": "Deve ter pelo menos {{requiredLength}} caracteres.", + "MAXLENGTH": "Deve ter menos de {{requiredLength}} caracteres.", "UPPERCASEMISSING": "Deve incluir uma letra maiúscula.", "LOWERCASEMISSING": "Deve incluir uma letra minúscula.", "SYMBOLERROR": "Deve incluir um símbolo ou caractere de pontuação.", @@ -880,7 +881,8 @@ "SET": "Definir Nova Senha", "RESENDNOTIFICATION": "Enviar Link de Redefinição de Senha", "REQUIRED": "Algumas informações obrigatórias estão faltando.", - "MINLENGTHERROR": "Deve ter pelo menos {{value}} caracteres." + "MINLENGTHERROR": "Deve ter pelo menos {{value}} caracteres.", + "MAXLENGTHERROR": "Deve ter menos de {{value}} caracteres" }, "ID": "ID", "EMAIL": "E-mail", diff --git a/console/src/assets/i18n/ru.json b/console/src/assets/i18n/ru.json index 4363ee1ae7..294039adc9 100644 --- a/console/src/assets/i18n/ru.json +++ b/console/src/assets/i18n/ru.json @@ -594,6 +594,7 @@ "INVALID_FORMAT": "Форматирование неверно.", "NOTANEMAIL": "Данное значение не является адресом электронной почты.", "MINLENGTH": "Должно быть не менее {{requiredLength}} символов.", + "MAXLENGTH": "Должно быть меньше {{requiredLength}} символов.", "UPPERCASEMISSING": "Должен содержать символ верхнего регистра.", "LOWERCASEMISSING": "Должен включать строчные буквы.", "SYMBOLERROR": "Должен содержать символ или знак препинания.", @@ -887,7 +888,8 @@ "RESENDNOTIFICATION": "Отправить ссылку для сброса пароля", "REQUIRED": "Отсутствуют некоторые обязательные поля.", "MINLENGTHERROR": "Должно быть не менее {{value}} символов.", - "NOTEQUAL": "Указанные пароли не совпадают." + "NOTEQUAL": "Указанные пароли не совпадают.", + "MAXLENGTHERROR": "Должно быть меньше {{value}} символов" }, "ID": "Идентификатор", "EMAIL": "Электронная почта", diff --git a/console/src/assets/i18n/zh.json b/console/src/assets/i18n/zh.json index f983fcf138..c8b2baa0a1 100644 --- a/console/src/assets/i18n/zh.json +++ b/console/src/assets/i18n/zh.json @@ -594,6 +594,7 @@ "INVALID_FORMAT": "格式是无效的。", "NOTANEMAIL": "给定的值不是合法电子邮件地址。", "MINLENGTH": "长度必须至少是{{requiredLength}}字符。", + "MAXLENGTH": "必须少于{{requiredLength}}个字符.", "UPPERCASEMISSING": "密码必须包含大写字符。", "LOWERCASEMISSING": "密码必须包含小写字符。", "SYMBOLERROR": "密码必须包含符号或标点符号。", @@ -879,7 +880,8 @@ "SET": "设置新密码", "RESENDNOTIFICATION": "发送重置密码链接", "REQUIRED": "缺少必填字段。", - "MINLENGTHERROR": "密码长度必须至少为 {{value}} 个字符。" + "MINLENGTHERROR": "密码长度必须至少为 {{value}} 个字符。", + "MAXLENGTHERROR": "必须少于{{value}}个字符" }, "ID": "ID", "EMAIL": "电子邮件", diff --git a/internal/api/ui/login/static/i18n/bg.yaml b/internal/api/ui/login/static/i18n/bg.yaml index 12f5e57bd6..61ef709f69 100644 --- a/internal/api/ui/login/static/i18n/bg.yaml +++ b/internal/api/ui/login/static/i18n/bg.yaml @@ -27,19 +27,22 @@ SelectAccount: SessionState0: активен SessionState1: Не сте в профила си MustBeMemberOfOrg: 'Потребителят трябва да е член на {{.OrgName}} организация.' + Password: Title: Парола - Description: Въведете вашите данни за вход. + Description: Въведете данните си за вход. PasswordLabel: Парола - MinLength: Минимална дължина - HasUppercase: Главна буква - HasLowercase: Малка буква - HasNumber: Номер - HasSymbol: Символ - Confirmation: Съвпадение за потвърждение - ResetLinkText: нулиране на парола - BackButtonText: обратно - NextButtonText: следващия + MinLength: Трябва да е поне + MinLengthp2: символа дълга. + MaxLength: Трябва да е по-малко от 70 символа. + HasUppercase: Трябва да включва главна буква. + HasLowercase: Трябва да включва малка буква. + HasNumber: Трябва да включва число. + HasSymbol: Трябва да включва символ. + Confirmation: Потвърждението на паролата съвпада. + ResetLinkText: Нулиране на паролата + BackButtonText: Назад + NextButtonText: Напред UsernameChange: Title: Промяна на потребителското име Description: Задайте новото си потребителско име diff --git a/internal/api/ui/login/static/i18n/cs.yaml b/internal/api/ui/login/static/i18n/cs.yaml index 3b97b14bf2..52e88e526b 100644 --- a/internal/api/ui/login/static/i18n/cs.yaml +++ b/internal/api/ui/login/static/i18n/cs.yaml @@ -32,12 +32,14 @@ Password: Title: Heslo Description: Zadejte své přihlašovací údaje. PasswordLabel: Heslo - MinLength: Minimální délka - HasUppercase: Velké písmeno - HasLowercase: Malé písmeno - HasNumber: Číslo - HasSymbol: Symbol - Confirmation: Potvrzení shody + MinLength: Musí být alespoň + MinLengthp2: znaků dlouhé. + MaxLength: Musí být kratší než 70 znaků. + HasUppercase: Musí obsahovat velké písmeno. + HasLowercase: Musí obsahovat malé písmeno. + HasNumber: Musí obsahovat číslo. + HasSymbol: Musí obsahovat symbol. + Confirmation: Potvrzení hesla odpovídá. ResetLinkText: Obnovit heslo BackButtonText: Zpět NextButtonText: Další diff --git a/internal/api/ui/login/static/i18n/de.yaml b/internal/api/ui/login/static/i18n/de.yaml index d258f09aa6..4022abfa74 100644 --- a/internal/api/ui/login/static/i18n/de.yaml +++ b/internal/api/ui/login/static/i18n/de.yaml @@ -29,15 +29,17 @@ SelectAccount: MustBeMemberOfOrg: Der Benutzer muss der Organisation {{.OrgName}} angehören. Password: - Title: Willkommen zurück! - Description: Gib deine Benutzerdaten ein. + Title: Passwort + Description: Geben Sie Ihre Anmeldedaten ein. PasswordLabel: Passwort - MinLength: Mindestlänge - HasUppercase: Großbuchstaben - HasLowercase: Kleinbuchstaben - HasNumber: Nummer - HasSymbol: Symbol - Confirmation: Wiederholung stimmt überein + MinLength: Muss mindestens + MinLengthp2: Zeichen lang sein. + MaxLength: Muss weniger als 70 Zeichen lang sein. + HasUppercase: Muss einen Großbuchstaben enthalten. + HasLowercase: Muss einen Kleinbuchstaben enthalten. + HasNumber: Muss eine Zahl enthalten. + HasSymbol: Muss ein Symbol enthalten. + Confirmation: Passwortbestätigung stimmt überein. ResetLinkText: Passwort zurücksetzen BackButtonText: Zurück NextButtonText: Weiter diff --git a/internal/api/ui/login/static/i18n/en.yaml b/internal/api/ui/login/static/i18n/en.yaml index 338107060d..b3f6cd4793 100644 --- a/internal/api/ui/login/static/i18n/en.yaml +++ b/internal/api/ui/login/static/i18n/en.yaml @@ -32,12 +32,14 @@ Password: Title: Password Description: Enter your login data. PasswordLabel: Password - MinLength: Minimum length - HasUppercase: Uppercase letter - HasLowercase: Lowercase letter - HasNumber: Number - HasSymbol: Symbol - Confirmation: Confirmation match + MinLength: Must be at least + MinLengthp2: characters long. + MaxLength: Must be less than 70 characters long. + HasUppercase: Must include an uppercase letter. + HasLowercase: Must include a lowercase letter. + HasNumber: Must include a number. + HasSymbol: Must include a symbol. + Confirmation: Password confirmation matched. ResetLinkText: Reset Password BackButtonText: Back NextButtonText: Next diff --git a/internal/api/ui/login/static/i18n/es.yaml b/internal/api/ui/login/static/i18n/es.yaml index ef091f2910..29336ab5a2 100644 --- a/internal/api/ui/login/static/i18n/es.yaml +++ b/internal/api/ui/login/static/i18n/es.yaml @@ -30,17 +30,19 @@ SelectAccount: Password: Title: Contraseña - Description: Introduce tus datos de inicio de sesión. + Description: Introduce tus datos de acceso. PasswordLabel: Contraseña - MinLength: Longitud mínima - HasUppercase: Una letra mayúscula - HasLowercase: Una letra minúscula - HasNumber: Número - HasSymbol: Símbolo - Confirmation: Las contraseñas coinciden - ResetLinkText: restablecer contraseña - BackButtonText: atrás - NextButtonText: siguiente + MinLength: Debe tener al menos + MinLengthp2: caracteres de longitud. + MaxLength: Debe tener menos de 70 caracteres de longitud. + HasUppercase: Debe incluir una letra mayúscula. + HasLowercase: Debe incluir una letra minúscula. + HasNumber: Debe incluir un número. + HasSymbol: Debe incluir un símbolo. + Confirmation: La confirmación de la contraseña coincide. + ResetLinkText: Restablecer contraseña + BackButtonText: Atrás + NextButtonText: Siguiente UsernameChange: Title: Cambiar nombre de usuario diff --git a/internal/api/ui/login/static/i18n/fr.yaml b/internal/api/ui/login/static/i18n/fr.yaml index 44532ca8de..69cd70518a 100644 --- a/internal/api/ui/login/static/i18n/fr.yaml +++ b/internal/api/ui/login/static/i18n/fr.yaml @@ -32,12 +32,14 @@ Password: Title: Mot de passe Description: Entrez vos identifiants. PasswordLabel: Mot de passe - MinLength: Longueur minimale - HasUppercase: Lettre majuscule - HasLowercase: Lettre minuscule - HasNumber: Numéro - HasSymbol: Symbole - Confirmation: Les mots de passe sont identiques + MinLength: Doit contenir au moins + MinLengthp2: caractères. + MaxLength: Doit contenir moins de 70 caractères. + HasUppercase: Doit inclure une lettre majuscule. + HasLowercase: Doit inclure une lettre minuscule. + HasNumber: Doit inclure un chiffre. + HasSymbol: Doit inclure un symbole. + Confirmation: La confirmation du mot de passe correspond. ResetLinkText: Réinitialiser le mot de passe BackButtonText: Retour NextButtonText: Suivant diff --git a/internal/api/ui/login/static/i18n/it.yaml b/internal/api/ui/login/static/i18n/it.yaml index 24e9733943..8b969e6c6f 100644 --- a/internal/api/ui/login/static/i18n/it.yaml +++ b/internal/api/ui/login/static/i18n/it.yaml @@ -32,14 +32,16 @@ Password: Title: Password Description: Inserisci i tuoi dati di accesso. PasswordLabel: Password - MinLength: Lunghezza minima - HasUppercase: Lettera maiuscola - HasLowercase: Lettera minuscola - HasNumber: Numero - HasSymbol: Simbolo - Confirmation: Conferma password - ResetLinkText: Password dimenticata? - BackButtonText: indietro + MinLength: Deve contenere almeno + MinLengthp2: caratteri. + MaxLength: Deve contenere meno di 70 caratteri. + HasUppercase: Deve includere una lettera maiuscola. + HasLowercase: Deve includere una lettera minuscola. + HasNumber: Deve includere un numero. + HasSymbol: Deve includere un simbolo. + Confirmation: La conferma della password corrisponde. + ResetLinkText: Reimposta password + BackButtonText: Indietro NextButtonText: Avanti UsernameChange: diff --git a/internal/api/ui/login/static/i18n/ja.yaml b/internal/api/ui/login/static/i18n/ja.yaml index e4ca75bad7..da55ccb523 100644 --- a/internal/api/ui/login/static/i18n/ja.yaml +++ b/internal/api/ui/login/static/i18n/ja.yaml @@ -22,16 +22,18 @@ SelectAccount: MustBeMemberOfOrg: ユーザーは組織 {{.OrgName}} のメンバーである必要があります。 Password: - Title: パスワードの入力 - Description: ログインデータを入力します。 + Title: パスワード + Description: ログインデータを入力してください。 PasswordLabel: パスワード - MinLength: 文字列の長さ - HasUppercase: 大文字 - HasLowercase: 小文字 - HasNumber: 数字 - HasSymbol: シンボル - Confirmation: パスワードの確認 - ResetLinkText: パスワードを再設定する + MinLength: 少なくとも + MinLengthp2: 文字でなければなりません。 + MaxLength: 70文字以下でなければなりません。 + HasUppercase: 大文字を含む必要があります。 + HasLowercase: 小文字を含む必要があります。 + HasNumber: 数字を含む必要があります。 + HasSymbol: 記号を含む必要があります。 + Confirmation: パスワードの確認が一致しました。 + ResetLinkText: パスワードをリセット BackButtonText: 戻る NextButtonText: 次へ diff --git a/internal/api/ui/login/static/i18n/mk.yaml b/internal/api/ui/login/static/i18n/mk.yaml index dafc520d56..c05af2b691 100644 --- a/internal/api/ui/login/static/i18n/mk.yaml +++ b/internal/api/ui/login/static/i18n/mk.yaml @@ -32,15 +32,17 @@ Password: Title: Лозинка Description: Внесете ги вашите податоци за најава. PasswordLabel: Лозинка - MinLength: Минимална должина - HasUppercase: Голема буква - HasLowercase: Мала буква - HasNumber: Број - HasSymbol: Симбол - Confirmation: Потврда на лозинка - ResetLinkText: ресетирај лозинка - BackButtonText: назад - NextButtonText: следно + MinLength: Мора да биде најмалку + MinLengthp2: карактери долго. + MaxLength: Мора да биде помалку од 70 карактери. + HasUppercase: Мора да вклучи голема буква. + HasLowercase: Мора да вклучи мала буква. + HasNumber: Мора да вклучи број. + HasSymbol: Мора да вклучи симбол. + Confirmation: Потврдата за лозинката се совпаѓа. + ResetLinkText: Ресетирај лозинка + BackButtonText: Назад + NextButtonText: Напред UsernameChange: Title: Промена на корисничко име diff --git a/internal/api/ui/login/static/i18n/nl.yaml b/internal/api/ui/login/static/i18n/nl.yaml index 68d8ffa4a1..5b76ee4179 100644 --- a/internal/api/ui/login/static/i18n/nl.yaml +++ b/internal/api/ui/login/static/i18n/nl.yaml @@ -32,13 +32,15 @@ Password: Title: Wachtwoord Description: Voer uw inloggegevens in. PasswordLabel: Wachtwoord - MinLength: Minimum lengte - HasUppercase: Hoofdletter - HasLowercase: Kleine letter - HasNumber: Nummer - HasSymbol: Symbool - Confirmation: Bevestiging komt overeen - ResetLinkText: Reset Wachtwoord + MinLength: Moet minstens + MinLengthp2: tekens lang zijn. + MaxLength: Moet minder dan 70 tekens lang zijn. + HasUppercase: Moet een hoofdletter bevatten. + HasLowercase: Moet een kleine letter bevatten. + HasNumber: Moet een nummer bevatten. + HasSymbol: Moet een symbool bevatten. + Confirmation: Wachtwoordbevestiging komt overeen. + ResetLinkText: Wachtwoord resetten BackButtonText: Terug NextButtonText: Volgende diff --git a/internal/api/ui/login/static/i18n/pl.yaml b/internal/api/ui/login/static/i18n/pl.yaml index e23ce3fa71..3f9def93a2 100644 --- a/internal/api/ui/login/static/i18n/pl.yaml +++ b/internal/api/ui/login/static/i18n/pl.yaml @@ -32,15 +32,17 @@ Password: Title: Hasło Description: Wprowadź swoje dane logowania. PasswordLabel: Hasło - MinLength: Minimalna długość - HasUppercase: Duża litera - HasLowercase: Mała litera - HasNumber: Liczba - HasSymbol: Symbol - Confirmation: Potwierdzenie zgodności - ResetLinkText: zresetuj hasło - BackButtonText: wróć - NextButtonText: dalej + MinLength: Musi zawierać co najmniej + MinLengthp2: znaków. + MaxLength: Musi zawierać mniej niż 70 znaków. + HasUppercase: Musi zawierać dużą literę. + HasLowercase: Musi zawierać małą literę. + HasNumber: Musi zawierać numer. + HasSymbol: Musi zawierać symbol. + Confirmation: Potwierdzenie hasła pasuje. + ResetLinkText: Zresetuj hasło + BackButtonText: Wstecz + NextButtonText: Dalej UsernameChange: Title: Zmiana nazwy użytkownika diff --git a/internal/api/ui/login/static/i18n/pt.yaml b/internal/api/ui/login/static/i18n/pt.yaml index 19d00c72f4..99aff3a8c3 100644 --- a/internal/api/ui/login/static/i18n/pt.yaml +++ b/internal/api/ui/login/static/i18n/pt.yaml @@ -32,15 +32,17 @@ Password: Title: Senha Description: Insira seus dados de login. PasswordLabel: Senha - MinLength: Comprimento mínimo - HasUppercase: Letra maiúscula - HasLowercase: Letra minúscula - HasNumber: Número - HasSymbol: Símbolo - Confirmation: Confirmação corresponde - ResetLinkText: redefinir senha - BackButtonText: voltar - NextButtonText: próximo + MinLength: Deve ter pelo menos + MinLengthp2: caracteres. + MaxLength: Deve ter menos de 70 caracteres. + HasUppercase: Deve incluir uma letra maiúscula. + HasLowercase: Deve incluir uma letra minúscula. + HasNumber: Deve incluir um número. + HasSymbol: Deve incluir um símbolo. + Confirmation: A confirmação da senha corresponde. + ResetLinkText: Redefinir senha + BackButtonText: Voltar + NextButtonText: Próximo UsernameChange: Title: Alterar nome de usuário diff --git a/internal/api/ui/login/static/i18n/ru.yaml b/internal/api/ui/login/static/i18n/ru.yaml index fb88312486..cd756cbdd8 100644 --- a/internal/api/ui/login/static/i18n/ru.yaml +++ b/internal/api/ui/login/static/i18n/ru.yaml @@ -29,17 +29,19 @@ SelectAccount: Password: Title: Пароль - Description: Введите ваши данные. + Description: Введите свои данные для входа. PasswordLabel: Пароль - MinLength: Минимальная длина - HasUppercase: Заглавная буква - HasLowercase: Строчная буква - HasNumber: Цифра - HasSymbol: Символ - Confirmation: Подтверждение пароля - ResetLinkText: сброс пароля - BackButtonText: назад - NextButtonText: далее + MinLength: Должно быть не менее + MinLengthp2: символов. + MaxLength: Должно быть меньше 70 символов. + HasUppercase: Должно содержать заглавную букву. + HasLowercase: Должно содержать строчную букву. + HasNumber: Должно содержать число. + HasSymbol: Должно содержать символ. + Confirmation: Подтверждение пароля совпадает. + ResetLinkText: Сбросить пароль + BackButtonText: Назад + NextButtonText: Вперед UsernameChange: Title: Изменение логина diff --git a/internal/api/ui/login/static/i18n/zh.yaml b/internal/api/ui/login/static/i18n/zh.yaml index bf31d270bb..85230efe0f 100644 --- a/internal/api/ui/login/static/i18n/zh.yaml +++ b/internal/api/ui/login/static/i18n/zh.yaml @@ -32,15 +32,17 @@ Password: Title: 密码 Description: 输入您的登录数据。 PasswordLabel: 密码 - MinLength: 密码 - HasUppercase: 大写字母 - HasLowercase: 小写字母 - HasNumber: 数字 - HasSymbol: 符号 - Confirmation: 确认匹配 - ResetLinkText: 重设密码 - BackButtonText: 后退 - NextButtonText: 继续 + MinLength: 必须至少有 + MinLengthp2: 个字符。 + MaxLength: 必须少于70个字符。 + HasUppercase: 必须包含一个大写字母。 + HasLowercase: 必须包含一个小写字母。 + HasNumber: 必须包含一个数字。 + HasSymbol: 必须包含一个符号。 + Confirmation: 密码确认匹配。 + ResetLinkText: 重置密码 + BackButtonText: 返回 + NextButtonText: 下一步 UsernameChange: Title: 更改用户名 diff --git a/internal/api/ui/login/static/resources/scripts/password_policy_check.js b/internal/api/ui/login/static/resources/scripts/password_policy_check.js index ce5936b32b..4a9712f815 100644 --- a/internal/api/ui/login/static/resources/scripts/password_policy_check.js +++ b/internal/api/ui/login/static/resources/scripts/password_policy_check.js @@ -15,6 +15,14 @@ function ComplexityPolicyCheck(passwordElement, passwordConfirmationElement) { invalid++; } + const maxLengthElem = document.getElementById("maxlength"); + if (passwordElement.value.length <= 70) { + ValidPolicyFlipped(maxLengthElem); + } else { + InvalidPolicyFlipped(maxLengthElem); + invalid++; + } + const upper = document.getElementById("uppercase"); if (upperRegex !== "") { if (RegExp(upperRegex).test(passwordElement.value)) { @@ -84,6 +92,14 @@ function ValidPolicy(element) { element.getElementsByTagName("i")[0].classList.add("lgn-valid"); } +function ValidPolicyFlipped(element) { + element.classList.add("valid"); + element.getElementsByTagName("i")[0].classList.remove("lgn-warn"); + element.getElementsByTagName("i")[0].classList.remove("lgn-icon-times-solid"); + element.getElementsByTagName("i")[0].classList.add("lgn-valid"); + element.getElementsByTagName("i")[0].classList.add("lgn-icon-check-solid"); +} + function InvalidPolicy(element) { element.classList.add("invalid"); element.getElementsByTagName("i")[0].classList.remove("lgn-valid"); @@ -91,3 +107,11 @@ function InvalidPolicy(element) { element.getElementsByTagName("i")[0].classList.add("lgn-warn"); element.getElementsByTagName("i")[0].classList.add("lgn-icon-times-solid"); } + +function InvalidPolicyFlipped(element) { + element.classList.remove("valid"); + element.getElementsByTagName("i")[0].classList.remove("lgn-icon-check-solid"); + element.getElementsByTagName("i")[0].classList.remove("lgn-valid"); + element.getElementsByTagName("i")[0].classList.add("lgn-icon-times-solid"); + element.getElementsByTagName("i")[0].classList.add("lgn-warn"); +} diff --git a/internal/api/ui/login/static/templates/password_complexity_policy.html b/internal/api/ui/login/static/templates/password_complexity_policy.html index f8f5d34765..19a4c9ce96 100644 --- a/internal/api/ui/login/static/templates/password_complexity_policy.html +++ b/internal/api/ui/login/static/templates/password_complexity_policy.html @@ -1,6 +1,7 @@ {{define "password-complexity-policy-description"}}
    -
  • {{t "Password.MinLength"}} {{.MinLength}}
    • +
  • {{t "Password.MinLength"}} {{.MinLength}} {{t "Password.MinLengthp2"}}
    • +
  • {{t "Password.MaxLength"}}
    • {{if .HasUppercase }}
  • {{t "Password.HasUppercase"}}
    • {{end}} From e58869c090c38b63fd9e6db5a9e35cff9b2765ae Mon Sep 17 00:00:00 2001 From: Stefan Benz <46600784+stebenz@users.noreply.github.com> Date: Thu, 23 May 2024 12:28:46 +0200 Subject: [PATCH 24/35] fix: setup instance with human an machine user at creation (#7997) # Which Problems Are Solved Currently on instance setup there is only a possibility to either use a human or a machine user and not both at creation. # How the Problems Are Solved The logic in the instance setup is refactored and changed so there is not an exclusion. # Additional Changes Refactoring, so that unit testing is possible to add for the different elements of an instance setup. # Additional Context Closes #6430 --- internal/command/command.go | 3 + internal/command/instance.go | 263 ++-- internal/command/instance_domain.go | 2 +- internal/command/instance_policy_label.go | 35 +- .../command/instance_policy_label_test.go | 154 --- internal/command/instance_test.go | 1207 +++++++++++++++++ internal/command/org.go | 8 +- 7 files changed, 1393 insertions(+), 279 deletions(-) diff --git a/internal/command/command.go b/internal/command/command.go index 8d77be765e..d8e6cfb7cf 100644 --- a/internal/command/command.go +++ b/internal/command/command.go @@ -82,6 +82,8 @@ type Commands struct { ActionFunctionExisting func(function string) bool EventExisting func(event string) bool EventGroupExisting func(group string) bool + + GenerateDomain func(instanceName, domain string) (string, error) } func StartCommands( @@ -168,6 +170,7 @@ func StartCommands( Issuer: defaults.Multifactors.OTP.Issuer, }, }, + GenerateDomain: domain.NewGeneratedInstanceDomain, } if defaultSecretGenerators != nil && defaultSecretGenerators.ClientSecret != nil { diff --git a/internal/command/instance.go b/internal/command/instance.go index 852e92ee6f..b5fb700459 100644 --- a/internal/command/instance.go +++ b/internal/command/instance.go @@ -142,6 +142,8 @@ type SecretGenerators struct { } type ZitadelConfig struct { + instanceID string + orgID string projectID string mgmtAppID string adminAppID string @@ -152,6 +154,16 @@ type ZitadelConfig struct { } func (s *InstanceSetup) generateIDs(idGenerator id.Generator) (err error) { + s.zitadel.instanceID, err = idGenerator.Next() + if err != nil { + return err + } + + s.zitadel.orgID, err = idGenerator.Next() + if err != nil { + return err + } + s.zitadel.projectID, err = idGenerator.Next() if err != nil { return err @@ -185,36 +197,88 @@ func (s *InstanceSetup) generateIDs(idGenerator id.Generator) (err error) { } func (c *Commands) SetUpInstance(ctx context.Context, setup *InstanceSetup) (string, string, *MachineKey, *domain.ObjectDetails, error) { - instanceID, err := c.idGenerator.Next() + if err := setup.generateIDs(c.idGenerator); err != nil { + return "", "", nil, nil, err + } + ctx = contextWithInstanceSetupInfo(ctx, setup.zitadel.instanceID, setup.zitadel.projectID, setup.zitadel.consoleAppID, c.externalDomain) + + validations, pat, machineKey, err := setUpInstance(ctx, c, setup) if err != nil { return "", "", nil, nil, err } - ctx = authz.SetCtxData(authz.WithRequestedDomain(authz.WithInstanceID(ctx, instanceID), c.externalDomain), authz.CtxData{OrgID: instanceID, ResourceOwner: instanceID}) - - orgID, err := c.idGenerator.Next() + //nolint:staticcheck + cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, validations...) if err != nil { return "", "", nil, nil, err } - userID, err := c.idGenerator.Next() + events, err := c.eventstore.Push(ctx, cmds...) if err != nil { return "", "", nil, nil, err } - if err = setup.generateIDs(c.idGenerator); err != nil { - return "", "", nil, nil, err + var token string + if pat != nil { + token = pat.Token } - ctx = authz.WithConsole(ctx, setup.zitadel.projectID, setup.zitadel.consoleAppID) - instanceAgg := instance.NewAggregate(instanceID) - orgAgg := org.NewAggregate(orgID) - userAgg := user.NewAggregate(userID, orgID) - projectAgg := project.NewAggregate(setup.zitadel.projectID, orgID) - limitsAgg := limits.NewAggregate(setup.zitadel.limitsID, instanceID) - restrictionsAgg := restrictions.NewAggregate(setup.zitadel.restrictionsID, instanceID, instanceID) + return setup.zitadel.instanceID, token, machineKey, &domain.ObjectDetails{ + Sequence: events[len(events)-1].Sequence(), + EventDate: events[len(events)-1].CreatedAt(), + ResourceOwner: setup.zitadel.orgID, + }, nil +} - validations := []preparation.Validation{ +func contextWithInstanceSetupInfo(ctx context.Context, instanceID, projectID, consoleAppID, externalDomain string) context.Context { + return authz.WithConsole( + authz.SetCtxData( + authz.WithRequestedDomain( + authz.WithInstanceID( + ctx, + instanceID), + externalDomain, + ), + authz.CtxData{ResourceOwner: instanceID}, + ), + projectID, + consoleAppID, + ) +} + +func setUpInstance(ctx context.Context, c *Commands, setup *InstanceSetup) (validations []preparation.Validation, pat *PersonalAccessToken, machineKey *MachineKey, err error) { + instanceAgg := instance.NewAggregate(setup.zitadel.instanceID) + + validations = setupInstanceElements(instanceAgg, setup) + + // default organization on setup'd instance + pat, machineKey, err = setupDefaultOrg(ctx, c, &validations, instanceAgg, setup.Org.Name, setup.Org.Machine, setup.Org.Human, setup.zitadel) + if err != nil { + return nil, nil, nil, err + } + + // domains + if err := setupGeneratedDomain(ctx, c, &validations, instanceAgg, setup.InstanceName); err != nil { + return nil, nil, nil, err + } + setupCustomDomain(c, &validations, instanceAgg, setup.CustomDomain) + + // optional setting if set + setupMessageTexts(&validations, setup.MessageTexts, instanceAgg) + if err := setupQuotas(c, &validations, setup.Quotas, setup.zitadel.instanceID); err != nil { + return nil, nil, nil, err + } + setupSMTPSettings(c, &validations, setup.SMTPConfiguration, instanceAgg) + setupOIDCSettings(c, &validations, setup.OIDCSettings, instanceAgg) + setupFeatures(&validations, setup.Features, setup.zitadel.instanceID) + setupLimits(c, &validations, limits.NewAggregate(setup.zitadel.limitsID, setup.zitadel.instanceID), setup.Limits) + setupRestrictions(c, &validations, restrictions.NewAggregate(setup.zitadel.restrictionsID, setup.zitadel.instanceID, setup.zitadel.instanceID), setup.Restrictions) + + return validations, pat, machineKey, nil +} + +func setupInstanceElements(instanceAgg *instance.Aggregate, setup *InstanceSetup) []preparation.Validation { + return []preparation.Validation{ prepareAddInstance(instanceAgg, setup.InstanceName, setup.DefaultLanguage), prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeAppSecret, setup.SecretGenerators.ClientSecret), prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeInitCode, setup.SecretGenerators.InitializeUserCode), @@ -292,54 +356,8 @@ func (c *Commands) SetUpInstance(ctx context.Context, setup *InstanceSetup) (str setup.LabelPolicy.DisableWatermark, setup.LabelPolicy.ThemeMode, ), - prepareActivateDefaultLabelPolicy(instanceAgg), - prepareAddDefaultEmailTemplate(instanceAgg, setup.EmailTemplate), } - if err := setupQuotas(c, &validations, setup.Quotas, instanceID); err != nil { - return "", "", nil, nil, err - } - setupMessageTexts(&validations, setup.MessageTexts, instanceAgg) - validations = append(validations, - AddOrgCommand(ctx, orgAgg, setup.Org.Name), - c.prepareSetDefaultOrg(instanceAgg, orgAgg.ID), - ) - pat, machineKey, err := setupAdmin(c, &validations, setup.Org.Machine, setup.Org.Human, orgID, userID, userAgg) - if err != nil { - return "", "", nil, nil, err - } - setupMinimalInterfaces(c, &validations, instanceAgg, projectAgg, orgAgg, userID, setup.zitadel) - if err := setupGeneratedDomain(ctx, c, &validations, instanceAgg, setup.InstanceName); err != nil { - return "", "", nil, nil, err - } - setupCustomDomain(c, &validations, instanceAgg, setup.CustomDomain) - setupSMTPSettings(c, &validations, setup.SMTPConfiguration, instanceAgg) - setupOIDCSettings(c, &validations, setup.OIDCSettings, instanceAgg) - setupFeatures(&validations, setup.Features, instanceID) - setupLimits(c, &validations, limitsAgg, setup.Limits) - setupRestrictions(c, &validations, restrictionsAgg, setup.Restrictions) - - //nolint:staticcheck - cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, validations...) - if err != nil { - return "", "", nil, nil, err - } - - events, err := c.eventstore.Push(ctx, cmds...) - if err != nil { - return "", "", nil, nil, err - } - - var token string - if pat != nil { - token = pat.Token - } - - return instanceID, token, machineKey, &domain.ObjectDetails{ - Sequence: events[len(events)-1].Sequence(), - EventDate: events[len(events)-1].CreatedAt(), - ResourceOwner: orgID, - }, nil } func setupLimits(commands *Commands, validations *[]preparation.Validation, limitsAgg *limits.Aggregate, setLimits *SetLimits) { @@ -369,7 +387,9 @@ func setupQuotas(commands *Commands, validations *[]preparation.Validation, setQ } func setupFeatures(validations *[]preparation.Validation, features *InstanceFeatures, instanceID string) { - *validations = append(*validations, prepareSetFeatures(instanceID, features)) + if features != nil { + *validations = append(*validations, prepareSetFeatures(instanceID, features)) + } } func setupOIDCSettings(commands *Commands, validations *[]preparation.Validation, oidcSettings *OIDCSettings, instanceAgg *instance.Aggregate) { @@ -425,7 +445,9 @@ func setupGeneratedDomain(ctx context.Context, commands *Commands, validations * return nil } -func setupMinimalInterfaces(commands *Commands, validations *[]preparation.Validation, instanceAgg *instance.Aggregate, projectAgg *project.Aggregate, orgAgg *org.Aggregate, userID string, ids ZitadelConfig) { +func setupMinimalInterfaces(commands *Commands, validations *[]preparation.Validation, instanceAgg *instance.Aggregate, orgAgg *org.Aggregate, projectOwner string, ids ZitadelConfig) { + projectAgg := project.NewAggregate(ids.projectID, orgAgg.ID) + cnsl := &addOIDCApp{ AddApp: AddApp{ Aggregate: *projectAgg, @@ -446,10 +468,9 @@ func setupMinimalInterfaces(commands *Commands, validations *[]preparation.Valid IDTokenUserinfoAssertion: false, ClockSkew: 0, } + *validations = append(*validations, - commands.AddOrgMemberCommand(orgAgg, userID, domain.RoleOrgOwner), - commands.AddInstanceMemberCommand(instanceAgg, userID, domain.RoleIAMOwner), - AddProjectCommand(projectAgg, zitadelProjectName, userID, false, false, false, domain.PrivateLabelingSettingUnspecified), + AddProjectCommand(projectAgg, zitadelProjectName, projectOwner, false, false, false, domain.PrivateLabelingSettingUnspecified), SetIAMProject(instanceAgg, projectAgg.ID), commands.AddAPIAppCommand( @@ -490,37 +511,103 @@ func setupMinimalInterfaces(commands *Commands, validations *[]preparation.Valid ) } -func setupAdmin(commands *Commands, validations *[]preparation.Validation, machine *AddMachine, human *AddHuman, orgID, userID string, userAgg *user.Aggregate) (pat *PersonalAccessToken, machineKey *MachineKey, err error) { - // only a human or a machine user should be created as owner +func setupDefaultOrg(ctx context.Context, + commands *Commands, + validations *[]preparation.Validation, + instanceAgg *instance.Aggregate, + name string, + machine *AddMachine, + human *AddHuman, + ids ZitadelConfig, +) (pat *PersonalAccessToken, machineKey *MachineKey, err error) { + orgAgg := org.NewAggregate(ids.orgID) + + *validations = append( + *validations, + AddOrgCommand(ctx, orgAgg, name), + commands.prepareSetDefaultOrg(instanceAgg, ids.orgID), + ) + + projectOwner, pat, machineKey, err := setupAdmins(commands, validations, instanceAgg, orgAgg, machine, human) + if err != nil { + return nil, nil, err + } + setupMinimalInterfaces(commands, validations, instanceAgg, orgAgg, projectOwner, ids) + return pat, machineKey, nil +} + +func setupAdmins(commands *Commands, + validations *[]preparation.Validation, + instanceAgg *instance.Aggregate, + orgAgg *org.Aggregate, + machine *AddMachine, + human *AddHuman, +) (owner string, pat *PersonalAccessToken, machineKey *MachineKey, err error) { + if human == nil && machine == nil { + return "", nil, nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-z1yi2q2ot7", "Error.Instance.NoAdmin") + } + if machine != nil && machine.Machine != nil && !machine.Machine.IsZero() { - *validations = append(*validations, - AddMachineCommand(userAgg, machine.Machine), - ) - if machine.Pat != nil { - pat = NewPersonalAccessToken(orgID, userID, machine.Pat.ExpirationDate, machine.Pat.Scopes, domain.UserTypeMachine) - pat.TokenID, err = commands.idGenerator.Next() - if err != nil { - return nil, nil, err - } - *validations = append(*validations, prepareAddPersonalAccessToken(pat, commands.keyAlgorithm)) + machineUserID, err := commands.idGenerator.Next() + if err != nil { + return "", nil, nil, err } - if machine.MachineKey != nil { - machineKey = NewMachineKey(orgID, userID, machine.MachineKey.ExpirationDate, machine.MachineKey.Type) - machineKey.KeyID, err = commands.idGenerator.Next() - if err != nil { - return nil, nil, err - } - *validations = append(*validations, prepareAddUserMachineKey(machineKey, commands.machineKeySize)) + owner = machineUserID + + pat, machineKey, err = setupMachineAdmin(commands, validations, machine, orgAgg.ID, machineUserID) + if err != nil { + return "", nil, nil, err } - } else if human != nil { - human.ID = userID + + setupAdminMembers(commands, validations, instanceAgg, orgAgg, machineUserID) + } + if human != nil { + humanUserID, err := commands.idGenerator.Next() + if err != nil { + return "", nil, nil, err + } + owner = humanUserID + human.ID = humanUserID + *validations = append(*validations, - commands.AddHumanCommand(human, orgID, commands.userPasswordHasher, commands.userEncryption, true), + commands.AddHumanCommand(human, orgAgg.ID, commands.userPasswordHasher, commands.userEncryption, true), ) + + setupAdminMembers(commands, validations, instanceAgg, orgAgg, humanUserID) + } + return owner, pat, machineKey, nil +} + +func setupMachineAdmin(commands *Commands, validations *[]preparation.Validation, machine *AddMachine, orgID, userID string) (pat *PersonalAccessToken, machineKey *MachineKey, err error) { + *validations = append(*validations, + AddMachineCommand(user.NewAggregate(userID, orgID), machine.Machine), + ) + if machine.Pat != nil { + pat = NewPersonalAccessToken(orgID, userID, machine.Pat.ExpirationDate, machine.Pat.Scopes, domain.UserTypeMachine) + pat.TokenID, err = commands.idGenerator.Next() + if err != nil { + return nil, nil, err + } + *validations = append(*validations, prepareAddPersonalAccessToken(pat, commands.keyAlgorithm)) + } + if machine.MachineKey != nil { + machineKey = NewMachineKey(orgID, userID, machine.MachineKey.ExpirationDate, machine.MachineKey.Type) + machineKey.KeyID, err = commands.idGenerator.Next() + if err != nil { + return nil, nil, err + } + *validations = append(*validations, prepareAddUserMachineKey(machineKey, commands.machineKeySize)) } return pat, machineKey, nil } +func setupAdminMembers(commands *Commands, validations *[]preparation.Validation, instanceAgg *instance.Aggregate, orgAgg *org.Aggregate, userID string) { + *validations = append(*validations, + commands.AddOrgMemberCommand(orgAgg, userID, domain.RoleOrgOwner), + commands.AddInstanceMemberCommand(instanceAgg, userID, domain.RoleIAMOwner), + ) +} + func setupMessageTexts(validations *[]preparation.Validation, setupMessageTexts []*domain.CustomMessageText, instanceAgg *instance.Aggregate) { for _, msg := range setupMessageTexts { *validations = append(*validations, prepareSetInstanceCustomMessageTexts(instanceAgg, msg)) diff --git a/internal/command/instance_domain.go b/internal/command/instance_domain.go index d5f6808cfb..43e1aebbf8 100644 --- a/internal/command/instance_domain.go +++ b/internal/command/instance_domain.go @@ -74,7 +74,7 @@ func (c *Commands) RemoveInstanceDomain(ctx context.Context, instanceDomain stri } func (c *Commands) addGeneratedInstanceDomain(ctx context.Context, a *instance.Aggregate, instanceName string) ([]preparation.Validation, error) { - domain, err := domain.NewGeneratedInstanceDomain(instanceName, authz.GetInstance(ctx).RequestedDomain()) + domain, err := c.GenerateDomain(instanceName, authz.GetInstance(ctx).RequestedDomain()) if err != nil { return nil, err } diff --git a/internal/command/instance_policy_label.go b/internal/command/instance_policy_label.go index 8392a7d564..3d047f65bc 100644 --- a/internal/command/instance_policy_label.go +++ b/internal/command/instance_policy_label.go @@ -12,38 +12,6 @@ import ( "github.com/zitadel/zitadel/internal/zerrors" ) -func (c *Commands) AddDefaultLabelPolicy( - ctx context.Context, - primaryColor, backgroundColor, warnColor, fontColor, primaryColorDark, backgroundColorDark, warnColorDark, fontColorDark string, - hideLoginNameSuffix, errorMsgPopup, disableWatermark bool, themeMode domain.LabelPolicyThemeMode, -) (*domain.ObjectDetails, error) { - instanceAgg := instance.NewAggregate(authz.GetInstance(ctx).InstanceID()) - cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, - prepareAddDefaultLabelPolicy( - instanceAgg, - primaryColor, - backgroundColor, - warnColor, - fontColor, - primaryColorDark, - backgroundColorDark, - warnColorDark, - fontColorDark, - hideLoginNameSuffix, - errorMsgPopup, - disableWatermark, - themeMode, - )) - if err != nil { - return nil, err - } - pushedEvents, err := c.eventstore.Push(ctx, cmds...) - if err != nil { - return nil, err - } - return pushedEventsToObjectDetails(pushedEvents), nil -} - func (c *Commands) ChangeDefaultLabelPolicy(ctx context.Context, policy *domain.LabelPolicy) (*domain.LabelPolicy, error) { if err := policy.IsValid(); err != nil { return nil, err @@ -373,6 +341,8 @@ func (c *Commands) getDefaultLabelPolicy(ctx context.Context) (*domain.LabelPoli return policy, nil } +// prepareAddDefaultLabelPolicy adds a default label policy, if none exists prior, and activates it directly +// this functions is only used on instance setup so the policy can be activated directly func prepareAddDefaultLabelPolicy( a *instance.Aggregate, primaryColor, @@ -417,6 +387,7 @@ func prepareAddDefaultLabelPolicy( disableWatermark, themeMode, ), + instance.NewLabelPolicyActivatedEvent(ctx, &a.Aggregate), }, nil }, nil } diff --git a/internal/command/instance_policy_label_test.go b/internal/command/instance_policy_label_test.go index ca508d414b..3720fba094 100644 --- a/internal/command/instance_policy_label_test.go +++ b/internal/command/instance_policy_label_test.go @@ -19,160 +19,6 @@ import ( "github.com/zitadel/zitadel/internal/zerrors" ) -func TestCommandSide_AddDefaultLabelPolicy(t *testing.T) { - type fields struct { - eventstore *eventstore.Eventstore - } - type args struct { - ctx context.Context - primaryColor string - backgroundColor string - warnColor string - fontColor string - primaryColorDark string - backgroundColorDark string - warnColorDark string - fontColorDark string - hideLoginNameSuffix bool - errorMsgPopup bool - disableWatermark bool - themeMode domain.LabelPolicyThemeMode - } - type res struct { - want *domain.ObjectDetails - err func(error) bool - } - tests := []struct { - name string - fields fields - args args - res res - }{ - { - name: "labelpolicy already existing, already exists error", - fields: fields{ - eventstore: eventstoreExpect( - t, - expectFilter( - eventFromEventPusher( - instance.NewLabelPolicyAddedEvent(context.Background(), - &instance.NewAggregate("INSTANCE").Aggregate, - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - true, - true, - true, - domain.LabelPolicyThemeAuto, - ), - ), - ), - ), - }, - args: args{ - ctx: context.Background(), - primaryColor: "#ffffff", - backgroundColor: "#ffffff", - warnColor: "#ffffff", - fontColor: "#ffffff", - primaryColorDark: "#ffffff", - backgroundColorDark: "#ffffff", - warnColorDark: "#ffffff", - fontColorDark: "#ffffff", - hideLoginNameSuffix: true, - errorMsgPopup: true, - disableWatermark: true, - themeMode: domain.LabelPolicyThemeAuto, - }, - res: res{ - err: zerrors.IsErrorAlreadyExists, - }, - }, - { - name: "add policy,ok", - fields: fields{ - eventstore: eventstoreExpect( - t, - expectFilter(), - expectPush( - instance.NewLabelPolicyAddedEvent(context.Background(), - &instance.NewAggregate("INSTANCE").Aggregate, - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - "#ffffff", - true, - true, - true, - domain.LabelPolicyThemeDark, - ), - ), - ), - }, - args: args{ - ctx: authz.WithInstanceID(context.Background(), "INSTANCE"), - primaryColor: "#ffffff", - backgroundColor: "#ffffff", - warnColor: "#ffffff", - fontColor: "#ffffff", - primaryColorDark: "#ffffff", - backgroundColorDark: "#ffffff", - warnColorDark: "#ffffff", - fontColorDark: "#ffffff", - hideLoginNameSuffix: true, - errorMsgPopup: true, - disableWatermark: true, - themeMode: domain.LabelPolicyThemeDark, - }, - res: res{ - want: &domain.ObjectDetails{ - ResourceOwner: "INSTANCE", - }, - }, - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - r := &Commands{ - eventstore: tt.fields.eventstore, - } - got, err := r.AddDefaultLabelPolicy( - tt.args.ctx, - tt.args.primaryColor, - tt.args.backgroundColor, - tt.args.warnColor, - tt.args.fontColor, - tt.args.primaryColorDark, - tt.args.backgroundColorDark, - tt.args.warnColorDark, - tt.args.fontColorDark, - tt.args.hideLoginNameSuffix, - tt.args.errorMsgPopup, - tt.args.disableWatermark, - tt.args.themeMode, - ) - if tt.res.err == nil { - assert.NoError(t, err) - } - if tt.res.err != nil && !tt.res.err(err) { - t.Errorf("got wrong err: %v ", err) - } - if tt.res.err == nil { - assert.Equal(t, tt.res.want, got) - } - }) - } -} - func TestCommandSide_ChangeDefaultLabelPolicy(t *testing.T) { type fields struct { eventstore *eventstore.Eventstore diff --git a/internal/command/instance_test.go b/internal/command/instance_test.go index 8f4f5b68e3..9cfcbb6926 100644 --- a/internal/command/instance_test.go +++ b/internal/command/instance_test.go @@ -2,17 +2,1224 @@ package command import ( "context" + "encoding/json" + "slices" + "strings" "testing" + "time" "github.com/stretchr/testify/assert" + "go.uber.org/mock/gomock" + "golang.org/x/text/language" "github.com/zitadel/zitadel/internal/api/authz" + "github.com/zitadel/zitadel/internal/command/preparation" + "github.com/zitadel/zitadel/internal/crypto" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" + "github.com/zitadel/zitadel/internal/id" + id_mock "github.com/zitadel/zitadel/internal/id/mock" "github.com/zitadel/zitadel/internal/repository/instance" + "github.com/zitadel/zitadel/internal/repository/org" + "github.com/zitadel/zitadel/internal/repository/project" + "github.com/zitadel/zitadel/internal/repository/user" "github.com/zitadel/zitadel/internal/zerrors" ) +func instanceSetupZitadelIDs() ZitadelConfig { + return ZitadelConfig{ + instanceID: "INSTANCE", + orgID: "ORG", + projectID: "PROJECT", + consoleAppID: "console-id", + authAppID: "auth-id", + mgmtAppID: "mgmt-id", + adminAppID: "admin-id", + } +} + +func projectAddedEvents(ctx context.Context, instanceID, orgID, id, owner string, externalSecure bool) []eventstore.Command { + events := []eventstore.Command{ + project.NewProjectAddedEvent(ctx, + &project.NewAggregate(id, orgID).Aggregate, + "ZITADEL", + false, + false, + false, + domain.PrivateLabelingSettingUnspecified, + ), + project.NewProjectMemberAddedEvent(ctx, + &project.NewAggregate(id, orgID).Aggregate, + owner, + domain.RoleProjectOwner, + ), + instance.NewIAMProjectSetEvent(ctx, + &instance.NewAggregate(instanceID).Aggregate, + id, + ), + } + events = append(events, apiAppEvents(ctx, orgID, id, "mgmt-id", "Management-API")...) + events = append(events, apiAppEvents(ctx, orgID, id, "admin-id", "Admin-API")...) + events = append(events, apiAppEvents(ctx, orgID, id, "auth-id", "Auth-API")...) + + consoleAppID := "console-id" + consoleClientID := "clientID@zitadel" + events = append(events, oidcAppEvents(ctx, orgID, id, consoleAppID, "Console", consoleClientID, externalSecure)...) + events = append(events, + instance.NewIAMConsoleSetEvent(ctx, + &instance.NewAggregate(instanceID).Aggregate, + &consoleClientID, + &consoleAppID, + ), + ) + return events +} + +func projectClientIDs() []string { + return []string{"clientID", "clientID", "clientID", "clientID"} +} + +func apiAppEvents(ctx context.Context, orgID, projectID, id, name string) []eventstore.Command { + return []eventstore.Command{ + project.NewApplicationAddedEvent( + ctx, + &project.NewAggregate(projectID, orgID).Aggregate, + id, + name, + ), + project.NewAPIConfigAddedEvent(ctx, + &project.NewAggregate(projectID, orgID).Aggregate, + id, + "clientID@zitadel", + "", + domain.APIAuthMethodTypePrivateKeyJWT, + ), + } +} + +func oidcAppEvents(ctx context.Context, orgID, projectID, id, name, clientID string, externalSecure bool) []eventstore.Command { + return []eventstore.Command{ + project.NewApplicationAddedEvent( + ctx, + &project.NewAggregate(projectID, orgID).Aggregate, + id, + name, + ), + project.NewOIDCConfigAddedEvent(ctx, + &project.NewAggregate(projectID, orgID).Aggregate, + domain.OIDCVersionV1, + id, + clientID, + "", + []string{}, + []domain.OIDCResponseType{domain.OIDCResponseTypeCode}, + []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode}, + domain.OIDCApplicationTypeUserAgent, + domain.OIDCAuthMethodTypeNone, + []string{}, + !externalSecure, + domain.OIDCTokenTypeBearer, + false, + false, + false, + 0, + nil, + false, + ), + } +} + +func orgFilters(orgID string, machine, human bool) []expect { + filters := []expect{ + expectFilter(), + expectFilter( + org.NewOrgAddedEvent(context.Background(), &org.NewAggregate(orgID).Aggregate, ""), + ), + } + if machine { + filters = append(filters, machineFilters(orgID, true)...) + filters = append(filters, adminMemberFilters(orgID, "USER-MACHINE")...) + } + if human { + filters = append(filters, humanFilters(orgID)...) + filters = append(filters, adminMemberFilters(orgID, "USER")...) + } + + return append(filters, + projectFilters()..., + ) +} + +func orgEvents(ctx context.Context, instanceID, orgID, name, projectID, defaultDomain string, externalSecure bool, machine, human bool) []eventstore.Command { + instanceAgg := instance.NewAggregate(instanceID) + orgAgg := org.NewAggregate(orgID) + domain := strings.ToLower(name + "." + defaultDomain) + events := []eventstore.Command{ + org.NewOrgAddedEvent(ctx, &orgAgg.Aggregate, name), + org.NewDomainAddedEvent(ctx, &orgAgg.Aggregate, domain), + org.NewDomainVerifiedEvent(ctx, &orgAgg.Aggregate, domain), + org.NewDomainPrimarySetEvent(ctx, &orgAgg.Aggregate, domain), + instance.NewDefaultOrgSetEventEvent(ctx, &instanceAgg.Aggregate, orgID), + } + + owner := "" + if machine { + machineID := "USER-MACHINE" + events = append(events, machineEvents(ctx, instanceID, orgID, machineID, "PAT")...) + owner = machineID + } + if human { + userID := "USER" + events = append(events, humanEvents(ctx, instanceID, orgID, userID)...) + owner = userID + } + + events = append(events, projectAddedEvents(ctx, instanceID, orgID, projectID, owner, externalSecure)...) + return events +} + +func orgIDs() []string { + return slices.Concat([]string{"USER-MACHINE", "PAT", "USER"}, projectClientIDs()) +} + +func instancePoliciesFilters(instanceID string) []expect { + return []expect{ + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + } +} + +func instancePoliciesEvents(ctx context.Context, instanceID string) []eventstore.Command { + instanceAgg := instance.NewAggregate(instanceID) + return []eventstore.Command{ + instance.NewPasswordComplexityPolicyAddedEvent(ctx, &instanceAgg.Aggregate, 8, true, true, true, true), + instance.NewPasswordAgePolicyAddedEvent(ctx, &instanceAgg.Aggregate, 0, 0), + instance.NewDomainPolicyAddedEvent(ctx, &instanceAgg.Aggregate, false, false, false), + instance.NewLoginPolicyAddedEvent(ctx, &instanceAgg.Aggregate, true, true, true, false, false, false, false, true, false, false, domain.PasswordlessTypeAllowed, "", 240*time.Hour, 240*time.Hour, 720*time.Hour, 18*time.Hour, 12*time.Hour), + instance.NewLoginPolicySecondFactorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecondFactorTypeTOTP), + instance.NewLoginPolicySecondFactorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecondFactorTypeU2F), + instance.NewLoginPolicyMultiFactorAddedEvent(ctx, &instanceAgg.Aggregate, domain.MultiFactorTypeU2FWithPIN), + instance.NewPrivacyPolicyAddedEvent(ctx, &instanceAgg.Aggregate, "", "", "", "", "", "", ""), + instance.NewNotificationPolicyAddedEvent(ctx, &instanceAgg.Aggregate, true), + instance.NewLockoutPolicyAddedEvent(ctx, &instanceAgg.Aggregate, 0, 0, true), + instance.NewLabelPolicyAddedEvent(ctx, &instanceAgg.Aggregate, "#5469d4", "#fafafa", "#cd3d56", "#000000", "#2073c4", "#111827", "#ff3b5b", "#ffffff", false, false, false, domain.LabelPolicyThemeAuto), + instance.NewLabelPolicyActivatedEvent(ctx, &instanceAgg.Aggregate), + } +} + +func instanceSetupPoliciesConfig() *InstanceSetup { + return &InstanceSetup{ + PasswordComplexityPolicy: struct { + MinLength uint64 + HasLowercase bool + HasUppercase bool + HasNumber bool + HasSymbol bool + }{8, true, true, true, true}, + PasswordAgePolicy: struct { + ExpireWarnDays uint64 + MaxAgeDays uint64 + }{0, 0}, + DomainPolicy: struct { + UserLoginMustBeDomain bool + ValidateOrgDomains bool + SMTPSenderAddressMatchesInstanceDomain bool + }{false, false, false}, + LoginPolicy: struct { + AllowUsernamePassword bool + AllowRegister bool + AllowExternalIDP bool + ForceMFA bool + ForceMFALocalOnly bool + HidePasswordReset bool + IgnoreUnknownUsername bool + AllowDomainDiscovery bool + DisableLoginWithEmail bool + DisableLoginWithPhone bool + PasswordlessType domain.PasswordlessType + DefaultRedirectURI string + PasswordCheckLifetime time.Duration + ExternalLoginCheckLifetime time.Duration + MfaInitSkipLifetime time.Duration + SecondFactorCheckLifetime time.Duration + MultiFactorCheckLifetime time.Duration + }{true, true, true, false, false, false, false, true, false, false, domain.PasswordlessTypeAllowed, "", 240 * time.Hour, 240 * time.Hour, 720 * time.Hour, 18 * time.Hour, 12 * time.Hour}, + NotificationPolicy: struct { + PasswordChange bool + }{true}, + PrivacyPolicy: struct { + TOSLink string + PrivacyLink string + HelpLink string + SupportEmail domain.EmailAddress + DocsLink string + CustomLink string + CustomLinkText string + }{"", "", "", "", "", "", ""}, + LabelPolicy: struct { + PrimaryColor string + BackgroundColor string + WarnColor string + FontColor string + PrimaryColorDark string + BackgroundColorDark string + WarnColorDark string + FontColorDark string + HideLoginNameSuffix bool + ErrorMsgPopup bool + DisableWatermark bool + ThemeMode domain.LabelPolicyThemeMode + }{"#5469d4", "#fafafa", "#cd3d56", "#000000", "#2073c4", "#111827", "#ff3b5b", "#ffffff", false, false, false, domain.LabelPolicyThemeAuto}, + LockoutPolicy: struct { + MaxPasswordAttempts uint64 + MaxOTPAttempts uint64 + ShouldShowLockoutFailure bool + }{0, 0, true}, + } +} + +func setupInstanceElementsFilters(instanceID string) []expect { + return slices.Concat( + instanceElementsFilters(), + instancePoliciesFilters(instanceID), + // email