mirror of
https://github.com/zitadel/zitadel.git
synced 2025-08-11 20:57:31 +00:00
perf(oidc): optimize the introspection endpoint (#6909)
* get key by id and cache them
* userinfo from events for v2 tokens
* improve keyset caching
* concurrent token and client checks
* client and project in single query
* logging and otel
* drop owner_removed column on apps and authN tables
* userinfo and project roles in go routines
* get oidc user info from projections and add actions
* add avatar URL
* some cleanup
* pull oidc work branch
* remove storage from server
* add config flag for experimental introspection
* legacy introspection flag
* drop owner_removed column on user projections
* drop owner_removed column on useer_metadata
* query userinfo unit test
* query introspection client test
* add user_grants to the userinfo query
* handle PAT scopes
* bring triggers back
* test instance keys query
* add userinfo unit tests
* unit test keys
* go mod tidy
* solve some bugs
* fix missing preferred login name
* do not run triggers in go routines, they seem to deadlock
* initialize the trigger handlers late with a sync.OnceValue
* Revert "do not run triggers in go routines, they seem to deadlock"
This reverts commit 2a03da2127.
* add missing translations
* chore: update go version for linting
* pin oidc version
* parse a global time location for query test
* fix linter complains
* upgrade go lint
* fix more linting issues
---------
Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
This commit is contained in:
Tim Möhlmann
@@ -22,43 +22,43 @@ var (
|
||||
preferredLoginNameQuery = `SELECT preferred_login_name.user_id, preferred_login_name.login_name, preferred_login_name.instance_id` +
|
||||
` FROM projections.login_names3 AS preferred_login_name` +
|
||||
` WHERE preferred_login_name.is_primary = $1`
|
||||
userQuery = `SELECT projections.users8.id,` +
|
||||
` projections.users8.creation_date,` +
|
||||
` projections.users8.change_date,` +
|
||||
` projections.users8.resource_owner,` +
|
||||
` projections.users8.sequence,` +
|
||||
` projections.users8.state,` +
|
||||
` projections.users8.type,` +
|
||||
` projections.users8.username,` +
|
||||
userQuery = `SELECT projections.users9.id,` +
|
||||
` projections.users9.creation_date,` +
|
||||
` projections.users9.change_date,` +
|
||||
` projections.users9.resource_owner,` +
|
||||
` projections.users9.sequence,` +
|
||||
` projections.users9.state,` +
|
||||
` projections.users9.type,` +
|
||||
` projections.users9.username,` +
|
||||
` login_names.loginnames,` +
|
||||
` preferred_login_name.login_name,` +
|
||||
` projections.users8_humans.user_id,` +
|
||||
` projections.users8_humans.first_name,` +
|
||||
` projections.users8_humans.last_name,` +
|
||||
` projections.users8_humans.nick_name,` +
|
||||
` projections.users8_humans.display_name,` +
|
||||
` projections.users8_humans.preferred_language,` +
|
||||
` projections.users8_humans.gender,` +
|
||||
` projections.users8_humans.avatar_key,` +
|
||||
` projections.users8_humans.email,` +
|
||||
` projections.users8_humans.is_email_verified,` +
|
||||
` projections.users8_humans.phone,` +
|
||||
` projections.users8_humans.is_phone_verified,` +
|
||||
` projections.users8_machines.user_id,` +
|
||||
` projections.users8_machines.name,` +
|
||||
` projections.users8_machines.description,` +
|
||||
` projections.users8_machines.has_secret,` +
|
||||
` projections.users8_machines.access_token_type,` +
|
||||
` projections.users9_humans.user_id,` +
|
||||
` projections.users9_humans.first_name,` +
|
||||
` projections.users9_humans.last_name,` +
|
||||
` projections.users9_humans.nick_name,` +
|
||||
` projections.users9_humans.display_name,` +
|
||||
` projections.users9_humans.preferred_language,` +
|
||||
` projections.users9_humans.gender,` +
|
||||
