TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2024-12-04 23:45:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(webkeys): remove include private key from projection index (#8436)

Browse Source 
# Which Problems Are Solved

When Web keys with a large RSA Bitsize were generated, the new web key
did not get projected.
Zitadel logs printed the following errors:

```
time="2024-08-15T09:18:47Z" level=debug msg="execution of statements failed" caller="/home/tim/Repositories/zitadel/zitadel/internal/eventstore/handler/v2/handler.go:518" error="statement failed: ID=CRDB-pKtsr Message=exec failed Parent=(ERROR: index row size 3400 exceeds btree version 4 maximum 2704 for index \"web_keys_web_key_state_idx\" (SQLSTATE 54000))" lastProcessedIndex=-1 projection=projections.web_keys
```


# How the Problems Are Solved

Remove the the `WithInclude` option with the Private key from the
`web_keys` projection index and bump the projection version.

# Additional Changes

- Correct RPC summaries for documentation
- Fix docs slug in sidebar.js

# Additional Context

- Found during release review.
This commit is contained in:
Tim Möhlmann 2024-08-16 14:41:09 +03:00 committed by GitHub
parent 83c78a470c
commit ab4daa0ebb
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 9 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/sidebars.js
View File

@ -761,8 +761,8 @@ module.exports = {
label: "Web key Lifecycle (Preview)",
link: {
type: "generated-index",
title: "Action Service API (Preview)",
slug: "/apis/resources/action_service_v3",
title: "Web Key Service API (Preview)",
slug: "/apis/resources/webkey_service_v3",
description:
"This API is intended to manage web keys for a ZITADEL instance, used to sign and validate OIDC tokens.\n" +
"\n" +

5
internal/query/projection/web_key.go
View File

@ -13,7 +13,7 @@ import (
)
const (
WebKeyTable = "projections.web_keys"
WebKeyTable = "projections.web_keys1"
WebKeyInstanceIDCol = "instance_id"
WebKeyKeyIDCol = "key_id"
@ -58,9 +58,6 @@ func (*webKeyProjection) Init() *old_handler.Check {
handler.WithIndex(handler.NewIndex(
"web_key_state",
[]string{WebKeyInstanceIDCol, WebKeyStateCol},
handler.WithInclude(
WebKeyPrivateKeyCol,
),
)),
),
)

2
internal/query/web_key_by_state.sql
View File

@ -1,5 +1,5 @@
select private_key
from projections.web_keys
from projections.web_keys1
where instance_id = $1
and state = $2
limit 1;

2
internal/query/web_key_list.sql
View File

@ -1,4 +1,4 @@
select key_id, creation_date, change_date, sequence, state, config, config_type
from projections.web_keys
from projections.web_keys1
where instance_id = $1
order by creation_date asc;

2
internal/query/web_key_public_keys.sql
View File

@ -1,3 +1,3 @@
select public_key
from projections.web_keys
from projections.web_keys1
where instance_id = $1;

6
proto/zitadel/resources/webkey/v3alpha/webkey_service.proto
View File

@ -172,8 +172,8 @@ service ZITADELWebKeys {
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
summary: "Generate a web key pair for the instance";
description: "Delete a web key. Only inactive keys can be deleted. Once a key is deleted, any tokens signed by this key will be invalid."
summary: "Delete a web key pair for the instance";
description: "Delete a web key pair. Only inactive keys can be deleted. Once a key is deleted, any tokens signed by this key will be invalid."
responses: {
key: "200"
value: {
@ -198,7 +198,7 @@ service ZITADELWebKeys {
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
summary: "Generate a web key pair for the instance";
summary: "List web key details for the instance";
description: "List web key details for the instance"
responses: {
key: "200"