template + []expect{expectFilter()}, + ) +} + +func setupInstanceElementsConfig() *InstanceSetup { + conf := instanceSetupPoliciesConfig() + conf.InstanceName = "ZITADEL" + conf.DefaultLanguage = language.English + conf.zitadel = instanceSetupZitadelIDs() + conf.SecretGenerators = instanceElementsConfig() + conf.EmailTemplate = []byte("something") + return conf +} + +func setupInstanceElementsEvents(ctx context.Context, instanceID, instanceName string, defaultLanguage language.Tag) []eventstore.Command { + instanceAgg := instance.NewAggregate(instanceID) + return slices.Concat( + instanceElementsEvents(ctx, instanceID, instanceName, defaultLanguage), + instancePoliciesEvents(ctx, instanceID), + []eventstore.Command{instance.NewMailTemplateAddedEvent(ctx, &instanceAgg.Aggregate, []byte("something"))}, + ) +} + +func instanceElementsFilters() []expect { + return []expect{ + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + } +} + +func instanceElementsEvents(ctx context.Context, instanceID, instanceName string, defaultLanguage language.Tag) []eventstore.Command { + instanceAgg := instance.NewAggregate(instanceID) + return []eventstore.Command{ + instance.NewInstanceAddedEvent(ctx, &instanceAgg.Aggregate, instanceName), + instance.NewDefaultLanguageSetEvent(ctx, &instanceAgg.Aggregate, defaultLanguage), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeAppSecret, 64, 0, true, true, true, false), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeInitCode, 6, 72*time.Hour, false, true, true, false), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyEmailCode, 6, time.Hour, false, true, true, false), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyPhoneCode, 6, time.Hour, false, true, true, false), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypePasswordResetCode, 6, time.Hour, false, true, true, false), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypePasswordlessInitCode, 12, time.Hour, true, true, true, false), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyDomain, 32, 0, true, true, true, false), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPSMS, 8, 5*time.Minute, false, false, true, false), + instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPEmail, 8, 5*time.Minute, false, false, true, false), + } +} +func instanceElementsConfig() *SecretGenerators { + return &SecretGenerators{ + ClientSecret: &crypto.GeneratorConfig{Length: 64, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true}, + InitializeUserCode: &crypto.GeneratorConfig{Length: 6, Expiry: 72 * time.Hour, IncludeUpperLetters: true, IncludeDigits: true}, + EmailVerificationCode: &crypto.GeneratorConfig{Length: 6, Expiry: time.Hour, IncludeUpperLetters: true, IncludeDigits: true}, + PhoneVerificationCode: &crypto.GeneratorConfig{Length: 6, Expiry: time.Hour, IncludeUpperLetters: true, IncludeDigits: true}, + PasswordVerificationCode: &crypto.GeneratorConfig{Length: 6, Expiry: time.Hour, IncludeUpperLetters: true, IncludeDigits: true}, + PasswordlessInitCode: &crypto.GeneratorConfig{Length: 12, Expiry: time.Hour, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true}, + DomainVerification: &crypto.GeneratorConfig{Length: 32, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true}, + OTPSMS: &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true}, + OTPEmail: &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true}, + } +} + +func setupInstanceFilters(instanceID, orgID, projectID, appID, domain string) []expect { + return slices.Concat( + setupInstanceElementsFilters(instanceID), + orgFilters(orgID, true, true), + generatedDomainFilters(instanceID, orgID, projectID, appID, domain), + ) +} + +func setupInstanceEvents(ctx context.Context, instanceID, orgID, projectID, appID, instanceName, orgName string, defaultLanguage language.Tag, domain string, externalSecure bool) []eventstore.Command { + return slices.Concat( + setupInstanceElementsEvents(ctx, instanceID, instanceName, defaultLanguage), + orgEvents(ctx, instanceID, orgID, orgName, projectID, domain, externalSecure, true, true), + generatedDomainEvents(ctx, instanceID, orgID, projectID, appID, domain), + ) +} + +func setupInstanceConfig() *InstanceSetup { + conf := setupInstanceElementsConfig() + conf.Org = InstanceOrgSetup{ + Name: "ZITADEL", + Machine: instanceSetupMachineConfig(), + Human: instanceSetupHumanConfig(), + } + conf.CustomDomain = "" + return conf +} + +func generatedDomainEvents(ctx context.Context, instanceID, orgID, projectID, appID, defaultDomain string) []eventstore.Command { + instanceAgg := instance.NewAggregate(instanceID) + changed, _ := project.NewOIDCConfigChangedEvent(ctx, &project.NewAggregate(projectID, orgID).Aggregate, appID, + []project.OIDCConfigChanges{ + project.ChangeRedirectURIs([]string{"http://" + defaultDomain + "/ui/console/auth/callback"}), + project.ChangePostLogoutRedirectURIs([]string{"http://" + defaultDomain + "/ui/console/signedout"}), + }, + ) + return []eventstore.Command{ + instance.NewDomainAddedEvent(ctx, &instanceAgg.Aggregate, defaultDomain, true), + changed, + instance.NewDomainPrimarySetEvent(ctx, &instanceAgg.Aggregate, defaultDomain), + } +} + +func generatedDomainFilters(instanceID, orgID, projectID, appID, generatedDomain string) []expect { + return []expect{ + expectFilter(), + expectFilter( + project.NewApplicationAddedEvent(context.Background(), + &project.NewAggregate(projectID, orgID).Aggregate, + appID, + "console", + ), + project.NewOIDCConfigAddedEvent(context.Background(), + &project.NewAggregate(projectID, orgID).Aggregate, + domain.OIDCVersionV1, + appID, + "clientID", + "", + []string{}, + []domain.OIDCResponseType{domain.OIDCResponseTypeCode}, + []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode}, + domain.OIDCApplicationTypeUserAgent, + domain.OIDCAuthMethodTypeNone, + []string{}, + true, + domain.OIDCTokenTypeBearer, + false, + false, + false, + 0, + nil, + false, + ), + ), + expectFilter( + func() eventstore.Event { + event := instance.NewDomainAddedEvent(context.Background(), + &instance.NewAggregate(instanceID).Aggregate, + generatedDomain, + true, + ) + event.Data, _ = json.Marshal(event) + return event + }(), + ), + } +} + +func humanFilters(orgID string) []expect { + return []expect{ + expectFilter(), + expectFilter( + org.NewDomainPolicyAddedEvent( + context.Background(), + &org.NewAggregate(orgID).Aggregate, + true, + true, + true, + ), + ), + expectFilter( + org.NewPasswordComplexityPolicyAddedEvent( + context.Background(), + &org.NewAggregate(orgID).Aggregate, + 2, + false, + false, + false, + false, + ), + ), + } +} + +func instanceSetupHumanConfig() *AddHuman { + return &AddHuman{ + Username: "zitadel-admin", + FirstName: "ZITADEL", + LastName: "Admin", + Email: Email{ + Address: domain.EmailAddress("admin@zitadel.test"), + Verified: true, + }, + PreferredLanguage: language.English, + Password: "password", + PasswordChangeRequired: false, + } +} + +func machineFilters(orgID string, pat bool) []expect { + filters := []expect{ + expectFilter(), + expectFilter( + org.NewDomainPolicyAddedEvent( + context.Background(), + &org.NewAggregate(orgID).Aggregate, + true, + true, + true, + ), + ), + } + if pat { + filters = append(filters, + expectFilter(), + expectFilter(), + ) + } + return filters +} + +func instanceSetupMachineConfig() *AddMachine { + return &AddMachine{ + Machine: &Machine{ + Username: "zitadel-admin-machine", + Name: "ZITADEL-machine", + Description: "Admin", + AccessTokenType: domain.OIDCTokenTypeBearer, + }, + Pat: &AddPat{ + ExpirationDate: time.Time{}, + Scopes: nil, + }, + /* not predictable with the key value in the events + MachineKey: &AddMachineKey{ + Type: domain.AuthNKeyTypeJSON, + ExpirationDate: time.Time{}, + }, + */ + } +} + +func projectFilters() []expect { + return []expect{ + expectFilter(), + expectFilter(), + expectFilter(), + expectFilter(), + } +} + +func adminMemberFilters(orgID, userID string) []expect { + return []expect{ + expectFilter( + addHumanEvent(context.Background(), orgID, userID), + ), + expectFilter(), + expectFilter( + addHumanEvent(context.Background(), orgID, userID), + ), + expectFilter(), + } +} + +func humanEvents(ctx context.Context, instanceID, orgID, userID string) []eventstore.Command { + agg := user.NewAggregate(userID, orgID) + instanceAgg := instance.NewAggregate(instanceID) + orgAgg := org.NewAggregate(orgID) + return []eventstore.Command{ + addHumanEvent(ctx, orgID, userID), + user.NewHumanEmailVerifiedEvent(ctx, &agg.Aggregate), + org.NewMemberAddedEvent(ctx, &orgAgg.Aggregate, userID, domain.RoleOrgOwner), + instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMOwner), + } +} + +func addHumanEvent(ctx context.Context, orgID, userID string) *user.HumanAddedEvent { + agg := user.NewAggregate(userID, orgID) + return func() *user.HumanAddedEvent { + event := user.NewHumanAddedEvent( + ctx, + &agg.Aggregate, + "zitadel-admin", + "ZITADEL", + "Admin", + "", + "ZITADEL Admin", + language.English, + 0, + "admin@zitadel.test", + false, + ) + event.AddPasswordData("$plain$x$password", false) + return event + }() +} + +// machineEvents all events from setup to create the machine user, machinekey can't be tested here, as the public key is not provided and as such the value in the event can't be expected +func machineEvents(ctx context.Context, instanceID, orgID, userID, patID string) []eventstore.Command { + agg := user.NewAggregate(userID, orgID) + instanceAgg := instance.NewAggregate(instanceID) + orgAgg := org.NewAggregate(orgID) + events := []eventstore.Command{addMachineEvent(ctx, orgID, userID)} + if patID != "" { + events = append(events, + user.NewPersonalAccessTokenAddedEvent( + ctx, + &agg.Aggregate, + patID, + time.Date(9999, time.December, 31, 23, 59, 59, 0, time.UTC), + nil, + ), + ) + } + return append(events, + org.NewMemberAddedEvent(ctx, &orgAgg.Aggregate, userID, domain.RoleOrgOwner), + instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMOwner), + ) +} + +func addMachineEvent(ctx context.Context, orgID, userID string) *user.MachineAddedEvent { + agg := user.NewAggregate(userID, orgID) + return user.NewMachineAddedEvent(ctx, + &agg.Aggregate, + "zitadel-admin-machine", + "ZITADEL-machine", + "Admin", + false, + domain.OIDCTokenTypeBearer, + ) +} + +func testSetup(ctx context.Context, c *Commands, validations []preparation.Validation) error { + //nolint:staticcheck + cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, validations...) + if err != nil { + return err + } + + _, err = c.eventstore.Push(ctx, cmds...) + return err +} + +func TestCommandSide_setupMinimalInterfaces(t *testing.T) { + type fields struct { + eventstore func(t *testing.T) *eventstore.Eventstore + idGenerator id.Generator + } + type args struct { + ctx context.Context + instanceAgg *instance.Aggregate + orgAgg *org.Aggregate + owner string + ids ZitadelConfig + } + type res struct { + err func(error) bool + } + tests := []struct { + name string + fields fields + args args + res res + }{ + { + name: "create, ok", + fields: fields{ + eventstore: expectEventstore( + slices.Concat( + projectFilters(), + []expect{expectPush( + projectAddedEvents(context.Background(), + "INSTANCE", + "ORG", + "PROJECT", + "owner", + false, + )..., + ), + }, + )..., + ), + idGenerator: id_mock.NewIDGeneratorExpectIDs(t, projectClientIDs()...), + }, + args: args{ + ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN"), + instanceAgg: instance.NewAggregate("INSTANCE"), + orgAgg: org.NewAggregate("ORG"), + owner: "owner", + ids: instanceSetupZitadelIDs(), + }, + res: res{ + err: nil, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + r := &Commands{ + eventstore: tt.fields.eventstore(t), + idGenerator: tt.fields.idGenerator, + } + validations := make([]preparation.Validation, 0) + setupMinimalInterfaces(r, &validations, tt.args.instanceAgg, tt.args.orgAgg, tt.args.owner, tt.args.ids) + + err := testSetup(tt.args.ctx, r, validations) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + }) + } +} + +func TestCommandSide_setupAdmins(t *testing.T) { + type fields struct { + eventstore func(t *testing.T) *eventstore.Eventstore + idGenerator id.Generator + userPasswordHasher *crypto.Hasher + roles []authz.RoleMapping + keyAlgorithm crypto.EncryptionAlgorithm + } + type args struct { + ctx context.Context + instanceAgg *instance.Aggregate + orgAgg *org.Aggregate + machine *AddMachine + human *AddHuman + } + type res struct { + owner string + pat bool + machineKey bool + err func(error) bool + } + tests := []struct { + name string + fields fields + args args + res res + }{ + { + name: "human, ok", + fields: fields{ + eventstore: expectEventstore( + slices.Concat( + humanFilters("ORG"), + adminMemberFilters("ORG", "USER"), + []expect{ + expectPush( + humanEvents(context.Background(), + "INSTANCE", + "ORG", + "USER", + )..., + ), + }, + )..., + ), + idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "USER"), + userPasswordHasher: mockPasswordHasher("x"), + roles: []authz.RoleMapping{ + {Role: domain.RoleOrgOwner, Permissions: []string{""}}, + {Role: domain.RoleIAMOwner, Permissions: []string{""}}, + }, + }, + args: args{ + ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN"), + instanceAgg: instance.NewAggregate("INSTANCE"), + orgAgg: org.NewAggregate("ORG"), + human: instanceSetupHumanConfig(), + }, + res: res{ + owner: "USER", + pat: false, + machineKey: false, + err: nil, + }, + }, + { + name: "machine, ok", + fields: fields{ + eventstore: expectEventstore( + slices.Concat( + machineFilters("ORG", true), + adminMemberFilters("ORG", "USER-MACHINE"), + []expect{ + expectPush( + machineEvents(context.Background(), + "INSTANCE", + "ORG", + "USER-MACHINE", + "PAT", + )..., + ), + }, + )..., + ), + idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "USER-MACHINE", "PAT"), + roles: []authz.RoleMapping{ + {Role: domain.RoleOrgOwner, Permissions: []string{""}}, + {Role: domain.RoleIAMOwner, Permissions: []string{""}}, + }, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + args: args{ + ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN"), + instanceAgg: instance.NewAggregate("INSTANCE"), + orgAgg: org.NewAggregate("ORG"), + machine: instanceSetupMachineConfig(), + }, + res: res{ + owner: "USER-MACHINE", + pat: true, + machineKey: false, + err: nil, + }, + }, + { + name: "human and machine, ok", + fields: fields{ + eventstore: expectEventstore( + slices.Concat( + machineFilters("ORG", true), + adminMemberFilters("ORG", "USER-MACHINE"), + humanFilters("ORG"), + adminMemberFilters("ORG", "USER"), + []expect{ + expectPush( + slices.Concat( + machineEvents(context.Background(), + "INSTANCE", + "ORG", + "USER-MACHINE", + "PAT", + ), + humanEvents(context.Background(), + "INSTANCE", + "ORG", + "USER", + ), + )..., + ), + }, + )..., + ), + userPasswordHasher: mockPasswordHasher("x"), + idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "USER-MACHINE", "PAT", "USER"), + roles: []authz.RoleMapping{ + {Role: domain.RoleOrgOwner, Permissions: []string{""}}, + {Role: domain.RoleIAMOwner, Permissions: []string{""}}, + }, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + args: args{ + ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN"), + instanceAgg: instance.NewAggregate("INSTANCE"), + orgAgg: org.NewAggregate("ORG"), + machine: instanceSetupMachineConfig(), + human: instanceSetupHumanConfig(), + }, + res: res{ + owner: "USER", + pat: true, + machineKey: false, + err: nil, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + r := &Commands{ + eventstore: tt.fields.eventstore(t), + idGenerator: tt.fields.idGenerator, + zitadelRoles: tt.fields.roles, + userPasswordHasher: tt.fields.userPasswordHasher, + keyAlgorithm: tt.fields.keyAlgorithm, + } + validations := make([]preparation.Validation, 0) + owner, pat, mk, err := setupAdmins(r, &validations, tt.args.instanceAgg, tt.args.orgAgg, tt.args.machine, tt.args.human) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + + err = testSetup(tt.args.ctx, r, validations) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + + if tt.res.err == nil { + assert.Equal(t, owner, tt.res.owner) + if tt.res.pat { + assert.NotNil(t, pat) + } + if tt.res.machineKey { + assert.NotNil(t, mk) + } + } + }) + } +} + +func TestCommandSide_setupDefaultOrg(t *testing.T) { + type fields struct { + eventstore func(t *testing.T) *eventstore.Eventstore + idGenerator id.Generator + userPasswordHasher *crypto.Hasher + roles []authz.RoleMapping + keyAlgorithm crypto.EncryptionAlgorithm + } + type args struct { + ctx context.Context + instanceAgg *instance.Aggregate + orgName string + machine *AddMachine + human *AddHuman + ids ZitadelConfig + } + type res struct { + pat bool + machineKey bool + err func(error) bool + } + tests := []struct { + name string + fields fields + args args + res res + }{ + { + name: "human and machine, ok", + fields: fields{ + eventstore: expectEventstore( + slices.Concat( + orgFilters( + "ORG", + true, + true, + ), + []expect{ + expectPush( + slices.Concat( + orgEvents(context.Background(), + "INSTANCE", + "ORG", + "ZITADEL", + "PROJECT", + "DOMAIN", + false, + true, + true, + ), + )..., + ), + }, + )..., + ), + userPasswordHasher: mockPasswordHasher("x"), + idGenerator: id_mock.NewIDGeneratorExpectIDs(t, orgIDs()...), + roles: []authz.RoleMapping{ + {Role: domain.RoleOrgOwner, Permissions: []string{""}}, + {Role: domain.RoleIAMOwner, Permissions: []string{""}}, + }, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + }, + args: args{ + ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN"), + instanceAgg: instance.NewAggregate("INSTANCE"), + orgName: "ZITADEL", + machine: &AddMachine{ + Machine: &Machine{ + Username: "zitadel-admin-machine", + Name: "ZITADEL-machine", + Description: "Admin", + AccessTokenType: domain.OIDCTokenTypeBearer, + }, + Pat: &AddPat{ + ExpirationDate: time.Time{}, + Scopes: nil, + }, + /* not predictable with the key value in the events + MachineKey: &AddMachineKey{ + Type: domain.AuthNKeyTypeJSON, + ExpirationDate: time.Time{}, + }, + */ + }, + human: &AddHuman{ + Username: "zitadel-admin", + FirstName: "ZITADEL", + LastName: "Admin", + Email: Email{ + Address: domain.EmailAddress("admin@zitadel.test"), + Verified: true, + }, + PreferredLanguage: language.English, + Password: "password", + PasswordChangeRequired: false, + }, + ids: ZitadelConfig{ + instanceID: "INSTANCE", + orgID: "ORG", + projectID: "PROJECT", + consoleAppID: "console-id", + authAppID: "auth-id", + mgmtAppID: "mgmt-id", + adminAppID: "admin-id", + }, + }, + res: res{ + pat: true, + machineKey: false, + err: nil, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + r := &Commands{ + eventstore: tt.fields.eventstore(t), + idGenerator: tt.fields.idGenerator, + zitadelRoles: tt.fields.roles, + userPasswordHasher: tt.fields.userPasswordHasher, + keyAlgorithm: tt.fields.keyAlgorithm, + } + validations := make([]preparation.Validation, 0) + pat, mk, err := setupDefaultOrg(tt.args.ctx, r, &validations, tt.args.instanceAgg, tt.args.orgName, tt.args.machine, tt.args.human, tt.args.ids) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + + err = testSetup(context.Background(), r, validations) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + + if tt.res.err == nil { + if tt.res.pat { + assert.NotNil(t, pat) + } + if tt.res.machineKey { + assert.NotNil(t, mk) + } + } + }) + } +} + +func TestCommandSide_setupInstanceElements(t *testing.T) { + type fields struct { + eventstore func(t *testing.T) *eventstore.Eventstore + } + type args struct { + ctx context.Context + instanceAgg *instance.Aggregate + setup *InstanceSetup + } + type res struct { + err func(error) bool + } + tests := []struct { + name string + fields fields + args args + res res + }{ + { + name: "ok", + fields: fields{ + eventstore: expectEventstore( + slices.Concat( + setupInstanceElementsFilters("INSTANCE"), + []expect{ + expectPush( + setupInstanceElementsEvents(context.Background(), + "INSTANCE", + "ZITADEL", + language.English, + )..., + ), + }, + )..., + ), + }, + args: args{ + ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN"), + instanceAgg: instance.NewAggregate("INSTANCE"), + setup: setupInstanceElementsConfig(), + }, + res: res{ + err: nil, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + r := &Commands{ + eventstore: tt.fields.eventstore(t), + } + validations := setupInstanceElements(tt.args.instanceAgg, tt.args.setup) + + err := testSetup(context.Background(), r, validations) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + }) + } +} + +func TestCommandSide_setUpInstance(t *testing.T) { + type fields struct { + eventstore func(t *testing.T) *eventstore.Eventstore + idGenerator id.Generator + userPasswordHasher *crypto.Hasher + roles []authz.RoleMapping + keyAlgorithm crypto.EncryptionAlgorithm + generateDomain func(string, string) (string, error) + } + type args struct { + ctx context.Context + setup *InstanceSetup + } + type res struct { + pat bool + machineKey bool + err func(error) bool + } + tests := []struct { + name string + fields fields + args args + res res + }{ + { + name: "ok", + fields: fields{ + eventstore: expectEventstore( + slices.Concat( + setupInstanceFilters("INSTANCE", "ORG", "PROJECT", "console-id", "DOMAIN"), + []expect{ + expectPush( + setupInstanceEvents(context.Background(), + "INSTANCE", + "ORG", + "PROJECT", + "console-id", + "ZITADEL", + "ZITADEL", + language.English, + "DOMAIN", + false, + )..., + ), + }, + )..., + ), + userPasswordHasher: mockPasswordHasher("x"), + idGenerator: id_mock.NewIDGeneratorExpectIDs(t, orgIDs()...), + roles: []authz.RoleMapping{ + {Role: domain.RoleOrgOwner, Permissions: []string{""}}, + {Role: domain.RoleIAMOwner, Permissions: []string{""}}, + }, + keyAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t)), + generateDomain: func(string, string) (string, error) { + return "DOMAIN", nil + }, + }, + args: args{ + ctx: contextWithInstanceSetupInfo(context.Background(), "INSTANCE", "PROJECT", "console-id", "DOMAIN"), + setup: setupInstanceConfig(), + }, + res: res{ + err: nil, + }, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + r := &Commands{ + eventstore: tt.fields.eventstore(t), + idGenerator: tt.fields.idGenerator, + zitadelRoles: tt.fields.roles, + userPasswordHasher: tt.fields.userPasswordHasher, + keyAlgorithm: tt.fields.keyAlgorithm, + GenerateDomain: tt.fields.generateDomain, + } + + validations, pat, mk, err := setUpInstance(tt.args.ctx, r, tt.args.setup) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + + err = testSetup(tt.args.ctx, r, validations) + if tt.res.err == nil { + assert.NoError(t, err) + } + if tt.res.err != nil && !tt.res.err(err) { + t.Errorf("got wrong err: %v ", err) + } + + if tt.res.err == nil { + if tt.res.pat { + assert.NotNil(t, pat) + } + if tt.res.machineKey { + assert.NotNil(t, mk) + } + } + }) + } +} + func TestCommandSide_UpdateInstance(t *testing.T) { type fields struct { eventstore *eventstore.Eventstore diff --git a/internal/command/org.go b/internal/command/org.go index 5f997183af..db963762b1 100644 --- a/internal/command/org.go +++ b/internal/command/org.go @@ -63,7 +63,7 @@ type CreatedOrgAdmin struct { } func (c *Commands) setUpOrgWithIDs(ctx context.Context, o *OrgSetup, orgID string, allowInitialMail bool, userIDs ...string) (_ *CreatedOrg, err error) { - cmds := c.newOrgSetupCommands(ctx, orgID, o, userIDs) + cmds := c.newOrgSetupCommands(ctx, orgID, o) for _, admin := range o.Admins { if err = cmds.setupOrgAdmin(admin, allowInitialMail); err != nil { return nil, err @@ -76,10 +76,10 @@ func (c *Commands) setUpOrgWithIDs(ctx context.Context, o *OrgSetup, orgID strin return cmds.push(ctx) } -func (c *Commands) newOrgSetupCommands(ctx context.Context, orgID string, orgSetup *OrgSetup, userIDs []string) *orgSetupCommands { +func (c *Commands) newOrgSetupCommands(ctx context.Context, orgID string, orgSetup *OrgSetup) *orgSetupCommands { orgAgg := org.NewAggregate(orgID) validations := []preparation.Validation{ - AddOrgCommand(ctx, orgAgg, orgSetup.Name, userIDs...), + AddOrgCommand(ctx, orgAgg, orgSetup.Name), } return &orgSetupCommands{ validations: validations, @@ -233,7 +233,7 @@ func (c *Commands) SetUpOrg(ctx context.Context, o *OrgSetup, allowInitialMail b // AddOrgCommand defines the commands to create a new org, // this includes the verified default domain -func AddOrgCommand(ctx context.Context, a *org.Aggregate, name string, userIDs ...string) preparation.Validation { +func AddOrgCommand(ctx context.Context, a *org.Aggregate, name string) preparation.Validation { return func() (preparation.CreateCommands, error) { if name = strings.TrimSpace(name); name == "" { return nil, zerrors.ThrowInvalidArgument(nil, "ORG-mruNY", "Errors.Invalid.Argument") From 0bfcf2c31774de939a2701fb291f1a7eb968389a Mon Sep 17 00:00:00 2001 From: Silvan Date: Fri, 24 May 2024 13:32:57 +0200 Subject: [PATCH 25/35] refactor(query): use new packages for org by id query (#7826) If the feature is enabled the new packages are used to query org by id Part of: https://github.com/zitadel/zitadel/issues/7639 ### Definition of Ready - [x] I am happy with the code - [x] Short description of the feature/issue is added in the pr description - [x] PR is linked to the corresponding user story - [ ] Acceptance criteria are met - [ ] All open todos and follow ups are defined in a new ticket and justified - [ ] Deviations from the acceptance criteria and design are agreed with the PO and documented. - [x] No debug or dead code - [x] My code has no repetitions - [ ] Critical parts are tested automatically - [ ] Where possible E2E tests are implemented - [ ] Documentation/examples are up-to-date - [ ] All non-functional requirements are met - [x] Functionality of the acceptance criteria is checked manually on the dev system. --- .github/workflows/e2e.yml | 1 + internal/api/grpc/feature/v2/converter.go | 56 +++++++++++++++ .../api/grpc/feature/v2/converter_test.go | 20 ++++++ internal/command/instance_features.go | 12 ++-- internal/command/instance_features_model.go | 60 +++++++++------- internal/command/system_features.go | 6 +- internal/command/system_features_model.go | 67 +++++++++++------- internal/feature/feature.go | 30 ++++++-- internal/feature/key_enumer.go | 12 ++-- internal/query/instance_features.go | 2 + internal/query/instance_features_model.go | 39 +++++------ internal/query/org.go | 42 +++++++++++- .../query/projection/instance_features.go | 5 ++ internal/query/projection/system_features.go | 5 ++ internal/query/query.go | 8 ++- internal/query/system_features.go | 6 ++ internal/query/system_features_model.go | 32 +++++---- .../feature/feature_v2/eventstore.go | 4 ++ .../repository/feature/feature_v2/feature.go | 2 + internal/v2/projection/org_primary_domain.go | 57 ++++++++++++++++ internal/v2/projection/org_state.go | 67 ++++++++++++++++++ internal/v2/projection/projection.go | 20 ++++++ internal/v2/readmodel/org.go | 68 +++++++++++++++++++ internal/v2/readmodel/query.go | 15 ++++ proto/zitadel/feature/v2beta/feature.proto | 22 ++++++ proto/zitadel/feature/v2beta/instance.proto | 16 +++++ proto/zitadel/feature/v2beta/system.proto | 17 ++++- 27 files changed, 587 insertions(+), 104 deletions(-) create mode 100644 internal/v2/projection/org_primary_domain.go create mode 100644 internal/v2/projection/org_state.go create mode 100644 internal/v2/projection/projection.go create mode 100644 internal/v2/readmodel/org.go create mode 100644 internal/v2/readmodel/query.go diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index ee49ed33c9..6796658f6f 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -5,6 +5,7 @@ on: jobs: test: + timeout-minutes: 10 strategy: fail-fast: false matrix: diff --git a/internal/api/grpc/feature/v2/converter.go b/internal/api/grpc/feature/v2/converter.go index aa8b1287f4..259a6f8a42 100644 --- a/internal/api/grpc/feature/v2/converter.go +++ b/internal/api/grpc/feature/v2/converter.go @@ -16,6 +16,7 @@ func systemFeaturesToCommand(req *feature_pb.SetSystemFeaturesRequest) *command. UserSchema: req.UserSchema, Actions: req.Actions, TokenExchange: req.OidcTokenExchange, + ImprovedPerformance: improvedPerformanceListToDomain(req.ImprovedPerformance), } } @@ -28,6 +29,7 @@ func systemFeaturesToPb(f *query.SystemFeatures) *feature_pb.GetSystemFeaturesRe UserSchema: featureSourceToFlagPb(&f.UserSchema), OidcTokenExchange: featureSourceToFlagPb(&f.TokenExchange), Actions: featureSourceToFlagPb(&f.Actions), + ImprovedPerformance: featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance), } } @@ -39,6 +41,7 @@ func instanceFeaturesToCommand(req *feature_pb.SetInstanceFeaturesRequest) *comm UserSchema: req.UserSchema, TokenExchange: req.OidcTokenExchange, Actions: req.Actions, + ImprovedPerformance: improvedPerformanceListToDomain(req.ImprovedPerformance), } } @@ -51,6 +54,14 @@ func instanceFeaturesToPb(f *query.InstanceFeatures) *feature_pb.GetInstanceFeat UserSchema: featureSourceToFlagPb(&f.UserSchema), OidcTokenExchange: featureSourceToFlagPb(&f.TokenExchange), Actions: featureSourceToFlagPb(&f.Actions), + ImprovedPerformance: featureSourceToImprovedPerformanceFlagPb(&f.ImprovedPerformance), + } +} + +func featureSourceToImprovedPerformanceFlagPb(fs *query.FeatureSource[[]feature.ImprovedPerformanceType]) *feature_pb.ImprovedPerformanceFeatureFlag { + return &feature_pb.ImprovedPerformanceFeatureFlag{ + ExecutionPaths: improvedPerformanceTypesToPb(fs.Value), + Source: featureLevelToSourcePb(fs.Level), } } @@ -81,3 +92,48 @@ func featureLevelToSourcePb(level feature.Level) feature_pb.Source { return feature_pb.Source(level) } } + +func improvedPerformanceTypesToPb(types []feature.ImprovedPerformanceType) []feature_pb.ImprovedPerformance { + res := make([]feature_pb.ImprovedPerformance, len(types)) + + for i, typ := range types { + res[i] = improvedPerformanceTypeToPb(typ) + } + + return res +} + +func improvedPerformanceTypeToPb(typ feature.ImprovedPerformanceType) feature_pb.ImprovedPerformance { + switch typ { + case feature.ImprovedPerformanceTypeUnknown: + return feature_pb.ImprovedPerformance_IMPROVED_PERFORMANCE_UNSPECIFIED + case feature.ImprovedPerformanceTypeOrgByID: + return feature_pb.ImprovedPerformance_IMPROVED_PERFORMANCE_ORG_BY_ID + default: + return feature_pb.ImprovedPerformance(typ) + } +} + +func improvedPerformanceListToDomain(list []feature_pb.ImprovedPerformance) []feature.ImprovedPerformanceType { + if list == nil { + return nil + } + res := make([]feature.ImprovedPerformanceType, len(list)) + + for i, typ := range list { + res[i] = improvedPerformanceToDomain(typ) + } + + return res +} + +func improvedPerformanceToDomain(typ feature_pb.ImprovedPerformance) feature.ImprovedPerformanceType { + switch typ { + case feature_pb.ImprovedPerformance_IMPROVED_PERFORMANCE_UNSPECIFIED: + return feature.ImprovedPerformanceTypeUnknown + case feature_pb.ImprovedPerformance_IMPROVED_PERFORMANCE_ORG_BY_ID: + return feature.ImprovedPerformanceTypeOrgByID + default: + return feature.ImprovedPerformanceTypeUnknown + } +} diff --git a/internal/api/grpc/feature/v2/converter_test.go b/internal/api/grpc/feature/v2/converter_test.go index 78aea5eb15..35dbf98014 100644 --- a/internal/api/grpc/feature/v2/converter_test.go +++ b/internal/api/grpc/feature/v2/converter_test.go @@ -24,6 +24,7 @@ func Test_systemFeaturesToCommand(t *testing.T) { UserSchema: gu.Ptr(true), Actions: gu.Ptr(true), OidcTokenExchange: gu.Ptr(true), + ImprovedPerformance: nil, } want := &command.SystemFeatures{ LoginDefaultOrg: gu.Ptr(true), @@ -32,6 +33,7 @@ func Test_systemFeaturesToCommand(t *testing.T) { UserSchema: gu.Ptr(true), Actions: gu.Ptr(true), TokenExchange: gu.Ptr(true), + ImprovedPerformance: nil, } got := systemFeaturesToCommand(arg) assert.Equal(t, want, got) @@ -68,6 +70,10 @@ func Test_systemFeaturesToPb(t *testing.T) { Level: feature.LevelSystem, Value: false, }, + ImprovedPerformance: query.FeatureSource[[]feature.ImprovedPerformanceType]{ + Level: feature.LevelSystem, + Value: []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgByID}, + }, } want := &feature_pb.GetSystemFeaturesResponse{ Details: &object.Details{ @@ -99,6 +105,10 @@ func Test_systemFeaturesToPb(t *testing.T) { Enabled: true, Source: feature_pb.Source_SOURCE_SYSTEM, }, + ImprovedPerformance: &feature_pb.ImprovedPerformanceFeatureFlag{ + ExecutionPaths: []feature_pb.ImprovedPerformance{feature_pb.ImprovedPerformance_IMPROVED_PERFORMANCE_ORG_BY_ID}, + Source: feature_pb.Source_SOURCE_SYSTEM, + }, } got := systemFeaturesToPb(arg) assert.Equal(t, want, got) @@ -112,6 +122,7 @@ func Test_instanceFeaturesToCommand(t *testing.T) { UserSchema: gu.Ptr(true), OidcTokenExchange: gu.Ptr(true), Actions: gu.Ptr(true), + ImprovedPerformance: nil, } want := &command.InstanceFeatures{ LoginDefaultOrg: gu.Ptr(true), @@ -120,6 +131,7 @@ func Test_instanceFeaturesToCommand(t *testing.T) { UserSchema: gu.Ptr(true), TokenExchange: gu.Ptr(true), Actions: gu.Ptr(true), + ImprovedPerformance: nil, } got := instanceFeaturesToCommand(arg) assert.Equal(t, want, got) @@ -156,6 +168,10 @@ func Test_instanceFeaturesToPb(t *testing.T) { Level: feature.LevelSystem, Value: false, }, + ImprovedPerformance: query.FeatureSource[[]feature.ImprovedPerformanceType]{ + Level: feature.LevelSystem, + Value: []feature.ImprovedPerformanceType{feature.ImprovedPerformanceTypeOrgByID}, + }, } want := &feature_pb.GetInstanceFeaturesResponse{ Details: &object.Details{ @@ -187,6 +203,10 @@ func Test_instanceFeaturesToPb(t *testing.T) { Enabled: false, Source: feature_pb.Source_SOURCE_SYSTEM, }, + ImprovedPerformance: &feature_pb.ImprovedPerformanceFeatureFlag{ + ExecutionPaths: []feature_pb.ImprovedPerformance{feature_pb.ImprovedPerformance_IMPROVED_PERFORMANCE_ORG_BY_ID}, + Source: feature_pb.Source_SOURCE_SYSTEM, + }, } got := instanceFeaturesToPb(arg) assert.Equal(t, want, got) diff --git a/internal/command/instance_features.go b/internal/command/instance_features.go index 35ef57da37..3acc789d1b 100644 --- a/internal/command/instance_features.go +++ b/internal/command/instance_features.go @@ -7,6 +7,7 @@ import ( "github.com/zitadel/zitadel/internal/command/preparation" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore" + "github.com/zitadel/zitadel/internal/feature" "github.com/zitadel/zitadel/internal/repository/feature/feature_v2" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -18,6 +19,7 @@ type InstanceFeatures struct { UserSchema *bool TokenExchange *bool Actions *bool + ImprovedPerformance []feature.ImprovedPerformanceType } func (m *InstanceFeatures) isEmpty() bool { @@ -26,7 +28,9 @@ func (m *InstanceFeatures) isEmpty() bool { m.LegacyIntrospection == nil && m.UserSchema == nil && m.TokenExchange == nil && - m.Actions == nil + m.Actions == nil && + // nil check to allow unset improvements + m.ImprovedPerformance == nil } func (c *Commands) SetInstanceFeatures(ctx context.Context, f *InstanceFeatures) (*domain.ObjectDetails, error) { @@ -37,11 +41,11 @@ func (c *Commands) SetInstanceFeatures(ctx context.Context, f *InstanceFeatures) if err := c.eventstore.FilterToQueryReducer(ctx, wm); err != nil { return nil, err } - cmds := wm.setCommands(ctx, f) - if len(cmds) == 0 { + commands := wm.setCommands(ctx, f) + if len(commands) == 0 { return writeModelToObjectDetails(wm.WriteModel), nil } - events, err := c.eventstore.Push(ctx, cmds...) + events, err := c.eventstore.Push(ctx, commands...) if err != nil { return nil, err } diff --git a/internal/command/instance_features_model.go b/internal/command/instance_features_model.go index 55ce5ea3da..bfd606e672 100644 --- a/internal/command/instance_features_model.go +++ b/internal/command/instance_features_model.go @@ -30,14 +30,23 @@ func (m *InstanceFeaturesWriteModel) Reduce() (err error) { case *feature_v2.ResetEvent: m.reduceReset() case *feature_v1.SetEvent[feature_v1.Boolean]: - err = m.reduceBoolFeature( - feature_v1.DefaultLoginInstanceEventToV2(e), + reduceInstanceFeature( + &m.InstanceFeatures, + feature.KeyLoginDefaultOrg, + feature_v1.DefaultLoginInstanceEventToV2(e).Value, ) case *feature_v2.SetEvent[bool]: - err = m.reduceBoolFeature(e) - } - if err != nil { - return err + _, key, err := e.FeatureInfo() + if err != nil { + return err + } + reduceInstanceFeature(&m.InstanceFeatures, key, e.Value) + case *feature_v2.SetEvent[[]feature.ImprovedPerformanceType]: + _, key, err := e.FeatureInfo() + if err != nil { + return err + } + reduceInstanceFeature(&m.InstanceFeatures, key, e.Value) } } return m.WriteModel.Reduce() @@ -57,41 +66,41 @@ func (m *InstanceFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder { feature_v2.InstanceUserSchemaEventType, feature_v2.InstanceTokenExchangeEventType, feature_v2.InstanceActionsEventType, + feature_v2.InstanceImprovedPerformanceEventType, ). Builder().ResourceOwner(m.ResourceOwner) } func (m *InstanceFeaturesWriteModel) reduceReset() { - m.LoginDefaultOrg = nil - m.TriggerIntrospectionProjections = nil - m.LegacyIntrospection = nil - m.UserSchema = nil - m.TokenExchange = nil - m.Actions = nil + m.InstanceFeatures = InstanceFeatures{} } -func (m *InstanceFeaturesWriteModel) reduceBoolFeature(event *feature_v2.SetEvent[bool]) error { - _, key, err := event.FeatureInfo() - if err != nil { - return err - } +func reduceInstanceFeature(features *InstanceFeatures, key feature.Key, value any) { switch key { case feature.KeyUnspecified: - return nil + return case feature.KeyLoginDefaultOrg: - m.LoginDefaultOrg = &event.Value + v := value.(bool) + features.LoginDefaultOrg = &v case feature.KeyTriggerIntrospectionProjections: - m.TriggerIntrospectionProjections = &event.Value + v := value.(bool) + features.TriggerIntrospectionProjections = &v case feature.KeyLegacyIntrospection: - m.LegacyIntrospection = &event.Value + v := value.(bool) + features.LegacyIntrospection = &v case feature.KeyTokenExchange: - m.TokenExchange = &event.Value + v := value.(bool) + features.TokenExchange = &v case feature.KeyUserSchema: - m.UserSchema = &event.Value + v := value.(bool) + features.UserSchema = &v case feature.KeyActions: - m.Actions = &event.Value + v := value.(bool) + features.Actions = &v + case feature.KeyImprovedPerformance: + v := value.([]feature.ImprovedPerformanceType) + features.ImprovedPerformance = v } - return nil } func (wm *InstanceFeaturesWriteModel) setCommands(ctx context.Context, f *InstanceFeatures) []eventstore.Command { @@ -103,5 +112,6 @@ func (wm *InstanceFeaturesWriteModel) setCommands(ctx context.Context, f *Instan cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.TokenExchange, f.TokenExchange, feature_v2.InstanceTokenExchangeEventType) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.UserSchema, f.UserSchema, feature_v2.InstanceUserSchemaEventType) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.Actions, f.Actions, feature_v2.InstanceActionsEventType) + cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.InstanceImprovedPerformanceEventType) return cmds } diff --git a/internal/command/system_features.go b/internal/command/system_features.go index 838fef5b9d..5aa7c8dda1 100644 --- a/internal/command/system_features.go +++ b/internal/command/system_features.go @@ -4,6 +4,7 @@ import ( "context" "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/feature" "github.com/zitadel/zitadel/internal/repository/feature/feature_v2" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -15,6 +16,7 @@ type SystemFeatures struct { TokenExchange *bool UserSchema *bool Actions *bool + ImprovedPerformance []feature.ImprovedPerformanceType } func (m *SystemFeatures) isEmpty() bool { @@ -23,7 +25,9 @@ func (m *SystemFeatures) isEmpty() bool { m.LegacyIntrospection == nil && m.UserSchema == nil && m.TokenExchange == nil && - m.Actions == nil + m.Actions == nil && + // nil check to allow unset improvements + m.ImprovedPerformance == nil } func (c *Commands) SetSystemFeatures(ctx context.Context, f *SystemFeatures) (*domain.ObjectDetails, error) { diff --git a/internal/command/system_features_model.go b/internal/command/system_features_model.go index d21aa85cbc..46b36d15ad 100644 --- a/internal/command/system_features_model.go +++ b/internal/command/system_features_model.go @@ -23,16 +23,23 @@ func NewSystemFeaturesWriteModel() *SystemFeaturesWriteModel { return m } -func (m *SystemFeaturesWriteModel) Reduce() (err error) { +func (m *SystemFeaturesWriteModel) Reduce() error { for _, event := range m.Events { switch e := event.(type) { case *feature_v2.ResetEvent: m.reduceReset() case *feature_v2.SetEvent[bool]: - err = m.reduceBoolFeature(e) - } - if err != nil { - return err + _, key, err := e.FeatureInfo() + if err != nil { + return err + } + reduceSystemFeature(&m.SystemFeatures, key, e.Value) + case *feature_v2.SetEvent[[]feature.ImprovedPerformanceType]: + _, key, err := e.FeatureInfo() + if err != nil { + return err + } + reduceSystemFeature(&m.SystemFeatures, key, e.Value) } } return m.WriteModel.Reduce() @@ -52,41 +59,40 @@ func (m *SystemFeaturesWriteModel) Query() *eventstore.SearchQueryBuilder { feature_v2.SystemUserSchemaEventType, feature_v2.SystemTokenExchangeEventType, feature_v2.SystemActionsEventType, + feature_v2.SystemImprovedPerformanceEventType, ). Builder().ResourceOwner(m.ResourceOwner) } func (m *SystemFeaturesWriteModel) reduceReset() { - m.LoginDefaultOrg = nil - m.TriggerIntrospectionProjections = nil - m.LegacyIntrospection = nil - m.TokenExchange = nil - m.UserSchema = nil - m.Actions = nil + m.SystemFeatures = SystemFeatures{} } -func (m *SystemFeaturesWriteModel) reduceBoolFeature(event *feature_v2.SetEvent[bool]) error { - _, key, err := event.FeatureInfo() - if err != nil { - return err - } +func reduceSystemFeature(features *SystemFeatures, key feature.Key, value any) { switch key { case feature.KeyUnspecified: - return nil + return case feature.KeyLoginDefaultOrg: - m.LoginDefaultOrg = &event.Value + v := value.(bool) + features.LoginDefaultOrg = &v case feature.KeyTriggerIntrospectionProjections: - m.TriggerIntrospectionProjections = &event.Value + v := value.(bool) + features.TriggerIntrospectionProjections = &v case feature.KeyLegacyIntrospection: - m.LegacyIntrospection = &event.Value + v := value.(bool) + features.LegacyIntrospection = &v case feature.KeyUserSchema: - m.UserSchema = &event.Value + v := value.(bool) + features.UserSchema = &v case feature.KeyTokenExchange: - m.TokenExchange = &event.Value + v := value.(bool) + features.TokenExchange = &v case feature.KeyActions: - m.Actions = &event.Value + v := value.(bool) + features.Actions = &v + case feature.KeyImprovedPerformance: + features.ImprovedPerformance = value.([]feature.ImprovedPerformanceType) } - return nil } func (wm *SystemFeaturesWriteModel) setCommands(ctx context.Context, f *SystemFeatures) []eventstore.Command { @@ -98,6 +104,7 @@ func (wm *SystemFeaturesWriteModel) setCommands(ctx context.Context, f *SystemFe cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.UserSchema, f.UserSchema, feature_v2.SystemUserSchemaEventType) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.TokenExchange, f.TokenExchange, feature_v2.SystemTokenExchangeEventType) cmds = appendFeatureUpdate(ctx, cmds, aggregate, wm.Actions, f.Actions, feature_v2.SystemActionsEventType) + cmds = appendFeatureSliceUpdate(ctx, cmds, aggregate, wm.ImprovedPerformance, f.ImprovedPerformance, feature_v2.SystemImprovedPerformanceEventType) return cmds } @@ -107,3 +114,15 @@ func appendFeatureUpdate[T comparable](ctx context.Context, cmds []eventstore.Co } return cmds } + +func appendFeatureSliceUpdate[T comparable](ctx context.Context, cmds []eventstore.Command, aggregate *feature_v2.Aggregate, oldValues, newValues []T, eventType eventstore.EventType) []eventstore.Command { + if len(newValues) != len(oldValues) { + return append(cmds, feature_v2.NewSetEvent[[]T](ctx, aggregate, eventType, newValues)) + } + for i, oldValue := range oldValues { + if oldValue != newValues[i] { + return append(cmds, feature_v2.NewSetEvent[[]T](ctx, aggregate, eventType, newValues)) + } + } + return cmds +} diff --git a/internal/feature/feature.go b/internal/feature/feature.go index 5edab4a8ba..dc3e0eb597 100644 --- a/internal/feature/feature.go +++ b/internal/feature/feature.go @@ -11,6 +11,7 @@ const ( KeyUserSchema KeyTokenExchange KeyActions + KeyImprovedPerformance ) //go:generate enumer -type Level -transform snake -trimprefix Level @@ -27,10 +28,27 @@ const ( ) type Features struct { - LoginDefaultOrg bool `json:"login_default_org,omitempty"` - TriggerIntrospectionProjections bool `json:"trigger_introspection_projections,omitempty"` - LegacyIntrospection bool `json:"legacy_introspection,omitempty"` - UserSchema bool `json:"user_schema,omitempty"` - TokenExchange bool `json:"token_exchange,omitempty"` - Actions bool `json:"actions,omitempty"` + LoginDefaultOrg bool `json:"login_default_org,omitempty"` + TriggerIntrospectionProjections bool `json:"trigger_introspection_projections,omitempty"` + LegacyIntrospection bool `json:"legacy_introspection,omitempty"` + UserSchema bool `json:"user_schema,omitempty"` + TokenExchange bool `json:"token_exchange,omitempty"` + Actions bool `json:"actions,omitempty"` + ImprovedPerformance []ImprovedPerformanceType `json:"improved_performance,omitempty"` +} + +type ImprovedPerformanceType int32 + +const ( + ImprovedPerformanceTypeUnknown = iota + ImprovedPerformanceTypeOrgByID +) + +func (f Features) ShouldUseImprovedPerformance(typ ImprovedPerformanceType) bool { + for _, improvedType := range f.ImprovedPerformance { + if improvedType == typ { + return true + } + } + return false } diff --git a/internal/feature/key_enumer.go b/internal/feature/key_enumer.go index 172d5f9d01..ca3e156b61 100644 --- a/internal/feature/key_enumer.go +++ b/internal/feature/key_enumer.go @@ -7,11 +7,11 @@ import ( "strings" ) -const _KeyName = "unspecifiedlogin_default_orgtrigger_introspection_projectionslegacy_introspectionuser_schematoken_exchangeactions" +const _KeyName = "unspecifiedlogin_default_orgtrigger_introspection_projectionslegacy_introspectionuser_schematoken_exchangeactionsimproved_performance" -var _KeyIndex = [...]uint8{0, 11, 28, 61, 81, 92, 106, 113} +var _KeyIndex = [...]uint8{0, 11, 28, 61, 81, 92, 106, 113, 133} -const _KeyLowerName = "unspecifiedlogin_default_orgtrigger_introspection_projectionslegacy_introspectionuser_schematoken_exchangeactions" +const _KeyLowerName = "unspecifiedlogin_default_orgtrigger_introspection_projectionslegacy_introspectionuser_schematoken_exchangeactionsimproved_performance" func (i Key) String() string { if i < 0 || i >= Key(len(_KeyIndex)-1) { @@ -31,9 +31,10 @@ func _KeyNoOp() { _ = x[KeyUserSchema-(4)] _ = x[KeyTokenExchange-(5)] _ = x[KeyActions-(6)] + _ = x[KeyImprovedPerformance-(7)] } -var _KeyValues = []Key{KeyUnspecified, KeyLoginDefaultOrg, KeyTriggerIntrospectionProjections, KeyLegacyIntrospection, KeyUserSchema, KeyTokenExchange, KeyActions} +var _KeyValues = []Key{KeyUnspecified, KeyLoginDefaultOrg, KeyTriggerIntrospectionProjections, KeyLegacyIntrospection, KeyUserSchema, KeyTokenExchange, KeyActions, KeyImprovedPerformance} var _KeyNameToValueMap = map[string]Key{ _KeyName[0:11]: KeyUnspecified, @@ -50,6 +51,8 @@ var _KeyNameToValueMap = map[string]Key{ _KeyLowerName[92:106]: KeyTokenExchange, _KeyName[106:113]: KeyActions, _KeyLowerName[106:113]: KeyActions, + _KeyName[113:133]: KeyImprovedPerformance, + _KeyLowerName[113:133]: KeyImprovedPerformance, } var _KeyNames = []string{ @@ -60,6 +63,7 @@ var _KeyNames = []string{ _KeyName[81:92], _KeyName[92:106], _KeyName[106:113], + _KeyName[113:133], } // KeyString retrieves an enum value from the enum constants string name. diff --git a/internal/query/instance_features.go b/internal/query/instance_features.go index a362b6a5ad..12d8e0d80d 100644 --- a/internal/query/instance_features.go +++ b/internal/query/instance_features.go @@ -4,6 +4,7 @@ import ( "context" "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/feature" ) type InstanceFeatures struct { @@ -14,6 +15,7 @@ type InstanceFeatures struct { UserSchema FeatureSource[bool] TokenExchange FeatureSource[bool] Actions FeatureSource[bool] + ImprovedPerformance FeatureSource[[]feature.ImprovedPerformanceType] } func (q *Queries) GetInstanceFeatures(ctx context.Context, cascade bool) (_ *InstanceFeatures, err error) { diff --git a/internal/query/instance_features_model.go b/internal/query/instance_features_model.go index 068e56a23c..215442c911 100644 --- a/internal/query/instance_features_model.go +++ b/internal/query/instance_features_model.go @@ -36,11 +36,14 @@ func (m *InstanceFeaturesReadModel) Reduce() (err error) { case *feature_v2.ResetEvent: m.reduceReset() case *feature_v1.SetEvent[feature_v1.Boolean]: - err = m.reduceBoolFeature( + err = reduceInstanceFeatureSet( + m.instance, feature_v1.DefaultLoginInstanceEventToV2(e), ) case *feature_v2.SetEvent[bool]: - err = m.reduceBoolFeature(e) + err = reduceInstanceFeatureSet(m.instance, e) + case *feature_v2.SetEvent[[]feature.ImprovedPerformanceType]: + err = reduceInstanceFeatureSet(m.instance, e) } if err != nil { return err @@ -63,6 +66,7 @@ func (m *InstanceFeaturesReadModel) Query() *eventstore.SearchQueryBuilder { feature_v2.InstanceUserSchemaEventType, feature_v2.InstanceTokenExchangeEventType, feature_v2.InstanceActionsEventType, + feature_v2.InstanceImprovedPerformanceEventType, ). Builder().ResourceOwner(m.ResourceOwner) } @@ -71,12 +75,8 @@ func (m *InstanceFeaturesReadModel) reduceReset() { if m.populateFromSystem() { return } - m.instance.LoginDefaultOrg = FeatureSource[bool]{} - m.instance.TriggerIntrospectionProjections = FeatureSource[bool]{} - m.instance.LegacyIntrospection = FeatureSource[bool]{} - m.instance.UserSchema = FeatureSource[bool]{} - m.instance.TokenExchange = FeatureSource[bool]{} - m.instance.Actions = FeatureSource[bool]{} + m.instance = nil + m.instance = new(InstanceFeatures) } func (m *InstanceFeaturesReadModel) populateFromSystem() bool { @@ -89,35 +89,32 @@ func (m *InstanceFeaturesReadModel) populateFromSystem() bool { m.instance.UserSchema = m.system.UserSchema m.instance.TokenExchange = m.system.TokenExchange m.instance.Actions = m.system.Actions + m.instance.ImprovedPerformance = m.system.ImprovedPerformance return true } -func (m *InstanceFeaturesReadModel) reduceBoolFeature(event *feature_v2.SetEvent[bool]) error { +func reduceInstanceFeatureSet[T any](features *InstanceFeatures, event *feature_v2.SetEvent[T]) error { level, key, err := event.FeatureInfo() if err != nil { return err } - var dst *FeatureSource[bool] - switch key { case feature.KeyUnspecified: return nil case