` projections.users9_humans.avatar_key,` +
|
||||
` projections.users9_humans.email,` +
|
||||
` projections.users9_humans.is_email_verified,` +
|
||||
` projections.users9_humans.phone,` +
|
||||
` projections.users9_humans.is_phone_verified,` +
|
||||
` projections.users9_machines.user_id,` +
|
||||
` projections.users9_machines.name,` +
|
||||
` projections.users9_machines.description,` +
|
||||
` projections.users9_machines.has_secret,` +
|
||||
` projections.users9_machines.access_token_type,` +
|
||||
` COUNT(*) OVER ()` +
|
||||
` FROM projections.users8` +
|
||||
` LEFT JOIN projections.users8_humans ON projections.users8.id = projections.users8_humans.user_id AND projections.users8.instance_id = projections.users8_humans.instance_id` +
|
||||
` LEFT JOIN projections.users8_machines ON projections.users8.id = projections.users8_machines.user_id AND projections.users8.instance_id = projections.users8_machines.instance_id` +
|
||||
` FROM projections.users9` +
|
||||
` LEFT JOIN projections.users9_humans ON projections.users9.id = projections.users9_humans.user_id AND projections.users9.instance_id = projections.users9_humans.instance_id` +
|
||||
` LEFT JOIN projections.users9_machines ON projections.users9.id = projections.users9_machines.user_id AND projections.users9.instance_id = projections.users9_machines.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + loginNamesQuery + `) AS login_names` +
|
||||
` ON login_names.user_id = projections.users8.id AND login_names.instance_id = projections.users8.instance_id` +
|
||||
` ON login_names.user_id = projections.users9.id AND login_names.instance_id = projections.users9.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + preferredLoginNameQuery + `) AS preferred_login_name` +
|
||||
` ON preferred_login_name.user_id = projections.users8.id AND preferred_login_name.instance_id = projections.users8.instance_id` +
|
||||
` ON preferred_login_name.user_id = projections.users9.id AND preferred_login_name.instance_id = projections.users9.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
userCols = []string{
|
||||
"id",
|
||||
@@ -92,21 +92,21 @@ var (
|
||||
"access_token_type",
|
||||
"count",
|
||||
}
|
||||
profileQuery = `SELECT projections.users8.id,` +
|
||||
` projections.users8.creation_date,` +
|
||||
` projections.users8.change_date,` +
|
||||
` projections.users8.resource_owner,` +
|
||||
` projections.users8.sequence,` +
|
||||
` projections.users8_humans.user_id,` +
|
||||
` projections.users8_humans.first_name,` +
|
||||
` projections.users8_humans.last_name,` +
|
||||
` projections.users8_humans.nick_name,` +
|
||||
` projections.users8_humans.display_name,` +
|
||||
` projections.users8_humans.preferred_language,` +
|
||||
` projections.users8_humans.gender,` +
|
||||
` projections.users8_humans.avatar_key` +
|
||||
` FROM projections.users8` +
|
||||
` LEFT JOIN projections.users8_humans ON projections.users8.id = projections.users8_humans.user_id AND projections.users8.instance_id = projections.users8_humans.instance_id` +
|
||||
profileQuery = `SELECT projections.users9.id,` +
|
||||
` projections.users9.creation_date,` +
|
||||
` projections.users9.change_date,` +
|
||||
` projections.users9.resource_owner,` +
|
||||
` projections.users9.sequence,` +
|
||||
` projections.users9_humans.user_id,` +
|
||||
` projections.users9_humans.first_name,` +
|
||||
` projections.users9_humans.last_name,` +
|
||||
` projections.users9_humans.nick_name,` +
|
||||
` projections.users9_humans.display_name,` +
|
||||
` projections.users9_humans.preferred_language,` +
|
||||
` projections.users9_humans.gender,` +
|
||||
` projections.users9_humans.avatar_key` +
|
||||
` FROM projections.users9` +
|
||||
` LEFT JOIN projections.users9_humans ON projections.users9.id = projections.users9_humans.user_id AND projections.users9.instance_id = projections.users9_humans.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