feature.KeyLoginDefaultOrg: - dst = &m.instance.LoginDefaultOrg + features.LoginDefaultOrg.set(level, event.Value) case feature.KeyTriggerIntrospectionProjections: - dst = &m.instance.TriggerIntrospectionProjections + features.TriggerIntrospectionProjections.set(level, event.Value) case feature.KeyLegacyIntrospection: - dst = &m.instance.LegacyIntrospection + features.LegacyIntrospection.set(level, event.Value) case feature.KeyUserSchema: - dst = &m.instance.UserSchema + features.UserSchema.set(level, event.Value) case feature.KeyTokenExchange: - dst = &m.instance.TokenExchange + features.TokenExchange.set(level, event.Value) case feature.KeyActions: - dst = &m.instance.Actions - } - *dst = FeatureSource[bool]{ - Level: level, - Value: event.Value, + features.Actions.set(level, event.Value) + case feature.KeyImprovedPerformance: + features.ImprovedPerformance.set(level, event.Value) } return nil } diff --git a/internal/query/org.go b/internal/query/org.go index 18715d015e..27bdfada76 100644 --- a/internal/query/org.go +++ b/internal/query/org.go @@ -13,8 +13,11 @@ import ( "github.com/zitadel/zitadel/internal/api/call" domain_pkg "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/eventstore/handler/v2" + "github.com/zitadel/zitadel/internal/feature" "github.com/zitadel/zitadel/internal/query/projection" "github.com/zitadel/zitadel/internal/telemetry/tracing" + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/v2/readmodel" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -92,7 +95,44 @@ func (q *OrgSearchQueries) toQuery(query sq.SelectBuilder) sq.SelectBuilder { return query } -func (q *Queries) OrgByID(ctx context.Context, shouldTriggerBulk bool, id string) (org *Org, err error) { +func (q *Queries) OrgByID(ctx context.Context, shouldTriggerBulk bool, id string) (_ *Org, err error) { + ctx, span := tracing.NewSpan(ctx) + defer func() { span.EndWithError(err) }() + + if !authz.GetInstance(ctx).Features().ShouldUseImprovedPerformance(feature.ImprovedPerformanceTypeOrgByID) { + return q.oldOrgByID(ctx, shouldTriggerBulk, id) + } + + foundOrg := readmodel.NewOrg(id) + eventCount, err := q.eventStoreV4.Query( + ctx, + eventstore.NewQuery( + authz.GetInstance(ctx).InstanceID(), + foundOrg, + eventstore.AppendFilters(foundOrg.Filter()...), + ), + ) + if err != nil { + return nil, zerrors.ThrowInternal(err, "QUERY-AWx52", "Errors.Query.SQLStatement") + } + + if eventCount == 0 { + return nil, zerrors.ThrowNotFound(nil, "QUERY-leq5Q", "Errors.Org.NotFound") + } + + return &Org{ + ID: foundOrg.ID, + CreationDate: foundOrg.CreationDate, + ChangeDate: foundOrg.ChangeDate, + ResourceOwner: foundOrg.Owner, + State: domain_pkg.OrgState(foundOrg.State.State), + Sequence: uint64(foundOrg.Sequence), + Name: foundOrg.Name, + Domain: foundOrg.PrimaryDomain.Domain, + }, nil +} + +func (q *Queries) oldOrgByID(ctx context.Context, shouldTriggerBulk bool, id string) (org *Org, err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() diff --git a/internal/query/projection/instance_features.go b/internal/query/projection/instance_features.go index ebb388da89..06090a2f5d 100644 --- a/internal/query/projection/instance_features.go +++ b/internal/query/projection/instance_features.go @@ -6,6 +6,7 @@ import ( "github.com/zitadel/zitadel/internal/eventstore" old_handler "github.com/zitadel/zitadel/internal/eventstore/handler" "github.com/zitadel/zitadel/internal/eventstore/handler/v2" + "github.com/zitadel/zitadel/internal/feature" feature_v1 "github.com/zitadel/zitadel/internal/repository/feature" "github.com/zitadel/zitadel/internal/repository/feature/feature_v2" "github.com/zitadel/zitadel/internal/repository/instance" @@ -83,6 +84,10 @@ func (*instanceFeatureProjection) Reducers() []handler.AggregateReducer { Event: feature_v2.InstanceActionsEventType, Reduce: reduceInstanceSetFeature[bool], }, + { + Event: feature_v2.InstanceImprovedPerformanceEventType, + Reduce: reduceInstanceSetFeature[[]feature.ImprovedPerformanceType], + }, { Event: instance.InstanceRemovedEventType, Reduce: reduceInstanceRemovedHelper(InstanceDomainInstanceIDCol), diff --git a/internal/query/projection/system_features.go b/internal/query/projection/system_features.go index 94c6282c49..158da7a616 100644 --- a/internal/query/projection/system_features.go +++ b/internal/query/projection/system_features.go @@ -6,6 +6,7 @@ import ( "github.com/zitadel/zitadel/internal/eventstore" old_handler "github.com/zitadel/zitadel/internal/eventstore/handler" "github.com/zitadel/zitadel/internal/eventstore/handler/v2" + "github.com/zitadel/zitadel/internal/feature" "github.com/zitadel/zitadel/internal/repository/feature/feature_v2" "github.com/zitadel/zitadel/internal/zerrors" ) @@ -75,6 +76,10 @@ func (*systemFeatureProjection) Reducers() []handler.AggregateReducer { Event: feature_v2.SystemActionsEventType, Reduce: reduceSystemSetFeature[bool], }, + { + Event: feature_v2.SystemImprovedPerformanceEventType, + Reduce: reduceSystemSetFeature[[]feature.ImprovedPerformanceType], + }, }, }} } diff --git a/internal/query/query.go b/internal/query/query.go index 6bae5f924e..8b8313625e 100644 --- a/internal/query/query.go +++ b/internal/query/query.go @@ -19,11 +19,14 @@ import ( "github.com/zitadel/zitadel/internal/eventstore/handler/v2" "github.com/zitadel/zitadel/internal/query/projection" "github.com/zitadel/zitadel/internal/telemetry/tracing" + es_v4 "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/v2/eventstore/postgres" ) type Queries struct { - eventstore *eventstore.Eventstore - client *database.DB + eventstore *eventstore.Eventstore + eventStoreV4 es_v4.Querier + client *database.DB keyEncryptionAlgorithm crypto.EncryptionAlgorithm idpConfigEncryption crypto.EncryptionAlgorithm @@ -56,6 +59,7 @@ func StartQueries( ) (repo *Queries, err error) { repo = &Queries{ eventstore: es, + eventStoreV4: postgres.New(querySqlClient), client: querySqlClient, DefaultLanguage: language.Und, LoginTranslationFileContents: make(map[string][]byte), diff --git a/internal/query/system_features.go b/internal/query/system_features.go index 65087e92dc..33e5f14b3a 100644 --- a/internal/query/system_features.go +++ b/internal/query/system_features.go @@ -12,6 +12,11 @@ type FeatureSource[T any] struct { Value T } +func (f *FeatureSource[T]) set(level feature.Level, value any) { + f.Level = level + f.Value = value.(T) +} + type SystemFeatures struct { Details *domain.ObjectDetails @@ -21,6 +26,7 @@ type SystemFeatures struct { UserSchema FeatureSource[bool] TokenExchange FeatureSource[bool] Actions FeatureSource[bool] + ImprovedPerformance FeatureSource[[]feature.ImprovedPerformanceType] } func (q *Queries) GetSystemFeatures(ctx context.Context) (_ *SystemFeatures, err error) { diff --git a/internal/query/system_features_model.go b/internal/query/system_features_model.go index 243dc4e6c4..9b185c3e8f 100644 --- a/internal/query/system_features_model.go +++ b/internal/query/system_features_model.go @@ -28,7 +28,12 @@ func (m *SystemFeaturesReadModel) Reduce() error { case *feature_v2.ResetEvent: m.reduceReset() case *feature_v2.SetEvent[bool]: - err := m.reduceBoolFeature(e) + err := reduceSystemFeatureSet(m.system, e) + if err != nil { + return err + } + case *feature_v2.SetEvent[[]feature.ImprovedPerformanceType]: + err := reduceSystemFeatureSet(m.system, e) if err != nil { return err } @@ -51,41 +56,38 @@ func (m *SystemFeaturesReadModel) Query() *eventstore.SearchQueryBuilder { feature_v2.SystemUserSchemaEventType, feature_v2.SystemTokenExchangeEventType, feature_v2.SystemActionsEventType, + feature_v2.SystemImprovedPerformanceEventType, ). Builder().ResourceOwner(m.ResourceOwner) } func (m *SystemFeaturesReadModel) reduceReset() { + m.system = nil m.system = new(SystemFeatures) } -func (m *SystemFeaturesReadModel) reduceBoolFeature(event *feature_v2.SetEvent[bool]) error { +func reduceSystemFeatureSet[T any](features *SystemFeatures, event *feature_v2.SetEvent[T]) error { level, key, err := event.FeatureInfo() if err != nil { return err } - var dst *FeatureSource[bool] - switch key { case feature.KeyUnspecified: return nil case feature.KeyLoginDefaultOrg: - dst = &m.system.LoginDefaultOrg + features.LoginDefaultOrg.set(level, event.Value) case feature.KeyTriggerIntrospectionProjections: - dst = &m.system.TriggerIntrospectionProjections + features.TriggerIntrospectionProjections.set(level, event.Value) case feature.KeyLegacyIntrospection: - dst = &m.system.LegacyIntrospection + features.LegacyIntrospection.set(level, event.Value) case feature.KeyUserSchema: - dst = &m.system.UserSchema + features.UserSchema.set(level, event.Value) case feature.KeyTokenExchange: - dst = &m.system.TokenExchange + features.TokenExchange.set(level, event.Value) case feature.KeyActions: - dst = &m.system.Actions - } - - *dst = FeatureSource[bool]{ - Level: level, - Value: event.Value, + features.Actions.set(level, event.Value) + case feature.KeyImprovedPerformance: + features.ImprovedPerformance.set(level, event.Value) } return nil } diff --git a/internal/repository/feature/feature_v2/eventstore.go b/internal/repository/feature/feature_v2/eventstore.go index 26f33661fe..bd8b22eec8 100644 --- a/internal/repository/feature/feature_v2/eventstore.go +++ b/internal/repository/feature/feature_v2/eventstore.go @@ -2,6 +2,7 @@ package feature_v2 import ( "github.com/zitadel/zitadel/internal/eventstore" + "github.com/zitadel/zitadel/internal/feature" ) func init() { @@ -12,6 +13,8 @@ func init() { eventstore.RegisterFilterEventMapper(AggregateType, SystemUserSchemaEventType, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, SystemTokenExchangeEventType, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, SystemActionsEventType, eventstore.GenericEventMapper[SetEvent[bool]]) + eventstore.RegisterFilterEventMapper(AggregateType, SystemImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]]) + eventstore.RegisterFilterEventMapper(AggregateType, InstanceResetEventType, eventstore.GenericEventMapper[ResetEvent]) eventstore.RegisterFilterEventMapper(AggregateType, InstanceLoginDefaultOrgEventType, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, InstanceTriggerIntrospectionProjectionsEventType, eventstore.GenericEventMapper[SetEvent[bool]]) @@ -19,4 +22,5 @@ func init() { eventstore.RegisterFilterEventMapper(AggregateType, InstanceUserSchemaEventType, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, InstanceTokenExchangeEventType, eventstore.GenericEventMapper[SetEvent[bool]]) eventstore.RegisterFilterEventMapper(AggregateType, InstanceActionsEventType, eventstore.GenericEventMapper[SetEvent[bool]]) + eventstore.RegisterFilterEventMapper(AggregateType, InstanceImprovedPerformanceEventType, eventstore.GenericEventMapper[SetEvent[[]feature.ImprovedPerformanceType]]) } diff --git a/internal/repository/feature/feature_v2/feature.go b/internal/repository/feature/feature_v2/feature.go index c1f9add2d7..d5beea8bf4 100644 --- a/internal/repository/feature/feature_v2/feature.go +++ b/internal/repository/feature/feature_v2/feature.go @@ -18,6 +18,7 @@ var ( SystemUserSchemaEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyUserSchema) SystemTokenExchangeEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyTokenExchange) SystemActionsEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyActions) + SystemImprovedPerformanceEventType = setEventTypeFromFeature(feature.LevelSystem, feature.KeyImprovedPerformance) InstanceResetEventType = resetEventTypeFromFeature(feature.LevelInstance) InstanceLoginDefaultOrgEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyLoginDefaultOrg) @@ -26,6 +27,7 @@ var ( InstanceUserSchemaEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyUserSchema) InstanceTokenExchangeEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyTokenExchange) InstanceActionsEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyActions) + InstanceImprovedPerformanceEventType = setEventTypeFromFeature(feature.LevelInstance, feature.KeyImprovedPerformance) ) const ( diff --git a/internal/v2/projection/org_primary_domain.go b/internal/v2/projection/org_primary_domain.go new file mode 100644 index 0000000000..3c83cd3152 --- /dev/null +++ b/internal/v2/projection/org_primary_domain.go @@ -0,0 +1,57 @@ +package projection + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/v2/org" +) + +type OrgPrimaryDomain struct { + projection + + id string + + Domain string +} + +func NewOrgPrimaryDomain(id string) *OrgPrimaryDomain { + return &OrgPrimaryDomain{ + id: id, + } +} + +func (p *OrgPrimaryDomain) Filter() []*eventstore.Filter { + return []*eventstore.Filter{ + eventstore.NewFilter( + eventstore.FilterPagination( + eventstore.GlobalPositionGreater(&p.position), + ), + eventstore.AppendAggregateFilter( + org.AggregateType, + eventstore.AggregateIDs(p.id), + eventstore.AppendEvent( + eventstore.SetEventTypes(org.DomainPrimarySetType), + ), + ), + ), + } +} + +func (p *OrgPrimaryDomain) Reduce(events ...*eventstore.StorageEvent) error { + for _, event := range events { + if !p.shouldReduce(event) { + continue + } + if event.Type != org.DomainPrimarySetType { + continue + } + e, err := org.DomainPrimarySetEventFromStorage(event) + if err != nil { + return err + } + + p.Domain = e.Payload.Name + p.projection.reduce(event) + } + + return nil +} diff --git a/internal/v2/projection/org_state.go b/internal/v2/projection/org_state.go new file mode 100644 index 0000000000..f67b51060a --- /dev/null +++ b/internal/v2/projection/org_state.go @@ -0,0 +1,67 @@ +package projection + +import ( + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/v2/org" +) + +type OrgState struct { + projection + + id string + + org.State +} + +func NewStateProjection(id string) *OrgState { + // TODO: check buffer for id and return from buffer if exists + return &OrgState{ + id: id, + } +} + +func (p *OrgState) Filter() []*eventstore.Filter { + return []*eventstore.Filter{ + eventstore.NewFilter( + eventstore.FilterPagination( + eventstore.Descending(), + eventstore.GlobalPositionGreater(&p.position), + ), + eventstore.AppendAggregateFilter( + org.AggregateType, + eventstore.AggregateIDs(p.id), + eventstore.AppendEvent( + eventstore.SetEventTypes( + org.AddedType, + org.DeactivatedType, + org.ReactivatedType, + org.RemovedType, + ), + ), + ), + ), + } +} + +func (p *OrgState) Reduce(events ...*eventstore.StorageEvent) error { + for _, event := range events { + if !p.shouldReduce(event) { + continue + } + + switch event.Type { + case org.AddedType: + p.State = org.ActiveState + case org.DeactivatedType: + p.State = org.InactiveState + case org.ReactivatedType: + p.State = org.ActiveState + case org.RemovedType: + p.State = org.RemovedState + default: + continue + } + p.position = event.Position + } + return nil +} diff --git a/internal/v2/projection/projection.go b/internal/v2/projection/projection.go new file mode 100644 index 0000000000..980eaecc74 --- /dev/null +++ b/internal/v2/projection/projection.go @@ -0,0 +1,20 @@ +package projection + +import "github.com/zitadel/zitadel/internal/v2/eventstore" + +type projection struct { + instance string + position eventstore.GlobalPosition +} + +func (p *projection) reduce(event *eventstore.StorageEvent) { + if p.instance == "" { + p.instance = event.Aggregate.Instance + } + p.position = event.Position +} + +func (p *projection) shouldReduce(event *eventstore.StorageEvent) bool { + shouldReduce := p.instance == "" || p.instance == event.Aggregate.Instance + return shouldReduce && p.position.IsLess(event.Position) +} diff --git a/internal/v2/readmodel/org.go b/internal/v2/readmodel/org.go new file mode 100644 index 0000000000..94bcb21537 --- /dev/null +++ b/internal/v2/readmodel/org.go @@ -0,0 +1,68 @@ +package readmodel + +import ( + "time" + + "github.com/zitadel/zitadel/internal/v2/eventstore" + "github.com/zitadel/zitadel/internal/v2/org" + "github.com/zitadel/zitadel/internal/v2/projection" +) + +type Org struct { + ID string + Name string + PrimaryDomain *projection.OrgPrimaryDomain + State *projection.OrgState + + Sequence uint32 + CreationDate time.Time + ChangeDate time.Time + Owner string +} + +func NewOrg(id string) *Org { + return &Org{ + ID: id, + State: projection.NewStateProjection(id), + PrimaryDomain: projection.NewOrgPrimaryDomain(id), + } +} + +func (rm *Org) Filter() []*eventstore.Filter { + return []*eventstore.Filter{ + // we don't need the filters of the projections as we filter all events of the read model + eventstore.NewFilter( + eventstore.AppendAggregateFilter( + org.AggregateType, + eventstore.SetAggregateID(rm.ID), + ), + ), + } +} + +func (rm *Org) Reduce(events ...*eventstore.StorageEvent) error { + for _, event := range events { + switch event.Type { + case org.AddedType: + added, err := org.AddedEventFromStorage(event) + if err != nil { + return err + } + rm.Name = added.Payload.Name + rm.Owner = event.Aggregate.Owner + rm.CreationDate = event.CreatedAt + case org.ChangedType: + changed, err := org.ChangedEventFromStorage(event) + if err != nil { + return err + } + rm.Name = changed.Payload.Name + } + rm.Sequence = event.Sequence + rm.ChangeDate = event.CreatedAt + } + if err := rm.State.Reduce(events...); err != nil { + return err + } + return rm.PrimaryDomain.Reduce(events...) +} diff --git a/internal/v2/readmodel/query.go b/internal/v2/readmodel/query.go new file mode 100644 index 0000000000..73ca7cd415 --- /dev/null +++ b/internal/v2/readmodel/query.go @@ -0,0 +1,15 @@ +package readmodel + +import ( + "database/sql" + + "github.com/zitadel/zitadel/internal/v2/eventstore" +) + +type QueryOpt func(opts []eventstore.QueryOpt) []eventstore.QueryOpt + +func WithTx(tx *sql.Tx) QueryOpt { + return func(opts []eventstore.QueryOpt) []eventstore.QueryOpt { + return append(opts, eventstore.SetQueryTx(tx)) + } +} diff --git a/proto/zitadel/feature/v2beta/feature.proto b/proto/zitadel/feature/v2beta/feature.proto index 484bb667fc..082159b95b 100644 --- a/proto/zitadel/feature/v2beta/feature.proto +++ b/proto/zitadel/feature/v2beta/feature.proto @@ -33,3 +33,25 @@ message FeatureFlag { } ]; } + +message ImprovedPerformanceFeatureFlag { + repeated ImprovedPerformance execution_paths = 1 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "[1]"; + description: "Which of the performance improvements is enabled"; + } + ]; + + Source source = 2 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + description: "The source where the setting of the feature was defined. The source may be the resource itself or a resource owner through inheritance."; + } + ]; +} + +enum ImprovedPerformance { + IMPROVED_PERFORMANCE_UNSPECIFIED = 0; + // Uses the eventstore to query the org by id + // instead of the sql table. + IMPROVED_PERFORMANCE_ORG_BY_ID = 1; +} \ No newline at end of file diff --git a/proto/zitadel/feature/v2beta/instance.proto b/proto/zitadel/feature/v2beta/instance.proto index 3cfc2c4506..292fcc5101 100644 --- a/proto/zitadel/feature/v2beta/instance.proto +++ b/proto/zitadel/feature/v2beta/instance.proto @@ -49,6 +49,15 @@ message SetInstanceFeaturesRequest{ description: "Actions allow to manage data executions and targets. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage."; } ]; + + repeated ImprovedPerformance improved_performance = 7 [ + (validate.rules).repeated.unique = true, + (validate.rules).repeated.items.enum = {defined_only: true, not_in: [0]}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "[1]"; + description: "Improves performance of specified execution paths."; + } + ]; } message SetInstanceFeaturesResponse { @@ -113,4 +122,11 @@ message GetInstanceFeaturesResponse { description: "Actions v2 allow to manage data executions and targets. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage."; } ]; + + ImprovedPerformanceFeatureFlag improved_performance = 8 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "[1]"; + description: "Improves performance of specified execution paths."; + } + ]; } diff --git a/proto/zitadel/feature/v2beta/system.proto b/proto/zitadel/feature/v2beta/system.proto index 8f98eb0625..048f25391f 100644 --- a/proto/zitadel/feature/v2beta/system.proto +++ b/proto/zitadel/feature/v2beta/system.proto @@ -46,13 +46,21 @@ message SetSystemFeaturesRequest{ } ]; - optional bool actions = 6 [ (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { example: "true"; description: "Actions allow to manage data executions and targets. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage."; } ]; + + repeated ImprovedPerformance improved_performance = 7 [ + (validate.rules).repeated.unique = true, + (validate.rules).repeated.items.enum = {defined_only: true, not_in: [0]}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "[1]"; + description: "Improves performance of specified execution paths."; + } + ]; } message SetSystemFeaturesResponse { @@ -110,4 +118,11 @@ message GetSystemFeaturesResponse { description: "Actions v2 allow to manage data executions and targets. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage."; } ]; + + ImprovedPerformanceFeatureFlag improved_performance = 8 [ + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "[1]"; + description: "Improves performance of specified execution paths."; + } + ]; } From 8e55b9713b9cbef59335530c9782f4956198a447 Mon Sep 17 00:00:00 2001 From: Florian Forster Date: Fri, 24 May 2024 15:44:15 +0200 Subject: [PATCH 26/35] chore(cloud): increase rate limits (#8005) # Which Problems Are Solved We identified some frequent rate limits in ZITADEL Cloud. # How the Problems Are Solved We increase the rate limits of some endpoint. # Additional Context (Private) Relates to https://github.com/zitadel/DevOps/issues/43 --- docs/docs/legal/policies/rate-limit-policy.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/docs/legal/policies/rate-limit-policy.md b/docs/docs/legal/policies/rate-limit-policy.md index 378bab28e4..6075b7e6ab 100644 --- a/docs/docs/legal/policies/rate-limit-policy.md +++ b/docs/docs/legal/policies/rate-limit-policy.md @@ -3,7 +3,7 @@ title: Rate Limit Policy custom_edit_url: null --- -Last updated on April 20, 2023 +Last updated on April 24, 2024 This policy is an annex to the [Terms of Service](../terms-of-service) and clarifies your obligations while using our Services, specifically how we will use rate limiting to enforce certain aspects of our [Acceptable Use Policy](acceptable-use-policy). @@ -35,10 +35,12 @@ For ZITADEL Cloud, we have a rate limiting rule for login paths (login, register Rate limits are implemented with the following rules: -| Path | Description | Rate Limiting | One Minute Banning | -|--------------------------|----------------------------------------|--------------------------------------|----------------------------------------| -| /ui/login* | Global Login, Register and Reset Limit | 10 requests per second over a minute | 15 requests per second over 3 minutes | -| All other paths | All gRPC- and REST APIs as well as the ZITADEL Customer Portal | 10 requests per second over a minute | 10 requests per second over 3 minutes | +| Path | Description | Rate Limiting | One Minute Banning | +| -------------------- | -------------------------------------------------------------- | ------------------------------------ | ------------------------------------- | +| /ui/login\* | Global Login, Register and Reset Limit | 10 requests per second over a minute | 15 requests per second over 3 minutes | +| /oauth/v2/keys | OAuth/OpenID Public Keys Endpoint | 20 requests per second over a minute | 15 requests per second over 3 minutes | +| /oauth/v2/introspect | OAuth Introspection Endpoint | 20 requests per second over a minute | 15 requests per second over 3 minutes | +| All other paths | All gRPC- and REST APIs as well as the ZITADEL Customer Portal | 10 requests per second over a minute | 10 requests per second over 3 minutes | ## Load Testing From 5cfccb1442a462d874cfcfb59042f18eab99c906 Mon Sep 17 00:00:00 2001 From: Silvan Date: Fri, 24 May 2024 16:13:36 +0200 Subject: [PATCH 27/35] fix(actions): correct statements to query targets (#8006) # Which Problems Are Solved Curretly loading targets fails on cockraochdb because the order of `with`-statements is wrong. # How the Problems Are Solved Changed the order of queries in the statements. --- internal/query/targets_by_execution_id.sql | 30 ++++++++-------- internal/query/targets_by_execution_ids.sql | 38 ++++++++++----------- 2 files changed, 34 insertions(+), 34 deletions(-) diff --git a/internal/query/targets_by_execution_id.sql b/internal/query/targets_by_execution_id.sql index 6b564104e5..f8248479b0 100644 --- a/internal/query/targets_by_execution_id.sql +++ b/internal/query/targets_by_execution_id.sql @@ -1,4 +1,18 @@ WITH RECURSIVE + matched AS (SELECT * + FROM projections.executions1 + WHERE instance_id = $1 + AND id = ANY($2) + ORDER BY id DESC + LIMIT 1), + matched_targets_and_includes AS (SELECT pos.* + FROM matched m + JOIN + projections.executions1_targets pos + ON m.id = pos.execution_id + AND m.instance_id = pos.instance_id + ORDER BY execution_id, + position), dissolved_execution_targets(execution_id, instance_id, position, "include", "target_id") AS (SELECT execution_id , instance_id @@ -16,21 +30,7 @@ WITH RECURSIVE JOIN projections.executions1_targets p ON e.instance_id = p.instance_id AND e.include IS NOT NULL - AND e.include = p.execution_id), - matched AS (SELECT * - FROM projections.executions1 - WHERE instance_id = $1 - AND id = ANY($2) - ORDER BY id DESC - LIMIT 1), - matched_targets_and_includes AS (SELECT pos.