profileCols = []string{
|
||||
"id",
|
||||
@@ -123,16 +123,16 @@ var (
|
||||
"gender",
|
||||
"avatar_key",
|
||||
}
|
||||
emailQuery = `SELECT projections.users8.id,` +
|
||||
` projections.users8.creation_date,` +
|
||||
` projections.users8.change_date,` +
|
||||
` projections.users8.resource_owner,` +
|
||||
` projections.users8.sequence,` +
|
||||
` projections.users8_humans.user_id,` +
|
||||
` projections.users8_humans.email,` +
|
||||
` projections.users8_humans.is_email_verified` +
|
||||
` FROM projections.users8` +
|
||||
` LEFT JOIN projections.users8_humans ON projections.users8.id = projections.users8_humans.user_id AND projections.users8.instance_id = projections.users8_humans.instance_id` +
|
||||
emailQuery = `SELECT projections.users9.id,` +
|
||||
` projections.users9.creation_date,` +
|
||||
` projections.users9.change_date,` +
|
||||
` projections.users9.resource_owner,` +
|
||||
` projections.users9.sequence,` +
|
||||
` projections.users9_humans.user_id,` +
|
||||
` projections.users9_humans.email,` +
|
||||
` projections.users9_humans.is_email_verified` +
|
||||
` FROM projections.users9` +
|
||||
` LEFT JOIN projections.users9_humans ON projections.users9.id = projections.users9_humans.user_id AND projections.users9.instance_id = projections.users9_humans.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
emailCols = []string{
|
||||
"id",
|
||||
@@ -144,16 +144,16 @@ var (
|
||||
"email",
|
||||
"is_email_verified",
|
||||
}
|
||||
phoneQuery = `SELECT projections.users8.id,` +
|
||||
` projections.users8.creation_date,` +
|
||||
` projections.users8.change_date,` +
|
||||
` projections.users8.resource_owner,` +
|
||||
` projections.users8.sequence,` +
|
||||
` projections.users8_humans.user_id,` +
|
||||
` projections.users8_humans.phone,` +
|
||||
` projections.users8_humans.is_phone_verified` +
|
||||
` FROM projections.users8` +
|
||||
` LEFT JOIN projections.users8_humans ON projections.users8.id = projections.users8_humans.user_id AND projections.users8.instance_id = projections.users8_humans.instance_id` +
|
||||
phoneQuery = `SELECT projections.users9.id,` +
|
||||
` projections.users9.creation_date,` +
|
||||
` projections.users9.change_date,` +
|
||||
` projections.users9.resource_owner,` +
|
||||
` projections.users9.sequence,` +
|
||||
` projections.users9_humans.user_id,` +
|
||||
` projections.users9_humans.phone,` +
|
||||
` projections.users9_humans.is_phone_verified` +
|
||||
` FROM projections.users9` +
|
||||
` LEFT JOIN projections.users9_humans ON projections.users9.id = projections.users9_humans.user_id AND projections.users9.instance_id = projections.users9_humans.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
phoneCols = []string{
|
||||
"id",
|
||||
@@ -165,14 +165,14 @@ var (
|
||||
"phone",
|
||||
"is_phone_verified",
|
||||
}
|
||||
userUniqueQuery = `SELECT projections.users8.id,` +
|
||||
` projections.users8.state,` +
|
||||
` projections.users8.username,` +
|
||||
` projections.users8_humans.user_id,` +
|
||||
` projections.users8_humans.email,` +
|
||||
` projections.users8_humans.is_email_verified` +
|
||||
` FROM projections.users8` +
|
||||
` LEFT JOIN projections.users8_humans ON projections.users8.id = projections.users8_humans.user_id AND projections.users8.instance_id = projections.users8_humans.instance_id` +
|
||||
userUniqueQuery = `SELECT projections.users9.id,` +
|
||||
` projections.users9.state,` +
|
||||
` projections.users9.username,` +
|
||||
` projections.users9_humans.user_id,` +
|
||||
` projections.users9_humans.email,` +
|
||||
` projections.users9_humans.is_email_verified` +
|
||||
` FROM projections.users9` +
|
||||