* - FROM matched m - JOIN - projections.executions1_targets pos - ON m.id = pos.execution_id - AND m.instance_id = pos.instance_id - ORDER BY execution_id, - position) + AND e.include = p.execution_id) select e.execution_id, e.instance_id, e.target_id, t.target_type, t.endpoint, t.timeout, t.interrupt_on_error FROM dissolved_execution_targets e JOIN projections.targets1 t diff --git a/internal/query/targets_by_execution_ids.sql b/internal/query/targets_by_execution_ids.sql index c1361d9320..749d9387b2 100644 --- a/internal/query/targets_by_execution_ids.sql +++ b/internal/query/targets_by_execution_ids.sql @@ -1,22 +1,4 @@ WITH RECURSIVE - dissolved_execution_targets(execution_id, instance_id, position, "include", "target_id") - AS (SELECT execution_id - , instance_id - , ARRAY [position] - , "include" - , "target_id" - FROM matched_targets_and_includes - UNION ALL - SELECT e.execution_id - , p.instance_id - , e.position || p.position - , p."include" - , p."target_id" - FROM dissolved_execution_targets e - JOIN projections.executions1_targets p - ON e.instance_id = p.instance_id - AND e.include IS NOT NULL - AND e.include = p.execution_id), matched AS ((SELECT * FROM projections.executions1 WHERE instance_id = $1 @@ -37,7 +19,25 @@ WITH RECURSIVE ON m.id = pos.execution_id AND m.instance_id = pos.instance_id ORDER BY execution_id, - position) + position), + dissolved_execution_targets(execution_id, instance_id, position, "include", "target_id") + AS (SELECT execution_id + , instance_id + , ARRAY [position] + , "include" + , "target_id" + FROM matched_targets_and_includes + UNION ALL + SELECT e.execution_id + , p.instance_id + , e.position || p.position + , p."include" + , p."target_id" + FROM dissolved_execution_targets e + JOIN projections.executions1_targets p + ON e.instance_id = p.instance_id + AND e.include IS NOT NULL + AND e.include = p.execution_id) select e.execution_id, e.instance_id, e.target_id, t.target_type, t.endpoint, t.timeout, t.interrupt_on_error FROM dissolved_execution_targets e JOIN projections.targets1 t From d058a2bc8a6cf663f7e639db7eec57656c3b235f Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Fri, 24 May 2024 16:58:45 +0200 Subject: [PATCH 28/35] fix(login): ensure auth request (#8004) # Which Problems Are Solved Potential nil pointers leading to a panic in the login UI. # How the Problems Are Solved As of now the login UI did not always check if the authRequest was actually retrieved form the database, which is ok for some endpoints which can also be called outside of an auth request. There are now methods added to ensure the request is loaded. # Additional Changes None # Additional Context Closes https://github.com/zitadel/DevOps/issues/55 --- internal/api/ui/login/auth_request.go | 18 ++++++++++++++++++ .../api/ui/login/change_password_handler.go | 2 +- internal/api/ui/login/device_auth.go | 6 ++---- .../api/ui/login/external_provider_handler.go | 4 ++-- internal/api/ui/login/ldap_handler.go | 2 +- internal/api/ui/login/link_prompt_handler.go | 2 +- internal/api/ui/login/mfa_init_sms.go | 2 +- internal/api/ui/login/mfa_init_u2f.go | 2 +- .../api/ui/login/mfa_init_verify_handler.go | 2 +- internal/api/ui/login/mfa_prompt_handler.go | 2 +- internal/api/ui/login/mfa_verify_handler.go | 2 +- .../api/ui/login/mfa_verify_otp_handler.go | 4 ++-- .../api/ui/login/mfa_verify_u2f_handler.go | 2 +- internal/api/ui/login/password_handler.go | 2 +- .../api/ui/login/password_reset_handler.go | 2 +- .../api/ui/login/passwordless_login_handler.go | 2 +- internal/api/ui/login/select_user_handler.go | 2 +- .../api/ui/login/username_change_handler.go | 2 +- 18 files changed, 38 insertions(+), 22 deletions(-) diff --git a/internal/api/ui/login/auth_request.go b/internal/api/ui/login/auth_request.go index f2dcce57da..4da045efac 100644 --- a/internal/api/ui/login/auth_request.go +++ b/internal/api/ui/login/auth_request.go @@ -7,6 +7,7 @@ import ( http_mw "github.com/zitadel/zitadel/internal/api/http/middleware" "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/zerrors" ) const ( @@ -23,6 +24,14 @@ func (l *Login) getAuthRequest(r *http.Request) (*domain.AuthRequest, error) { return l.authRepo.AuthRequestByID(r.Context(), authRequestID, userAgentID) } +func (l *Login) ensureAuthRequest(r *http.Request) (*domain.AuthRequest, error) { + authRequest, err := l.getAuthRequest(r) + if authRequest != nil || err != nil { + return authRequest, err + } + return nil, zerrors.ThrowInvalidArgument(nil, "LOGIN-OLah9", "invalid or missing auth request") +} + func (l *Login) getAuthRequestAndParseData(r *http.Request, data interface{}) (*domain.AuthRequest, error) { authReq, err := l.getAuthRequest(r) if err != nil { @@ -32,6 +41,15 @@ func (l *Login) getAuthRequestAndParseData(r *http.Request, data interface{}) (* return authReq, err } +func (l *Login) ensureAuthRequestAndParseData(r *http.Request, data interface{}) (*domain.AuthRequest, error) { + authReq, err := l.ensureAuthRequest(r) + if err != nil { + return authReq, err + } + err = l.parser.Parse(r, data) + return authReq, err +} + func (l *Login) getParseData(r *http.Request, data interface{}) error { return l.parser.Parse(r, data) } diff --git a/internal/api/ui/login/change_password_handler.go b/internal/api/ui/login/change_password_handler.go index 1eacdcebd5..5c36d0f74f 100644 --- a/internal/api/ui/login/change_password_handler.go +++ b/internal/api/ui/login/change_password_handler.go @@ -20,7 +20,7 @@ type changePasswordData struct { func (l *Login) handleChangePassword(w http.ResponseWriter, r *http.Request) { data := new(changePasswordData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/device_auth.go b/internal/api/ui/login/device_auth.go index 659f2ac144..0d5349903e 100644 --- a/internal/api/ui/login/device_auth.go +++ b/internal/api/ui/login/device_auth.go @@ -14,7 +14,6 @@ import ( "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/api/http/middleware" "github.com/zitadel/zitadel/internal/domain" - "github.com/zitadel/zitadel/internal/zerrors" ) const ( @@ -145,9 +144,8 @@ func (l *Login) redirectDeviceAuthStart(w http.ResponseWriter, r *http.Request, // When the action of "allowed" or "denied", the device authorization is updated accordingly. // Else the user is presented with a page where they can choose / submit either action. func (l *Login) handleDeviceAuthAction(w http.ResponseWriter, r *http.Request) { - authReq, err := l.getAuthRequest(r) - if authReq == nil { - err = zerrors.ThrowInvalidArgument(err, "LOGIN-OLah8", "invalid or missing auth request") + authReq, err := l.ensureAuthRequest(r) + if err != nil { l.redirectDeviceAuthStart(w, r, err.Error()) return } diff --git a/internal/api/ui/login/external_provider_handler.go b/internal/api/ui/login/external_provider_handler.go index e03b32086f..ab0d98b997 100644 --- a/internal/api/ui/login/external_provider_handler.go +++ b/internal/api/ui/login/external_provider_handler.go @@ -127,7 +127,7 @@ func (l *Login) handleExternalLogin(w http.ResponseWriter, r *http.Request) { // handleExternalRegister is called when a user selects the idp on the register options page func (l *Login) handleExternalRegister(w http.ResponseWriter, r *http.Request) { data := new(externalIDPData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return @@ -657,7 +657,7 @@ func (l *Login) renderExternalNotFoundOption(w http.ResponseWriter, r *http.Requ // and either links or creates an externalUser func (l *Login) handleExternalNotFoundOptionCheck(w http.ResponseWriter, r *http.Request) { data := new(externalNotFoundOptionFormData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderExternalNotFoundOption(w, r, authReq, nil, nil, nil, err) return diff --git a/internal/api/ui/login/ldap_handler.go b/internal/api/ui/login/ldap_handler.go index 93590458f6..0fd47c5a6a 100644 --- a/internal/api/ui/login/ldap_handler.go +++ b/internal/api/ui/login/ldap_handler.go @@ -42,7 +42,7 @@ func (l *Login) renderLDAPLogin(w http.ResponseWriter, r *http.Request, authReq func (l *Login) handleLDAPCallback(w http.ResponseWriter, r *http.Request) { data := new(ldapFormData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/link_prompt_handler.go b/internal/api/ui/login/link_prompt_handler.go index 04293bd864..30ac186298 100644 --- a/internal/api/ui/login/link_prompt_handler.go +++ b/internal/api/ui/login/link_prompt_handler.go @@ -44,7 +44,7 @@ func (l *Login) renderLinkingUserPrompt(w http.ResponseWriter, r *http.Request, func (l *Login) handleLinkingUserPrompt(w http.ResponseWriter, r *http.Request) { data := new(linkingUserPromptFormData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderLogin(w, r, authReq, err) return diff --git a/internal/api/ui/login/mfa_init_sms.go b/internal/api/ui/login/mfa_init_sms.go index 9aaa744a39..03f2c32014 100644 --- a/internal/api/ui/login/mfa_init_sms.go +++ b/internal/api/ui/login/mfa_init_sms.go @@ -71,7 +71,7 @@ func (l *Login) renderRegisterSMS(w http.ResponseWriter, r *http.Request, authRe // and a successful OTP SMS check will be added to the auth request. func (l *Login) handleRegisterSMSCheck(w http.ResponseWriter, r *http.Request) { formData := new(smsInitFormData) - authReq, err := l.getAuthRequestAndParseData(r, formData) + authReq, err := l.ensureAuthRequestAndParseData(r, formData) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/mfa_init_u2f.go b/internal/api/ui/login/mfa_init_u2f.go index 0b7718bb80..c84948796c 100644 --- a/internal/api/ui/login/mfa_init_u2f.go +++ b/internal/api/ui/login/mfa_init_u2f.go @@ -42,7 +42,7 @@ func (l *Login) renderRegisterU2F(w http.ResponseWriter, r *http.Request, authRe func (l *Login) handleRegisterU2F(w http.ResponseWriter, r *http.Request) { data := new(webAuthNFormData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/mfa_init_verify_handler.go b/internal/api/ui/login/mfa_init_verify_handler.go index 0b66451434..cd6a9091e2 100644 --- a/internal/api/ui/login/mfa_init_verify_handler.go +++ b/internal/api/ui/login/mfa_init_verify_handler.go @@ -26,7 +26,7 @@ type mfaInitVerifyData struct { func (l *Login) handleMFAInitVerify(w http.ResponseWriter, r *http.Request) { data := new(mfaInitVerifyData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/mfa_prompt_handler.go b/internal/api/ui/login/mfa_prompt_handler.go index ade1b53229..ce1b7240ec 100644 --- a/internal/api/ui/login/mfa_prompt_handler.go +++ b/internal/api/ui/login/mfa_prompt_handler.go @@ -18,7 +18,7 @@ type mfaPromptData struct { func (l *Login) handleMFAPrompt(w http.ResponseWriter, r *http.Request) { data := new(mfaPromptData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/mfa_verify_handler.go b/internal/api/ui/login/mfa_verify_handler.go index 80f1c94e25..cfffc6fced 100644 --- a/internal/api/ui/login/mfa_verify_handler.go +++ b/internal/api/ui/login/mfa_verify_handler.go @@ -19,7 +19,7 @@ type mfaVerifyFormData struct { func (l *Login) handleMFAVerify(w http.ResponseWriter, r *http.Request) { data := new(mfaVerifyFormData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/mfa_verify_otp_handler.go b/internal/api/ui/login/mfa_verify_otp_handler.go index 2c0d5d8568..b39605e667 100644 --- a/internal/api/ui/login/mfa_verify_otp_handler.go +++ b/internal/api/ui/login/mfa_verify_otp_handler.go @@ -75,8 +75,8 @@ func (l *Login) renderOTPVerification(w http.ResponseWriter, r *http.Request, au // A user is also able to request a code resend or choose another provider. func (l *Login) handleOTPVerificationCheck(w http.ResponseWriter, r *http.Request) { formData := new(mfaOTPFormData) - authReq, err := l.getAuthRequestAndParseData(r, formData) - if authReq == nil || err != nil { + authReq, err := l.ensureAuthRequestAndParseData(r, formData) + if err != nil { l.renderError(w, r, authReq, err) return } diff --git a/internal/api/ui/login/mfa_verify_u2f_handler.go b/internal/api/ui/login/mfa_verify_u2f_handler.go index 3afa416823..7873468616 100644 --- a/internal/api/ui/login/mfa_verify_u2f_handler.go +++ b/internal/api/ui/login/mfa_verify_u2f_handler.go @@ -50,7 +50,7 @@ func (l *Login) renderU2FVerification(w http.ResponseWriter, r *http.Request, au func (l *Login) handleU2FVerification(w http.ResponseWriter, r *http.Request) { formData := new(mfaU2FFormData) - authReq, err := l.getAuthRequestAndParseData(r, formData) + authReq, err := l.ensureAuthRequestAndParseData(r, formData) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/password_handler.go b/internal/api/ui/login/password_handler.go index 28baf4a1e1..026963bbde 100644 --- a/internal/api/ui/login/password_handler.go +++ b/internal/api/ui/login/password_handler.go @@ -34,7 +34,7 @@ func (l *Login) renderPassword(w http.ResponseWriter, r *http.Request, authReq * func (l *Login) handlePasswordCheck(w http.ResponseWriter, r *http.Request) { data := new(passwordFormData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/password_reset_handler.go b/internal/api/ui/login/password_reset_handler.go index ff57321e92..bc9a5069d1 100644 --- a/internal/api/ui/login/password_reset_handler.go +++ b/internal/api/ui/login/password_reset_handler.go @@ -12,7 +12,7 @@ const ( ) func (l *Login) handlePasswordReset(w http.ResponseWriter, r *http.Request) { - authReq, err := l.getAuthRequest(r) + authReq, err := l.ensureAuthRequest(r) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/passwordless_login_handler.go b/internal/api/ui/login/passwordless_login_handler.go index 8373a8fbdb..52b9d06fed 100644 --- a/internal/api/ui/login/passwordless_login_handler.go +++ b/internal/api/ui/login/passwordless_login_handler.go @@ -49,7 +49,7 @@ func (l *Login) renderPasswordlessVerification(w http.ResponseWriter, r *http.Re func (l *Login) handlePasswordlessVerification(w http.ResponseWriter, r *http.Request) { formData := new(passwordlessFormData) - authReq, err := l.getAuthRequestAndParseData(r, formData) + authReq, err := l.ensureAuthRequestAndParseData(r, formData) if err != nil { l.renderError(w, r, authReq, err) return diff --git a/internal/api/ui/login/select_user_handler.go b/internal/api/ui/login/select_user_handler.go index 3febbaed7a..98c3993376 100644 --- a/internal/api/ui/login/select_user_handler.go +++ b/internal/api/ui/login/select_user_handler.go @@ -36,7 +36,7 @@ func (l *Login) renderUserSelection(w http.ResponseWriter, r *http.Request, auth func (l *Login) handleSelectUser(w http.ResponseWriter, r *http.Request) { data := new(userSelectionFormData) - authSession, err := l.getAuthRequestAndParseData(r, data) + authSession, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authSession, err) return diff --git a/internal/api/ui/login/username_change_handler.go b/internal/api/ui/login/username_change_handler.go index 7a497c4eb5..f11fe43a72 100644 --- a/internal/api/ui/login/username_change_handler.go +++ b/internal/api/ui/login/username_change_handler.go @@ -27,7 +27,7 @@ func (l *Login) renderChangeUsername(w http.ResponseWriter, r *http.Request, aut func (l *Login) handleChangeUsername(w http.ResponseWriter, r *http.Request) { data := new(changeUsernameData) - authReq, err := l.getAuthRequestAndParseData(r, data) + authReq, err := l.ensureAuthRequestAndParseData(r, data) if err != nil { l.renderError(w, r, authReq, err) return From eefa35715f0cb81190d8de7c0f4bbcda8d538eeb Mon Sep 17 00:00:00 2001 From: Elio Bischof Date: Fri, 24 May 2024 18:45:06 +0200 Subject: [PATCH 29/35] chore: tag author in ready for review comment (#8009) # Which Problems Are Solved It is not very clear if the author or the reviewer of a PR should tick the boxes. # How the Problems Are Solved The author of the PR is tagged in the comment, because the author should tick the boxes before marking it as ready for review. --- .github/workflows/ready_for_review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ready_for_review.yml b/.github/workflows/ready_for_review.yml index f46ee4a407..2ead263dc9 100644 --- a/.github/workflows/ready_for_review.yml +++ b/.github/workflows/ready_for_review.yml @@ -9,7 +9,7 @@ jobs: - uses: actions/github-script@v7 with: script: | - const content = `### Thanks for your contribution! 🎉 + const content = `### Thanks for your contribution @${{ github.event.pull_request.user.login }}! 🎉 Please make sure you tick the following checkboxes before marking this Pull Request (PR) as ready for review: From 0b366bece622c705a0b81e9a5ad2d04dc031f30a Mon Sep 17 00:00:00 2001 From: Fuzzbizz Date: Mon, 27 May 2024 09:30:07 +0200 Subject: [PATCH 30/35] fix: Service User Description in English localization (#8011) # Which Problems Are Solved - The text was in French instead of English # How the Problems Are Solved - I wrote the text in English # Additional Changes No Additional Changes # Additional Context This is a followup to https://github.com/zitadel/zitadel/pull/8007/ which has German in the English file. --------- Co-authored-by: Fabienne Co-authored-by: Fabi --- console/src/assets/i18n/en.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/console/src/assets/i18n/en.json b/console/src/assets/i18n/en.json index f411faddcd..8a50cae2cf 100644 --- a/console/src/assets/i18n/en.json +++ b/console/src/assets/i18n/en.json @@ -54,7 +54,7 @@ }, "MACHINES": { "TITLE": "Service Users", - "DESCRIPTION": "Les utilisateurs du service s'authentifient de manière non interactive à l'aide d'un jeton de porteur JWT signé avec une clé privée. Ils peuvent également utiliser un jeton d'accès personnel.", + "DESCRIPTION": "Service Users authenticate non-interactively using a JWT bearer token signed with a private key. They can also use a personal access token.", "METADATA": "Add custom attributes to the user like the authenticating system. You can use this information in your actions." }, "SELF": { From cff0f73e24f938c0f492726f1ac75c73246c9ee5 Mon Sep 17 00:00:00 2001 From: Silvan Date: Mon, 27 May 2024 11:03:34 +0200 Subject: [PATCH 31/35] fix(init): add setting to enable durable locks on crdb (#7982) feat(init): add setting to enable durable locks on crdb --- cmd/initialise/init.go | 9 +++- cmd/initialise/sql/cockroach/11_settings.sql | 4 ++ cmd/initialise/sql/postgres/11_settings.sql | 0 cmd/initialise/verify_settings.go | 44 +++++++++++++++++++ .../manage/database/_cockroachdb.mdx | 2 + docs/docs/support/advisory/a10009.md | 27 ++++++++++++ docs/docs/support/technical_advisory.mdx | 14 +++++- internal/eventstore/local_crdb_test.go | 3 +- .../repository/sql/local_crdb_test.go | 3 +- 9 files changed, 102 insertions(+), 4 deletions(-) create mode 100644 cmd/initialise/sql/cockroach/11_settings.sql create mode 100644 cmd/initialise/sql/postgres/11_settings.sql create mode 100644 cmd/initialise/verify_settings.go create mode 100644 docs/docs/support/advisory/a10009.md diff --git a/cmd/initialise/init.go b/cmd/initialise/init.go index 7451f73ad3..d45bacfc17 100644 --- a/cmd/initialise/init.go +++ b/cmd/initialise/init.go @@ -19,6 +19,7 @@ var ( createUserStmt string grantStmt string + settingsStmt string databaseStmt string createEventstoreStmt string createProjectionsStmt string @@ -53,7 +54,7 @@ The user provided by flags needs privileges to }, } - cmd.AddCommand(newZitadel(), newDatabase(), newUser(), newGrant()) + cmd.AddCommand(newZitadel(), newDatabase(), newUser(), newGrant(), newSettings()) return cmd } @@ -62,6 +63,7 @@ func InitAll(ctx context.Context, config *Config) { VerifyUser(config.Database.Username(), config.Database.Password()), VerifyDatabase(config.Database.DatabaseName()), VerifyGrant(config.Database.DatabaseName(), config.Database.Username()), + VerifySettings(config.Database.DatabaseName(), config.Database.Username()), ) logging.OnError(err).Fatal("unable to initialize the database") @@ -147,6 +149,11 @@ func ReadStmts(typ string) (err error) { return err } + settingsStmt, err = readStmt(typ, "11_settings") + if err != nil { + return err + } + return nil } diff --git a/cmd/initialise/sql/cockroach/11_settings.sql b/cmd/initialise/sql/cockroach/11_settings.sql new file mode 100644 index 0000000000..5fa9dd72f6 --- /dev/null +++ b/cmd/initialise/sql/cockroach/11_settings.sql @@ -0,0 +1,4 @@ +-- replace the first %[1]q with the database in double quotes +-- replace the second \%[2]q with the user in double quotes$ +-- For more information see technical advisory 10009 (https://zitadel.com/docs/support/advisory/a10009) +ALTER ROLE %[2]q IN DATABASE %[1]q SET enable_durable_locking_for_serializable = on; \ No newline at end of file diff --git a/cmd/initialise/sql/postgres/11_settings.sql b/cmd/initialise/sql/postgres/11_settings.sql new file mode 100644 index 0000000000..e69de29bb2 diff --git a/cmd/initialise/verify_settings.go b/cmd/initialise/verify_settings.go new file mode 100644 index 0000000000..75e811663f --- /dev/null +++ b/cmd/initialise/verify_settings.go @@ -0,0 +1,44 @@ +package initialise + +import ( + _ "embed" + "fmt" + + "github.com/spf13/cobra" + "github.com/spf13/viper" + "github.com/zitadel/logging" + + "github.com/zitadel/zitadel/internal/database" +) + +func newSettings() *cobra.Command { + return &cobra.Command{ + Use: "settings", + Short: "Ensures proper settings on the database", + Long: `Ensures proper settings on the database. + +Prerequisites: +- cockroachDB or postgreSQL + +Cockroach +- Sets enable_durable_locking_for_serializable to on for the zitadel user and database +`, + Run: func(cmd *cobra.Command, args []string) { + config := MustNewConfig(viper.GetViper()) + + err := initialise(config.Database, VerifySettings(config.Database.DatabaseName(), config.Database.Username())) + logging.OnError(err).Fatal("unable to set settings") + }, + } +} + +func VerifySettings(databaseName, username string) func(*database.DB) error { + return func(db *database.DB) error { + if db.Type() == "postgres" { + return nil + } + logging.WithFields("user", username, "database", databaseName).Info("verify settings") + + return exec(db, fmt.Sprintf(settingsStmt, databaseName, username), nil) + } +} diff --git a/docs/docs/self-hosting/manage/database/_cockroachdb.mdx b/docs/docs/self-hosting/manage/database/_cockroachdb.mdx index 2836640669..edc3f139fd 100644 --- a/docs/docs/self-hosting/manage/database/_cockroachdb.mdx +++ b/docs/docs/self-hosting/manage/database/_cockroachdb.mdx @@ -2,6 +2,8 @@ The default database of ZITADEL is [CockroachDB](https://www.cockroachlabs.com). The SQL database provides a bunch of features like horizontal scalability, data regionality and many more. +Currently versions >= 23.2 are supported. + The default configuration of the database looks like this: ```yaml diff --git a/docs/docs/support/advisory/a10009.md b/docs/docs/support/advisory/a10009.md new file mode 100644 index 0000000000..7137fdceaf --- /dev/null +++ b/docs/docs/support/advisory/a10009.md @@ -0,0 +1,27 @@ +--- +title: Technical Advisory 10009 +--- + +## Date and Version + +Version: 2.53.0 + +Date: Calendar week 23/24 2024 + +## Description + +There were rare cases where Cockroachdb got blocked during runtime of ZITADEL and returned `WRITE_TOO_OLD`-errors to ZITADEL. The root cause of the problem is described in [this github issue of the database](https://github.com/cockroachdb/cockroach/issues/77119). The workaround provided by the database is enabling the `enable_durable_locking_for_serializable`-flag as described [here](https://github.com/cockroachdb/cockroach/issues/75456#issuecomment-1936277716). + +Because enabling flags requires admin privileges the statement must be executed manually or by executing `zitadel init` command. + +## Statement + +Ensure lock distribution for `FOR UPDATE`-statements on Cockroachdb. + +## Mitigation + +Cockroachdb version >= 23.2. + +## Impact + +Adding additional raft queries to `FOR UPDATE`-statements can impact performance slightly but ensures availability of the system. diff --git a/docs/docs/support/technical_advisory.mdx b/docs/docs/support/technical_advisory.mdx index d1a865f88d..565dae3904 100644 --- a/docs/docs/support/technical_advisory.mdx +++ b/docs/docs/support/technical_advisory.mdx @@ -149,11 +149,23 @@ We understand that these advisories may include breaking changes, and we aim to New flag to prefill projections during setup instead of after start Feature description - new flag `--init-projections` introduced to `zitadel setup` commands (`setup`, `start-from-setup`, `start-from-init`) + New flag `--init-projections` introduced to `zitadel setup` commands (`setup`, `start-from-setup`, `start-from-init`) 2.44.0, 2.43.6, 2.42.12 2024-01-25 + + + A-10009 + + Ensure lock distribution for `FOR UPDATE`-statements on Cockroachdb + Feature description + + Fixes rare cases where updating projections was blocked by a `WRITE_TOO_OLD`-error when using cockroachdb. + + 2.53.0 + 2024-05-27 + ## Subscribe to our Mailing List diff --git a/internal/eventstore/local_crdb_test.go b/internal/eventstore/local_crdb_test.go index fc7a35daf9..6df9e9fd29 100644 --- a/internal/eventstore/local_crdb_test.go +++ b/internal/eventstore/local_crdb_test.go @@ -88,7 +88,8 @@ func initDB(db *database.DB) error { err := initialise.Init(db, initialise.VerifyUser(config.Username(), ""), initialise.VerifyDatabase(config.DatabaseName()), - initialise.VerifyGrant(config.DatabaseName(), config.Username())) + initialise.VerifyGrant(config.DatabaseName(), config.Username()), + initialise.VerifySettings(config.DatabaseName(), config.Username())) if err != nil { return err } diff --git a/internal/eventstore/repository/sql/local_crdb_test.go b/internal/eventstore/repository/sql/local_crdb_test.go index ca5128aaf7..fccb169341 100644 --- a/internal/eventstore/repository/sql/local_crdb_test.go +++ b/internal/eventstore/repository/sql/local_crdb_test.go @@ -60,7 +60,8 @@ func initDB(db *database.DB) error { err := initialise.Init(db, initialise.VerifyUser(config.Username(), ""), initialise.VerifyDatabase(config.DatabaseName()), - initialise.VerifyGrant(config.DatabaseName(), config.Username())) + initialise.VerifyGrant(config.DatabaseName(), config.Username()), + initialise.VerifySettings(config.DatabaseName(), config.Username())) if err != nil { return err } From e3cdf76439e67c6a6eec5113b8d64ea9d1d19580 Mon Sep 17 00:00:00 2001 From: mffap Date: Mon, 27 May 2024 13:04:59 +0200 Subject: [PATCH 32/35] docs(features): clean up audit trail feature (#8018) # Which Problems Are Solved duplicated content # How the Problems Are Solved reference to primary conent --- docs/docs/concepts/features/audit-trail.md | 31 ++++++++-------------- 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/docs/docs/concepts/features/audit-trail.md b/docs/docs/concepts/features/audit-trail.md index a4c79e003e..355029a6a4 100644 --- a/docs/docs/concepts/features/audit-trail.md +++ b/docs/docs/concepts/features/audit-trail.md @@ -14,6 +14,15 @@ This form of audit log has several benefits over storing classic audit logs. You can view past data in-context of the whole system at a single point in time. Reviewing a past state of the application can be important when tracing an incident that happened months back. Moreover the eventstore provides a truly complete and clean audit log. +:::info Future Plans +There will be three major areas for future development on the audit data + +- [Metrics](https://github.com/zitadel/zitadel/issues/4458) and [standard reports](https://github.com/zitadel/zitadel/discussions/2162#discussioncomment-1153259) +- [Feedback loop](https://github.com/zitadel/zitadel/issues/5102) and threat detection +- Forensics and replay of events + +::: + ## Accessing the Audit Log ### Last changes of an object @@ -42,24 +51,6 @@ Access to the API is possible with a [Service User](/docs/guides/integrate/servi ## Using logs in external systems -You can use the [Event API](#event-api) to pull data and ingest it in an external system. +You can use the events from the audit log in external systems such as a SOC/SIEM solution. -[Actions](actions.md) can be used to write events to the stdout and [process the events as logs](../../self-hosting/manage/production#logging). -Please refer to the zitadel/actions repository for a [code sample](https://github.com/zitadel/actions/blob/main/examples/post_auth_log.js). -You can use your log processing pipeline to parse and ingest the events in your favorite analytics tool. - -It is possible to send events directly with an http request to an external tool. -We don't recommend this approach since this would create back-pressure and increase the overall processing time for requests. - -:::info Scope of Actions -At this moment Actions can be invoked on certain events, but not generally on every event. -This is not a technical limitation, but a [feature on our backlog](https://github.com/zitadel/zitadel/issues/5101). -::: - -## Future plans - -There will be three major areas for future development on the audit data - -- [Metrics](https://github.com/zitadel/zitadel/issues/4458) and [standard reports](https://github.com/zitadel/zitadel/discussions/2162#discussioncomment-1153259) -- [Feedback loop](https://github.com/zitadel/zitadel/issues/5102) and threat detection -- Forensics and replay of events +Follow our guide on how to [integrate ZITADEL with external systems for streaming events and audit logs](/docs/guides/integrate/external-audit-log). From 5fa32cbfb9fad1b228967c95596c3c8df75ef3e4 Mon Sep 17 00:00:00 2001 From: Silvan Date: Tue, 28 May 2024 07:03:50 +0200 Subject: [PATCH 33/35] chore(stable): update to v2.48.5 (#8020) Updates the stable tag to v.2.48.5 --- release-channels.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release-channels.yaml b/release-channels.yaml index 496ddee451..873825b841 100644 --- a/release-channels.yaml +++ b/release-channels.yaml @@ -1 +1 @@ -stable: "v2.47.10" +stable: "v2.48.5" From 4dc86c241531bbe23d30a4d7efb0aa05010bff1e Mon Sep 17 00:00:00 2001 From: Silvan Date: Tue, 28 May 2024 08:49:30 +0200 Subject: [PATCH 34/35] fix(eventstore): order by sequence if filter by aggregate id (#8019) # Which Problems Are Solved Queriying events by an aggregate id can produce high loads on the database if the aggregate id contains many events (count > 1000000). # How the Problems Are Solved Instead of using the postion and in_tx_order columns we use the sequence column which guarantees correct ordering in a single aggregate and uses more optimised indexes. # Additional Context Closes https://github.com/zitadel/DevOps/issues/50 Co-authored-by: Livio Spring --- internal/eventstore/repository/sql/crdb.go | 10 ++++++++-- internal/eventstore/repository/sql/query.go | 17 ++++++++++++++--- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/internal/eventstore/repository/sql/crdb.go b/internal/eventstore/repository/sql/crdb.go index 2298f8ee48..9f925d4635 100644 --- a/internal/eventstore/repository/sql/crdb.go +++ b/internal/eventstore/repository/sql/crdb.go @@ -282,17 +282,23 @@ func (db *CRDB) db() *database.DB { return db.DB } -func (db *CRDB) orderByEventSequence(desc, useV1 bool) string { +func (db *CRDB) orderByEventSequence(desc, shouldOrderBySequence, useV1 bool) string { if useV1 { if desc { return ` ORDER BY event_sequence DESC` } return ` ORDER BY event_sequence` } + if shouldOrderBySequence { + if desc { + return ` ORDER BY "sequence" DESC` + } + return ` ORDER BY "sequence"` + } + if desc { return ` ORDER BY "position" DESC, in_tx_order DESC` } - return ` ORDER BY "position", in_tx_order` } diff --git a/internal/eventstore/repository/sql/query.go b/internal/eventstore/repository/sql/query.go index 145f168d52..3cddcb7924 100644 --- a/internal/eventstore/repository/sql/query.go +++ b/internal/eventstore/repository/sql/query.go @@ -28,7 +28,7 @@ type querier interface { maxSequenceQuery(useV1 bool) string instanceIDsQuery(useV1 bool) string db() *database.DB - orderByEventSequence(desc, useV1 bool) string + orderByEventSequence(desc, shouldOrderBySequence, useV1 bool) string dialect.Database } @@ -59,6 +59,7 @@ func query(ctx context.Context, criteria querier, searchQuery *eventstore.Search if err != nil { return err } + query, rowScanner := prepareColumns(criteria, q.Columns, useV1) where, values := prepareConditions(criteria, q, useV1) if where == "" || query == "" { @@ -78,10 +79,20 @@ func query(ctx context.Context, criteria querier, searchQuery *eventstore.Search q.Desc = true } + // if there is only one subquery we can optimize the query ordering by ordering by sequence + var shouldOrderBySequence bool + if len(q.SubQueries) == 1 { + for _, filter := range q.SubQueries[0] { + if filter.Field == repository.FieldAggregateID { + shouldOrderBySequence = filter.Operation == repository.OperationEquals + } + } + } + switch q.Columns { case eventstore.ColumnsEvent, eventstore.ColumnsMaxSequence: - query += criteria.orderByEventSequence(q.Desc, useV1) + query += criteria.orderByEventSequence(q.Desc, shouldOrderBySequence, useV1) } if q.Limit > 0 { @@ -220,7 +231,7 @@ func eventsScanner(useV1 bool) func(scanner scan, dest interface{}) (err error) } } -func prepareConditions(criteria querier, query *repository.SearchQuery, useV1 bool) (string, []any) { +func prepareConditions(criteria querier, query *repository.SearchQuery, useV1 bool) (_ string, args []any) { clauses, args := prepareQuery(criteria, useV1, query.InstanceID, query.InstanceIDs, query.ExcludedInstances) if clauses != "" && len(query.SubQueries) > 0 { clauses += " AND " From ec222a13d7a42a9a5e523a8e7f8dbb923747e654 Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Tue, 28 May 2024 10:59:49 +0200 Subject: [PATCH 35/35] fix(oidc): IDP and passwordless user auth methods (#7998) # Which Problems Are Solved As already mentioned and (partially) fixed in #7992 we discovered, issues with v2 tokens that where obtained through an IDP, with passwordless authentication or with password authentication (wihtout any 2FA set up) using the v1 login for zitadel API calls - (Previous) authentication through an IdP is now correctly treated as auth method in case of a reauth even when the user is not redirected to the IdP - There were some cases where passwordless authentication was successfully checked but not correctly set as auth method, which denied access to ZITADEL API - Users with password and passwordless, but no 2FA set up which authenticate just wich password can access the ZITADEL API again Additionally while testing we found out that because of #7969 the login UI could completely break / block with the following error: `sql: Scan error on column index 3, name "state": converting NULL to int32 is unsupported (Internal)` # How the Problems Are Solved - IdP checks are treated the same way as other factors and it's ensured that a succeeded check within the configured timeframe will always provide the idp auth method - `MFATypesAllowed` checks for possible passwordless authentication - As with the v1 login, the token check now only requires MFA if the policy is set or the user has 2FA set up - UserAuthMethodsRequirements now always uses the correctly policy to check for MFA enforcement - `State` column is handled as nullable and additional events set the state to active (as before #7969) # Additional Changes - Console now also checks for 403 (mfa required) errors (e.g. after setting up the first 2FA in console) and redirects the user to the login UI (with the current id_token as id_token_hint) - Possible duplicates in auth methods / AMRs are removed now as well. # Additional Context - Bugs were introduced in #7822 and # and 7969 and only part of a pre-release. - partially already fixed with #7992 - Reported internally. --- .../app/services/authentication.service.ts | 4 + console/src/app/services/grpc.service.ts | 1 + .../services/interceptors/auth.interceptor.ts | 14 +++- internal/api/oidc/oidc_integration_test.go | 68 +++++++++++++++- .../eventsourcing/eventstore/auth_request.go | 33 ++++++-- .../eventstore/auth_request_test.go | 56 +++++++++++-- .../eventsourcing/eventstore/user.go | 2 +- .../eventsourcing/handler/user_session.go | 3 + .../eventstore/token_verifier.go | 4 +- internal/domain/auth_request.go | 3 +- internal/domain/user.go | 27 ++++++- internal/query/user_auth_method.go | 81 +++++++++++-------- internal/query/user_auth_method_test.go | 60 +++++++------- .../repository/view/model/user_session.go | 24 +++--- .../view/model/user_session_test.go | 5 +- 15 files changed, 281 insertions(+), 104 deletions(-) diff --git a/console/src/app/services/authentication.service.ts b/console/src/app/services/authentication.service.ts index 314b9edb7e..3ee3024e40 100644 --- a/console/src/app/services/authentication.service.ts +++ b/console/src/app/services/authentication.service.ts @@ -35,6 +35,10 @@ export class AuthenticationService { return from(this.oauthService.loadUserProfile()); } + public getIdToken(): string { + return this.oauthService.getIdToken(); + } + public async authenticate(partialConfig?: Partial, force: boolean = false): Promise { if (partialConfig) { Object.assign(this.authConfig, partialConfig); diff --git a/console/src/app/services/grpc.service.ts b/console/src/app/services/grpc.service.ts index 8a87f95ef0..5c4c0fd510 100644 --- a/console/src/app/services/grpc.service.ts +++ b/console/src/app/services/grpc.service.ts @@ -18,6 +18,7 @@ import { I18nInterceptor } from './interceptors/i18n.interceptor'; import { OrgInterceptor } from './interceptors/org.interceptor'; import { StorageService } from './storage.service'; import { FeatureServiceClient } from '../proto/generated/zitadel/feature/v2beta/Feature_serviceServiceClientPb'; +import { GrpcAuthService } from './grpc-auth.service'; @Injectable({ providedIn: 'root', diff --git a/console/src/app/services/interceptors/auth.interceptor.ts b/console/src/app/services/interceptors/auth.interceptor.ts index d21bb5cdaa..4ccdc768c7 100644 --- a/console/src/app/services/interceptors/auth.interceptor.ts +++ b/console/src/app/services/interceptors/auth.interceptor.ts @@ -2,11 +2,13 @@ import { Injectable } from '@angular/core'; import { MatDialog } from '@angular/material/dialog'; import { Request, UnaryInterceptor, UnaryResponse } from 'grpc-web'; import { Subject } from 'rxjs'; -import { debounceTime, filter, first, take } from 'rxjs/operators'; +import { debounceTime, filter, first, map, take, tap } from 'rxjs/operators'; import { WarnDialogComponent } from 'src/app/modules/warn-dialog/warn-dialog.component'; import { AuthenticationService } from '../authentication.service'; import { StorageService } from '../storage.service'; +import { AuthConfig } from 'angular-oauth2-oidc'; +import { GrpcAuthService } from '../grpc-auth.service'; const authorizationKey = 'Authorization'; const bearerPrefix = 'Bearer'; @@ -44,7 +46,7 @@ export class AuthInterceptor implements UnaryIn return response; }) .catch(async (error: any) => { - if (error.code === 16) { + if (error.code === 16 || (error.code === 7 && error.message === 'mfa required (AUTHZ-Kl3p0)')) { this.triggerDialog.next(true); } return Promise.reject(error); @@ -67,7 +69,13 @@ export class AuthInterceptor implements UnaryIn .pipe(take(1)) .subscribe((resp) => { if (resp) { - this.authenticationService.authenticate(undefined, true); + const idToken = this.authenticationService.getIdToken(); + const configWithPrompt: Partial = { + customQueryParams: { + id_token_hint: idToken, + }, + }; + this.authenticationService.authenticate(configWithPrompt, true); } }); } diff --git a/internal/api/oidc/oidc_integration_test.go b/internal/api/oidc/oidc_integration_test.go index 09e76391bd..c7a101afd3 100644 --- a/internal/api/oidc/oidc_integration_test.go +++ b/internal/api/oidc/oidc_integration_test.go @@ -18,6 +18,7 @@ import ( "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/integration" "github.com/zitadel/zitadel/pkg/grpc/auth" + mgmt "github.com/zitadel/zitadel/pkg/grpc/management" oidc_pb "github.com/zitadel/zitadel/pkg/grpc/oidc/v2beta" session "github.com/zitadel/zitadel/pkg/grpc/session/v2beta" user "github.com/zitadel/zitadel/pkg/grpc/user/v2beta" @@ -26,6 +27,7 @@ import ( var ( CTX context.Context CTXLOGIN context.Context + CTXIAM context.Context Tester *integration.Tester User *user.AddHumanUserResponse ) @@ -50,6 +52,7 @@ func TestMain(m *testing.M) { Tester.SetUserPassword(CTX, User.GetUserId(), integration.UserPassword, false) Tester.RegisterUserPasskey(CTX, User.GetUserId()) CTXLOGIN = Tester.WithAuthorization(ctx, integration.Login) + CTXIAM = Tester.WithAuthorization(ctx, integration.IAMOwner) return m.Run() }()) } @@ -117,10 +120,13 @@ func Test_ZITADEL_API_missing_authentication(t *testing.T) { require.Nil(t, myUserResp) } -func Test_ZITADEL_API_missing_mfa(t *testing.T) { +func Test_ZITADEL_API_missing_mfa_2fa_setup(t *testing.T) { clientID, _ := createClient(t) + userResp := Tester.CreateHumanUser(CTX) + Tester.SetUserPassword(CTX, userResp.GetUserId(), integration.UserPassword, false) + Tester.RegisterUserU2F(CTX, userResp.GetUserId()) authRequestID := createAuthRequest(t, clientID, redirectURI, oidc.ScopeOpenID, zitadelAudienceScope) - sessionID, sessionToken, startTime, changeTime := Tester.CreatePasswordSession(t, CTX, User.GetUserId(), integration.UserPassword) + sessionID, sessionToken, startTime, changeTime := Tester.CreatePasswordSession(t, CTXLOGIN, userResp.GetUserId(), integration.UserPassword) linkResp, err := Tester.Client.OIDCv2.CreateCallback(CTXLOGIN, &oidc_pb.CreateCallbackRequest{ AuthRequestId: authRequestID, CallbackKind: &oidc_pb.CreateCallbackRequest_Session{ @@ -136,7 +142,7 @@ func Test_ZITADEL_API_missing_mfa(t *testing.T) { code := assertCodeResponse(t, linkResp.GetCallbackUrl()) tokens, err := exchangeTokens(t, clientID, code, redirectURI) require.NoError(t, err) - assertIDTokenClaims(t, tokens.IDTokenClaims, User.GetUserId(), armPassword, startTime, changeTime) + assertIDTokenClaims(t, tokens.IDTokenClaims, userResp.GetUserId(), armPassword, startTime, changeTime) ctx := metadata.AppendToOutgoingContext(context.Background(), "Authorization", fmt.Sprintf("%s %s", tokens.TokenType, tokens.AccessToken)) @@ -145,6 +151,62 @@ func Test_ZITADEL_API_missing_mfa(t *testing.T) { require.Nil(t, myUserResp) } +func Test_ZITADEL_API_missing_mfa_policy(t *testing.T) { + clientID, _ := createClient(t) + org := Tester.CreateOrganization(CTXIAM, fmt.Sprintf("ZITADEL_API_MISSING_MFA_%d", time.Now().UnixNano()), fmt.Sprintf("%d@mouse.com", time.Now().UnixNano())) + userID := org.CreatedAdmins[0].GetUserId() + Tester.SetUserPassword(CTXIAM, userID, integration.UserPassword, false) + authRequestID := createAuthRequest(t, clientID, redirectURI, oidc.ScopeOpenID, zitadelAudienceScope) + sessionID, sessionToken, startTime, changeTime := Tester.CreatePasswordSession(t, CTXLOGIN, userID, integration.UserPassword) + linkResp, err := Tester.Client.OIDCv2.CreateCallback(CTXLOGIN, &oidc_pb.CreateCallbackRequest{ + AuthRequestId: authRequestID, + CallbackKind: &oidc_pb.CreateCallbackRequest_Session{ + Session: &oidc_pb.Session{ + SessionId: sessionID, + SessionToken: sessionToken, + }, + }, + }) + require.NoError(t, err) + + // code exchange + code := assertCodeResponse(t, linkResp.GetCallbackUrl()) + tokens, err := exchangeTokens(t, clientID, code, redirectURI) + require.NoError(t, err) + assertIDTokenClaims(t, tokens.IDTokenClaims, userID, armPassword, startTime, changeTime) + + ctx := metadata.AppendToOutgoingContext(context.Background(), "Authorization", fmt.Sprintf("%s %s", tokens.TokenType, tokens.AccessToken)) + + // pre check if request would succeed + myUserResp, err := Tester.Client.Auth.GetMyUser(ctx, &auth.GetMyUserRequest{}) + require.NoError(t, err) + require.Equal(t, userID, myUserResp.GetUser().GetId()) + + // require MFA + ctxOrg := metadata.AppendToOutgoingContext(CTXIAM, "x-zitadel-orgid", org.GetOrganizationId()) + _, err = Tester.Client.Mgmt.AddCustomLoginPolicy(ctxOrg, &mgmt.AddCustomLoginPolicyRequest{ + ForceMfa: true, + }) + require.NoError(t, err) + + // make sure policy is projected + retryDuration := 5 * time.Second + if ctxDeadline, ok := CTX.Deadline(); ok { + retryDuration = time.Until(ctxDeadline) + } + require.EventuallyWithT(t, func(ttt *assert.CollectT) { + got, getErr := Tester.Client.Mgmt.GetLoginPolicy(ctxOrg, &mgmt.GetLoginPolicyRequest{}) + assert.NoError(ttt, getErr) + assert.False(ttt, got.GetPolicy().IsDefault) + + }, retryDuration, time.Millisecond*100, "timeout waiting for login policy") + + // now it must fail + myUserResp, err = Tester.Client.Auth.GetMyUser(ctx, &auth.GetMyUserRequest{}) + require.Error(t, err) + require.Nil(t, myUserResp) +} + func Test_ZITADEL_API_success(t *testing.T) { clientID, _ := createClient(t) authRequestID := createAuthRequest(t, clientID, redirectURI, oidc.ScopeOpenID, zitadelAudienceScope) diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request.go b/internal/auth/repository/eventsourcing/eventstore/auth_request.go index 9de07b742f..a5105d1f5b 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request.go @@ -2,6 +2,7 @@ package eventstore import ( "context" + "slices" "strings" "time" @@ -1030,15 +1031,11 @@ func (repo *AuthRequestRepo) nextSteps(ctx context.Context, request *domain.Auth if err != nil { return nil, err } - if (!isInternalLogin || len(idps.Links) > 0) && len(request.LinkingUsers) == 0 && !checkVerificationTimeMaxAge(userSession.ExternalLoginVerification, request.LoginPolicy.ExternalLoginCheckLifetime, request) { - selectedIDPConfigID := request.SelectedIDPConfigID - if selectedIDPConfigID == "" { - selectedIDPConfigID = userSession.SelectedIDPConfigID + if (!isInternalLogin || len(idps.Links) > 0) && len(request.LinkingUsers) == 0 { + step := repo.idpChecked(request, idps.Links, userSession) + if step != nil { + return append(steps, step), nil } - if selectedIDPConfigID == "" { - selectedIDPConfigID = idps.Links[0].IDPID - } - return append(steps, &domain.ExternalLoginStep{SelectedIDPConfigID: selectedIDPConfigID}), nil } if isInternalLogin || (!isInternalLogin && len(request.LinkingUsers) > 0) { step := repo.firstFactorChecked(request, user, userSession) @@ -1198,6 +1195,7 @@ func (repo *AuthRequestRepo) firstFactorChecked(request *domain.AuthRequest, use var step domain.NextStep if request.LoginPolicy.PasswordlessType != domain.PasswordlessTypeNotAllowed && user.IsPasswordlessReady() { if checkVerificationTimeMaxAge(userSession.PasswordlessVerification, request.LoginPolicy.MultiFactorCheckLifetime, request) { + request.MFAsVerified = append(request.MFAsVerified, domain.MFATypeU2FUserVerification) request.AuthTime = userSession.PasswordlessVerification return nil } @@ -1225,8 +1223,27 @@ func (repo *AuthRequestRepo) firstFactorChecked(request *domain.AuthRequest, use return &domain.PasswordStep{} } +func (repo *AuthRequestRepo) idpChecked(request *domain.AuthRequest, idps []*query.IDPUserLink, userSession *user_model.UserSessionView) domain.NextStep { + if checkVerificationTimeMaxAge(userSession.ExternalLoginVerification, request.LoginPolicy.ExternalLoginCheckLifetime, request) { + request.IDPLoginChecked = true + request.AuthTime = userSession.ExternalLoginVerification + return nil + } + selectedIDPConfigID := request.SelectedIDPConfigID + if selectedIDPConfigID == "" { + selectedIDPConfigID = userSession.SelectedIDPConfigID + } + if selectedIDPConfigID == "" && len(idps) > 0 { + selectedIDPConfigID = idps[0].IDPID + } + return &domain.ExternalLoginStep{SelectedIDPConfigID: selectedIDPConfigID} +} + func (repo *AuthRequestRepo) mfaChecked(userSession *user_model.UserSessionView, request *domain.AuthRequest, user *user_model.UserView, isInternalAuthentication bool) (domain.NextStep, bool, error) { mfaLevel := request.MFALevel() + if slices.Contains(request.MFAsVerified, domain.MFATypeU2FUserVerification) { + return nil, true, nil + } allowedProviders, required := user.MFATypesAllowed(mfaLevel, request.LoginPolicy, isInternalAuthentication) promptRequired := (user.MFAMaxSetUp < mfaLevel) || (len(allowedProviders) == 0 && required) if promptRequired || !repo.mfaSkippedOrSetUp(user, request) { diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go b/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go index 324039a765..35ce216877 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go @@ -89,7 +89,7 @@ func (m *mockViewUserSession) UserSessionsByAgentID(string, string) ([]*user_vie for i, user := range m.Users { sessions[i] = &user_view_model.UserSessionView{ ResourceOwner: user.ResourceOwner, - State: int32(user.SessionState), + State: sql.Null[domain.UserSessionState]{V: user.SessionState}, UserID: user.UserID, LoginName: sql.NullString{String: user.LoginName}, } @@ -1682,11 +1682,12 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { isInternal bool } tests := []struct { - name string - args args - want domain.NextStep - wantChecked bool - errFunc func(err error) bool + name string + args args + want domain.NextStep + wantChecked bool + errFunc func(err error) bool + wantMFAVerified []domain.MFAType }{ //{ // "required, prompt and false", //TODO: enable when LevelsOfAssurance is checked @@ -1718,6 +1719,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { nil, false, zerrors.IsPreconditionFailed, + nil, }, { "not set up, no mfas configured, no prompt and true", @@ -1737,6 +1739,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { nil, true, nil, + nil, }, { "not set up, prompt and false", @@ -1761,6 +1764,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { }, false, nil, + nil, }, { "not set up, forced by org, true", @@ -1787,6 +1791,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { }, false, nil, + nil, }, { "not set up and skipped, true", @@ -1807,6 +1812,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { nil, true, nil, + nil, }, { "checked second factor, true", @@ -1829,6 +1835,38 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { nil, true, nil, + []domain.MFAType{domain.MFATypeTOTP}, + }, + { + "checked passwordless, true", + args{ + request: &domain.AuthRequest{ + LoginPolicy: &domain.LoginPolicy{ + SecondFactors: []domain.SecondFactorType{domain.SecondFactorTypeTOTP}, + SecondFactorCheckLifetime: 18 * time.Hour, + MultiFactors: []domain.MultiFactorType{domain.MultiFactorTypeU2FWithPIN}, + MultiFactorCheckLifetime: 18 * time.Hour, + }, + MFAsVerified: []domain.MFAType{domain.MFATypeU2FUserVerification}, + }, + user: &user_model.UserView{ + HumanView: &user_model.HumanView{ + MFAMaxSetUp: domain.MFALevelMultiFactor, + PasswordlessTokens: []*user_model.WebAuthNView{ + { + TokenID: "tokenID", + State: user_model.MFAStateReady, + }, + }, + }, + }, + userSession: &user_model.UserSessionView{PasswordlessVerification: testNow.Add(-5 * time.Hour)}, + isInternal: true, + }, + nil, + true, + nil, + []domain.MFAType{domain.MFATypeU2FUserVerification}, }, { "not checked, check and false", @@ -1854,6 +1892,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { }, false, nil, + nil, }, { "external not checked or forced but set up, want step", @@ -1878,6 +1917,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { }, false, nil, + nil, }, { "external not forced but checked", @@ -1900,6 +1940,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { nil, true, nil, + []domain.MFAType{domain.MFATypeTOTP}, }, { "external not checked but required, want step", @@ -1927,6 +1968,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { }, false, nil, + nil, }, { "external not checked but local required", @@ -1950,6 +1992,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { nil, true, nil, + nil, }, } for _, tt := range tests { @@ -1964,6 +2007,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) { t.Errorf("mfaChecked() checked = %v, want %v", ok, tt.wantChecked) } assert.Equal(t, tt.want, got) + assert.ElementsMatch(t, tt.args.request.MFAsVerified, tt.wantMFAVerified) }) } } diff --git a/internal/auth/repository/eventsourcing/eventstore/user.go b/internal/auth/repository/eventsourcing/eventstore/user.go index 83f09be6ae..cfa573e7e3 100644 --- a/internal/auth/repository/eventsourcing/eventstore/user.go +++ b/internal/auth/repository/eventsourcing/eventstore/user.go @@ -32,7 +32,7 @@ func (repo *UserRepo) UserSessionUserIDsByAgentID(ctx context.Context, agentID s } userIDs := make([]string, 0, len(userSessions)) for _, session := range userSessions { - if session.State == int32(domain.UserSessionStateActive) { + if session.State.V == domain.UserSessionStateActive { userIDs = append(userIDs, session.UserID) } } diff --git a/internal/auth/repository/eventsourcing/handler/user_session.go b/internal/auth/repository/eventsourcing/handler/user_session.go index de97a2062e..3147b336f3 100644 --- a/internal/auth/repository/eventsourcing/handler/user_session.go +++ b/internal/auth/repository/eventsourcing/handler/user_session.go @@ -220,6 +220,7 @@ func (u *UserSession) Reduce(event eventstore.Event) (_ *handler.Statement, err user.HumanPasswordCheckFailedType: columns, err := sessionColumns(event, handler.NewCol(view_model.UserSessionKeyPasswordVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), ) if err != nil { return nil, err @@ -241,6 +242,7 @@ func (u *UserSession) Reduce(event eventstore.Event) (_ *handler.Statement, err user.HumanU2FTokenCheckFailedType: columns, err := sessionColumns(event, handler.NewCol(view_model.UserSessionKeySecondFactorVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), ) if err != nil { return nil, err @@ -317,6 +319,7 @@ func (u *UserSession) Reduce(event eventstore.Event) (_ *handler.Statement, err columns, err := sessionColumns(event, handler.NewCol(view_model.UserSessionKeyPasswordlessVerification, time.Time{}), handler.NewCol(view_model.UserSessionKeyMultiFactorVerification, time.Time{}), + handler.NewCol(view_model.UserSessionKeyState, domain.UserSessionStateActive), ) if err != nil { return nil, err diff --git a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go index c02e9cb329..603146f511 100644 --- a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go +++ b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go @@ -172,7 +172,7 @@ func (repo *TokenVerifierRepo) verifySessionToken(ctx context.Context, sessionID } // checkAuthentication ensures the session or token was authenticated (at least a single [domain.UserAuthMethodType]). -// It will also check if there was a multi factor authentication, if either MFA is forced by the login policy or if the user has set up any +// It will also check if there was a multi factor authentication, if either MFA is forced by the login policy or if the user has set up any second factor func (repo *TokenVerifierRepo) checkAuthentication(ctx context.Context, authMethods []domain.UserAuthMethodType, userID string) error { if len(authMethods) == 0 { return zerrors.ThrowPermissionDenied(nil, "AUTHZ-Kl3p0", "authentication required") @@ -191,7 +191,7 @@ func (repo *TokenVerifierRepo) checkAuthentication(ctx context.Context, authMeth requirements.ForceMFA, requirements.ForceMFALocalOnly, !hasIDPAuthentication(authMethods)) || - domain.HasMFA(requirements.AuthMethods) { + domain.Has2FA(requirements.AuthMethods) { return zerrors.ThrowPermissionDenied(nil, "AUTHZ-Kl3p0", "mfa required") } return nil diff --git a/internal/domain/auth_request.go b/internal/domain/auth_request.go index b7e463ff9a..1aaf2bb63d 100644 --- a/internal/domain/auth_request.go +++ b/internal/domain/auth_request.go @@ -1,6 +1,7 @@ package domain import ( + "slices" "strings" "time" @@ -81,7 +82,7 @@ func (a *AuthRequest) AuthMethods() []UserAuthMethodType { for _, mfa := range a.MFAsVerified { list = append(list, mfa.UserAuthMethodType()) } - return list + return slices.Compact(list) } type ExternalUser struct { diff --git a/internal/domain/user.go b/internal/domain/user.go index 3204d658da..da32e17490 100644 --- a/internal/domain/user.go +++ b/internal/domain/user.go @@ -62,7 +62,8 @@ func HasMFA(methods []UserAuthMethodType) bool { UserAuthMethodTypeOTPSMS, UserAuthMethodTypeOTPEmail, UserAuthMethodTypeIDP, - UserAuthMethodTypeOTP: + UserAuthMethodTypeOTP, + UserAuthMethodTypePrivateKey: factors++ case UserAuthMethodTypeUnspecified, userAuthMethodTypeCount: @@ -72,6 +73,30 @@ func HasMFA(methods []UserAuthMethodType) bool { return factors > 1 } +// Has2FA checks whether the auth factors provided are a second factor and will return true if at least one is. +func Has2FA(methods []UserAuthMethodType) bool { + var factors int + for _, method := range methods { + switch method { + case + UserAuthMethodTypeU2F, + UserAuthMethodTypeTOTP, + UserAuthMethodTypeOTPSMS, + UserAuthMethodTypeOTPEmail, + UserAuthMethodTypeOTP: + factors++ + case UserAuthMethodTypeUnspecified, + UserAuthMethodTypePassword, + UserAuthMethodTypePasswordless, + UserAuthMethodTypeIDP, + UserAuthMethodTypePrivateKey, + userAuthMethodTypeCount: + // ignore + } + } + return factors > 0 +} + // RequiresMFA checks whether the user requires to authenticate with multiple auth factors based on the LoginPolicy and the authentication type. // Internal authentication will require MFA if either option is activated. // External authentication will only require MFA if it's forced generally and not local only. diff --git a/internal/query/user_auth_method.go b/internal/query/user_auth_method.go index 3c24948d87..a350d75360 100644 --- a/internal/query/user_auth_method.go +++ b/internal/query/user_auth_method.go @@ -3,6 +3,7 @@ package query import ( "context" "database/sql" + "errors" "time" sq "github.com/Masterminds/squirrel" @@ -10,6 +11,7 @@ import ( "github.com/zitadel/zitadel/internal/api/authz" "github.com/zitadel/zitadel/internal/api/call" + "github.com/zitadel/zitadel/internal/database" "github.com/zitadel/zitadel/internal/domain" "github.com/zitadel/zitadel/internal/query/projection" "github.com/zitadel/zitadel/internal/telemetry/tracing" @@ -69,8 +71,12 @@ var ( authMethodTypeTable = userAuthMethodTable.setAlias("auth_method_types") authMethodTypeUserID = UserAuthMethodColumnUserID.setTable(authMethodTypeTable) authMethodTypeInstanceID = UserAuthMethodColumnInstanceID.setTable(authMethodTypeTable) - authMethodTypeTypes = UserAuthMethodColumnMethodType.setTable(authMethodTypeTable) - authMethodTypeState = UserAuthMethodColumnState.setTable(authMethodTypeTable) + authMethodTypeType = UserAuthMethodColumnMethodType.setTable(authMethodTypeTable) + authMethodTypeTypes = Column{ + name: "method_types", + table: authMethodTypeTable, + } + authMethodTypeState = UserAuthMethodColumnState.setTable(authMethodTypeTable) userIDPsCountTable = idpUserLinkTable.setAlias("user_idps_count") userIDPsCountUserID = IDPUserLinkUserIDCol.setTable(userIDPsCountTable) @@ -199,8 +205,8 @@ func (q *Queries) ListUserAuthMethodTypesRequired(ctx context.Context, userID st return nil, zerrors.ThrowInvalidArgument(err, "QUERY-E5ut4", "Errors.Query.InvalidRequest") } - err = q.client.QueryContext(ctx, func(rows *sql.Rows) error { - requirements, err = scan(rows) + err = q.client.QueryRowContext(ctx, func(row *sql.Row) error { + requirements, err = scan(row) return err }, stmt, args...) if err != nil { @@ -360,7 +366,7 @@ func prepareActiveUserAuthMethodTypesQuery(ctx context.Context, db prepareDataba } return sq.Select( NotifyPasswordSetCol.identifier(), - authMethodTypeTypes.identifier(), + authMethodTypeType.identifier(), userIDPsCountCount.identifier()). From(userTable.identifier()). LeftJoin(join(NotifyUserIDCol, UserIDCol)). @@ -411,12 +417,12 @@ func prepareActiveUserAuthMethodTypesQuery(ctx context.Context, db prepareDataba } } -func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { +func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Row) (*UserAuthMethodRequirements, error)) { loginPolicyQuery, err := prepareAuthMethodsForceMFAQuery() if err != nil { return sq.SelectBuilder{}, nil } - authMethodsQuery, authMethodsArgs, err := prepareAuthMethodQuery() + authMethodsQuery, authMethodsArgs, err := prepareAggAuthMethodsQuery() if err != nil { return sq.SelectBuilder{}, nil } @@ -442,47 +448,41 @@ func prepareUserAuthMethodTypesRequiredQuery(ctx context.Context, db prepareData userIDPsCountInstanceID.identifier() + " = " + UserInstanceIDCol.identifier()). LeftJoin("(" + loginPolicyQuery + ") AS " + forceMFATable.alias + " ON " + "(" + forceMFAOrgID.identifier() + " = " + UserInstanceIDCol.identifier() + " OR " + forceMFAOrgID.identifier() + " = " + UserResourceOwnerCol.identifier() + ") AND " + - forceMFAInstanceID.identifier() + " = " + UserInstanceIDCol.identifier() + db.Timetravel(call.Took(ctx))). + forceMFAInstanceID.identifier() + " = " + UserInstanceIDCol.identifier()). + OrderBy(forceMFAIsDefault.identifier()). + Limit(1). PlaceholderFormat(sq.Dollar), - func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { - userAuthMethodTypes := make([]domain.UserAuthMethodType, 0) + func(row *sql.Row) (*UserAuthMethodRequirements, error) { var passwordSet sql.NullBool + var authMethodTypes database.NumberArray[domain.UserAuthMethodType] var idp sql.NullInt64 var userType sql.NullInt32 var forceMFA sql.NullBool var forceMFALocalOnly sql.NullBool - for rows.Next() { - var authMethodType sql.NullInt16 - err := rows.Scan( - &passwordSet, - &authMethodType, - &idp, - &userType, - &forceMFA, - &forceMFALocalOnly, - ) - if err != nil { - return nil, err - } - if authMethodType.Valid { - userAuthMethodTypes = append(userAuthMethodTypes, domain.UserAuthMethodType(authMethodType.Int16)) + err := row.Scan( + &passwordSet, + &authMethodTypes, + &idp, + &userType, + &forceMFA, + &forceMFALocalOnly, + ) + if err != nil { + if errors.Is(err, sql.ErrNoRows) { + return nil, zerrors.ThrowNotFound(err, "QUERY-SF3h2", "Errors.Internal") } + return nil, zerrors.ThrowInternal(err, "QUERY-Sf3rt", "Errors.Internal") } if passwordSet.Valid && passwordSet.Bool { - userAuthMethodTypes = append(userAuthMethodTypes, domain.UserAuthMethodTypePassword) + authMethodTypes = append(authMethodTypes, domain.UserAuthMethodTypePassword) } if idp.Valid && idp.Int64 > 0 { - logging.Error("IDP", idp.Int64) - userAuthMethodTypes = append(userAuthMethodTypes, domain.UserAuthMethodTypeIDP) - } - - if err := rows.Close(); err != nil { - return nil, zerrors.ThrowInternal(err, "QUERY-W4zje", "Errors.Query.CloseRows") + authMethodTypes = append(authMethodTypes, domain.UserAuthMethodTypeIDP) } return &UserAuthMethodRequirements{ UserType: domain.UserType(userType.Int32), - AuthMethods: userAuthMethodTypes, + AuthMethods: authMethodTypes, ForceMFA: forceMFA.Bool, ForceMFALocalOnly: forceMFALocalOnly.Bool, }, nil @@ -505,7 +505,7 @@ func prepareAuthMethodsIDPsQuery() (string, error) { func prepareAuthMethodQuery() (string, []interface{}, error) { return sq.Select( - "DISTINCT("+authMethodTypeTypes.identifier()+")", + "DISTINCT("+authMethodTypeType.identifier()+")", authMethodTypeUserID.identifier(), authMethodTypeInstanceID.identifier()). From(authMethodTypeTable.identifier()). @@ -513,15 +513,26 @@ func prepareAuthMethodQuery() (string, []interface{}, error) { ToSql() } +func prepareAggAuthMethodsQuery() (string, []interface{}, error) { + return sq.Select( + "array_agg(DISTINCT("+authMethodTypeType.identifier()+")) as method_types", + authMethodTypeUserID.identifier(), + authMethodTypeInstanceID.identifier()). + From(authMethodTypeTable.identifier()). + Where(sq.Eq{authMethodTypeState.identifier(): domain.MFAStateReady}). + GroupBy(authMethodTypeInstanceID.identifier(), authMethodTypeUserID.identifier()). + ToSql() +} + func prepareAuthMethodsForceMFAQuery() (string, error) { loginPolicyQuery, _, err := sq.Select( forceMFAForce.identifier(), forceMFAForceLocalOnly.identifier(), forceMFAInstanceID.identifier(), forceMFAOrgID.identifier(), + forceMFAIsDefault.identifier(), ). From(forceMFATable.identifier()). - OrderBy(forceMFAIsDefault.identifier()). ToSql() return loginPolicyQuery, err } diff --git a/internal/query/user_auth_method_test.go b/internal/query/user_auth_method_test.go index 578b14cec5..698667d990 100644 --- a/internal/query/user_auth_method_test.go +++ b/internal/query/user_auth_method_test.go @@ -11,7 +11,9 @@ import ( sq "github.com/Masterminds/squirrel" + "github.com/zitadel/zitadel/internal/database" "github.com/zitadel/zitadel/internal/domain" + "github.com/zitadel/zitadel/internal/zerrors" ) var ( @@ -57,27 +59,27 @@ var ( "idps_count", } prepareAuthMethodTypesRequiredStmt = `SELECT projections.users12_notifications.password_set,` + - ` auth_method_types.method_type,` + + ` auth_method_types.method_types,` + ` user_idps_count.count,` + ` projections.users12.type,` + ` auth_methods_force_mfa.force_mfa,` + ` auth_methods_force_mfa.force_mfa_local_only` + ` FROM projections.users12` + ` LEFT JOIN projections.users12_notifications ON projections.users12.id = projections.users12_notifications.user_id AND projections.users12.instance_id = projections.users12_notifications.instance_id` + - ` LEFT JOIN (SELECT DISTINCT(auth_method_types.method_type), auth_method_types.user_id, auth_method_types.instance_id FROM projections.user_auth_methods4 AS auth_method_types` + - ` WHERE auth_method_types.state = $1) AS auth_method_types` + + ` LEFT JOIN (SELECT array_agg(DISTINCT(auth_method_types.method_type)) as method_types, auth_method_types.user_id, auth_method_types.instance_id FROM projections.user_auth_methods4 AS auth_method_types` + + ` WHERE auth_method_types.state = $1 GROUP BY auth_method_types.instance_id, auth_method_types.user_id) AS auth_method_types` + ` ON auth_method_types.user_id = projections.users12.id AND auth_method_types.instance_id = projections.users12.instance_id` + ` LEFT JOIN (SELECT user_idps_count.user_id, user_idps_count.instance_id, COUNT(user_idps_count.user_id) AS count FROM projections.idp_user_links3 AS user_idps_count` + ` GROUP BY user_idps_count.user_id, user_idps_count.instance_id) AS user_idps_count` + ` ON user_idps_count.user_id = projections.users12.id AND user_idps_count.instance_id = projections.users12.instance_id` + - ` LEFT JOIN (SELECT auth_methods_force_mfa.force_mfa, auth_methods_force_mfa.force_mfa_local_only, auth_methods_force_mfa.instance_id, auth_methods_force_mfa.aggregate_id FROM projections.login_policies5 AS auth_methods_force_mfa ORDER BY auth_methods_force_mfa.is_default) AS auth_methods_force_mfa` + + ` LEFT JOIN (SELECT auth_methods_force_mfa.force_mfa, auth_methods_force_mfa.force_mfa_local_only, auth_methods_force_mfa.instance_id, auth_methods_force_mfa.aggregate_id, auth_methods_force_mfa.is_default FROM projections.login_policies5 AS auth_methods_force_mfa) AS auth_methods_force_mfa` + ` ON (auth_methods_force_mfa.aggregate_id = projections.users12.instance_id OR auth_methods_force_mfa.aggregate_id = projections.users12.resource_owner) AND auth_methods_force_mfa.instance_id = projections.users12.instance_id` + - ` AS OF SYSTEM TIME '-1 ms + ` ORDER BY auth_methods_force_mfa.is_default LIMIT 1 ` prepareAuthMethodTypesRequiredCols = []string{ "password_set", "type", - "method_type", + "method_types", "idps_count", "force_mfa", "force_mfa_local_only", @@ -319,27 +321,33 @@ func Test_UserAuthMethodPrepares(t *testing.T) { }, { name: "prepareUserAuthMethodTypesRequiredQuery no result", - prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { + prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Row) (*UserAuthMethodRequirements, error)) { builder, scan := prepareUserAuthMethodTypesRequiredQuery(ctx, db) - return builder, func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { - return scan(rows) + return builder, func(row *sql.Row) (*UserAuthMethodRequirements, error) { + return scan(row) } }, want: want{ - sqlExpectations: mockQueries( + sqlExpectations: mockQueriesScanErr( regexp.QuoteMeta(prepareAuthMethodTypesRequiredStmt), nil, nil, ), + err: func(err error) (error, bool) { + if !zerrors.IsNotFound(err) { + return fmt.Errorf("err should be zitadel.NotFoundError got: %w", err), false + } + return nil, true + }, }, - object: &UserAuthMethodRequirements{AuthMethods: []domain.UserAuthMethodType{}, ForceMFA: false}, + object: (*UserAuthMethodRequirements)(nil), }, { name: "prepareUserAuthMethodTypesRequiredQuery one second factor", - prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { + prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Row) (*UserAuthMethodRequirements, error)) { builder, scan := prepareUserAuthMethodTypesRequiredQuery(ctx, db) - return builder, func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { - return scan(rows) + return builder, func(row *sql.Row) (*UserAuthMethodRequirements, error) { + return scan(row) } }, want: want{ @@ -349,7 +357,7 @@ func Test_UserAuthMethodPrepares(t *testing.T) { [][]driver.Value{ { true, - domain.UserAuthMethodTypePasswordless, + database.NumberArray[domain.UserAuthMethodType]{domain.UserAuthMethodTypePasswordless}, 1, domain.UserTypeHuman, true, @@ -371,10 +379,10 @@ func Test_UserAuthMethodPrepares(t *testing.T) { }, { name: "prepareUserAuthMethodTypesRequiredQuery multiple second factors", - prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { + prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Row) (*UserAuthMethodRequirements, error)) { builder, scan := prepareUserAuthMethodTypesRequiredQuery(ctx, db) - return builder, func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { - return scan(rows) + return builder, func(row *sql.Row) (*UserAuthMethodRequirements, error) { + return scan(row) } }, want: want{ @@ -384,15 +392,7 @@ func Test_UserAuthMethodPrepares(t *testing.T) { [][]driver.Value{ { true, - domain.UserAuthMethodTypePasswordless, - 1, - domain.UserTypeHuman, - true, - true, - }, - { - true, - domain.UserAuthMethodTypeTOTP, + database.NumberArray[domain.UserAuthMethodType]{domain.UserAuthMethodTypePasswordless, domain.UserAuthMethodTypeTOTP}, 1, domain.UserTypeHuman, true, @@ -416,10 +416,10 @@ func Test_UserAuthMethodPrepares(t *testing.T) { }, { name: "prepareUserAuthMethodTypesRequiredQuery sql err", - prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*UserAuthMethodRequirements, error)) { + prepare: func(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Row) (*UserAuthMethodRequirements, error)) { builder, scan := prepareUserAuthMethodTypesRequiredQuery(ctx, db) - return builder, func(rows *sql.Rows) (*UserAuthMethodRequirements, error) { - return scan(rows) + return builder, func(row *sql.Row) (*UserAuthMethodRequirements, error) { + return scan(row) } }, want: want{ diff --git a/internal/user/repository/view/model/user_session.go b/internal/user/repository/view/model/user_session.go index 4208ea5b53..d761592551 100644 --- a/internal/user/repository/view/model/user_session.go +++ b/internal/user/repository/view/model/user_session.go @@ -35,12 +35,12 @@ const ( ) type UserSessionView struct { - CreationDate time.Time `json:"-" gorm:"column:creation_date"` - ChangeDate time.Time `json:"-" gorm:"column:change_date"` - ResourceOwner string `json:"-" gorm:"column:resource_owner"` - State int32 `json:"-" gorm:"column:state"` - UserAgentID string `json:"userAgentID" gorm:"column:user_agent_id;primary_key"` - UserID string `json:"userID" gorm:"column:user_id;primary_key"` + CreationDate time.Time `json:"-" gorm:"column:creation_date"` + ChangeDate time.Time `json:"-" gorm:"column:change_date"` + ResourceOwner string `json:"-" gorm:"column:resource_owner"` + State sql.Null[domain.UserSessionState] `json:"-" gorm:"column:state"` + UserAgentID string `json:"userAgentID" gorm:"column:user_agent_id;primary_key"` + UserID string `json:"userID" gorm:"column:user_id;primary_key"` // As of https://github.com/zitadel/zitadel/pull/7199 the following 4 attributes // are not projected in the user session handler anymore // and are therefore annotated with a `gorm:"-"`. @@ -79,7 +79,7 @@ func UserSessionToModel(userSession *UserSessionView) *model.UserSessionView { ChangeDate: userSession.ChangeDate, CreationDate: userSession.CreationDate, ResourceOwner: userSession.ResourceOwner, - State: domain.UserSessionState(userSession.State), + State: userSession.State.V, UserAgentID: userSession.UserAgentID, UserID: userSession.UserID, UserName: userSession.UserName.String, @@ -114,7 +114,7 @@ func (v *UserSessionView) AppendEvent(event eventstore.Event) error { case user.UserV1PasswordCheckSucceededType, user.HumanPasswordCheckSucceededType: v.PasswordVerification = sql.NullTime{Time: event.CreatedAt(), Valid: true} - v.State = int32(domain.UserSessionStateActive) + v.State.V = domain.UserSessionStateActive case user.UserIDPLoginCheckSucceededType: data := new(es_model.AuthRequest) err := data.SetData(event) @@ -123,12 +123,12 @@ func (v *UserSessionView) AppendEvent(event eventstore.Event) error { } v.ExternalLoginVerification = sql.NullTime{Time: event.CreatedAt(), Valid: true} v.SelectedIDPConfigID = sql.NullString{String: data.SelectedIDPConfigID, Valid: true} - v.State = int32(domain.UserSessionStateActive) + v.State.V = domain.UserSessionStateActive case user.HumanPasswordlessTokenCheckSucceededType: v.PasswordlessVerification = sql.NullTime{Time: event.CreatedAt(), Valid: true} v.MultiFactorVerification = sql.NullTime{Time: event.CreatedAt(), Valid: true} v.MultiFactorVerificationType = sql.NullInt32{Int32: int32(domain.MFATypeU2FUserVerification)} - v.State = int32(domain.UserSessionStateActive) + v.State.V = domain.UserSessionStateActive case user.HumanPasswordlessTokenCheckFailedType, user.HumanPasswordlessTokenRemovedType: v.PasswordlessVerification = sql.NullTime{Time: time.Time{}, Valid: true} @@ -207,7 +207,7 @@ func (v *UserSessionView) AppendEvent(event eventstore.Event) error { v.MultiFactorVerification = sql.NullTime{Time: time.Time{}, Valid: true} v.MultiFactorVerificationType = sql.NullInt32{Int32: int32(domain.MFALevelNotSetUp)} v.ExternalLoginVerification = sql.NullTime{Time: time.Time{}, Valid: true} - v.State = int32(domain.UserSessionStateTerminated) + v.State.V = domain.UserSessionStateTerminated case user.UserIDPLinkRemovedType, user.UserIDPLinkCascadeRemovedType: v.ExternalLoginVerification = sql.NullTime{Time: time.Time{}, Valid: true} v.SelectedIDPConfigID = sql.NullString{String: "", Valid: true} @@ -218,7 +218,7 @@ func (v *UserSessionView) AppendEvent(event eventstore.Event) error { func (v *UserSessionView) setSecondFactorVerification(verificationTime time.Time, mfaType domain.MFAType) { v.SecondFactorVerification = sql.NullTime{Time: verificationTime, Valid: true} v.SecondFactorVerificationType = sql.NullInt32{Int32: int32(mfaType)} - v.State = int32(domain.UserSessionStateActive) + v.State.V = domain.UserSessionStateActive } func (v *UserSessionView) EventTypes() []eventstore.EventType { diff --git a/internal/user/repository/view/model/user_session_test.go b/internal/user/repository/view/model/user_session_test.go index 25acd489c7..3e832ae1fd 100644 --- a/internal/user/repository/view/model/user_session_test.go +++ b/internal/user/repository/view/model/user_session_test.go @@ -9,6 +9,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/zitadel/zitadel/internal/crypto" + "github.com/zitadel/zitadel/internal/domain" es_models "github.com/zitadel/zitadel/internal/eventstore/v1/models" "github.com/zitadel/zitadel/internal/repository/user" es_model "github.com/zitadel/zitadel/internal/user/repository/eventsourcing/model" @@ -209,7 +210,7 @@ func TestAppendEvent(t *testing.T) { ExternalLoginVerification: sql.NullTime{Time: time.Time{}, Valid: true}, PasswordlessVerification: sql.NullTime{Time: time.Time{}, Valid: true}, MultiFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}, - State: 1, + State: sql.Null[domain.UserSessionState]{V: domain.UserSessionStateTerminated}, }, }, { @@ -228,7 +229,7 @@ func TestAppendEvent(t *testing.T) { ExternalLoginVerification: sql.NullTime{Time: time.Time{}, Valid: true}, PasswordlessVerification: sql.NullTime{Time: time.Time{}, Valid: true}, MultiFactorVerification: sql.NullTime{Time: time.Time{}, Valid: true}, - State: 1, + State: sql.Null[domain.UserSessionState]{V: domain.UserSessionStateTerminated}, }, }, }