` LEFT JOIN projections.users9_humans ON projections.users9.id = projections.users9_humans.user_id AND projections.users9.instance_id = projections.users9_humans.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
userUniqueCols = []string{
|
||||
"id",
|
||||
@@ -182,40 +182,40 @@ var (
|
||||
"email",
|
||||
"is_email_verified",
|
||||
}
|
||||
notifyUserQuery = `SELECT projections.users8.id,` +
|
||||
` projections.users8.creation_date,` +
|
||||
` projections.users8.change_date,` +
|
||||
` projections.users8.resource_owner,` +
|
||||
` projections.users8.sequence,` +
|
||||
` projections.users8.state,` +
|
||||
` projections.users8.type,` +
|
||||
` projections.users8.username,` +
|
||||
notifyUserQuery = `SELECT projections.users9.id,` +
|
||||
` projections.users9.creation_date,` +
|
||||
` projections.users9.change_date,` +
|
||||
` projections.users9.resource_owner,` +
|
||||
` projections.users9.sequence,` +
|
||||
` projections.users9.state,` +
|
||||
` projections.users9.type,` +
|
||||
` projections.users9.username,` +
|
||||
` login_names.loginnames,` +
|
||||
` preferred_login_name.login_name,` +
|
||||
` projections.users8_humans.user_id,` +
|
||||
` projections.users8_humans.first_name,` +
|
||||
` projections.users8_humans.last_name,` +
|
||||
` projections.users8_humans.nick_name,` +
|
||||
` projections.users8_humans.display_name,` +
|
||||
` projections.users8_humans.preferred_language,` +
|
||||
` projections.users8_humans.gender,` +
|
||||
` projections.users8_humans.avatar_key,` +
|
||||
` projections.users8_notifications.user_id,` +
|
||||
` projections.users8_notifications.last_email,` +
|
||||
` projections.users8_notifications.verified_email,` +
|
||||
` projections.users8_notifications.last_phone,` +
|
||||
` projections.users8_notifications.verified_phone,` +
|
||||
` projections.users8_notifications.password_set,` +
|
||||
` projections.users9_humans.user_id,` +
|
||||
` projections.users9_humans.first_name,` +
|
||||
` projections.users9_humans.last_name,` +
|
||||
` projections.users9_humans.nick_name,` +
|
||||
` projections.users9_humans.display_name,` +
|
||||
` projections.users9_humans.preferred_language,` +
|
||||
` projections.users9_humans.gender,` +
|
||||
` projections.users9_humans.avatar_key,` +
|
||||
` projections.users9_notifications.user_id,` +
|
||||
` projections.users9_notifications.last_email,` +
|
||||
` projections.users9_notifications.verified_email,` +
|
||||
` projections.users9_notifications.last_phone,` +
|
||||
` projections.users9_notifications.verified_phone,` +
|
||||
` projections.users9_notifications.password_set,` +
|
||||
` COUNT(*) OVER ()` +
|
||||
` FROM projections.users8` +
|
||||
` LEFT JOIN projections.users8_humans ON projections.users8.id = projections.users8_humans.user_id AND projections.users8.instance_id = projections.users8_humans.instance_id` +
|
||||
` LEFT JOIN projections.users8_notifications ON projections.users8.id = projections.users8_notifications.user_id AND projections.users8.instance_id = projections.users8_notifications.instance_id` +
|
||||
` FROM projections.users9` +
|
||||
` LEFT JOIN projections.users9_humans ON projections.users9.id = projections.users9_humans.user_id AND projections.users9.instance_id = projections.users9_humans.instance_id` +
|
||||
` LEFT JOIN projections.users9_notifications ON projections.users9.id = projections.users9_notifications.user_id AND projections.users9.instance_id = projections.users9_notifications.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + loginNamesQuery + `) AS login_names` +
|
||||
` ON login_names.user_id = projections.users8.id AND login_names.instance_id = projections.users8.instance_id` +
|
||||
` ON login_names.user_id = projections.users9.id AND login_names.instance_id = projections.users9.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + preferredLoginNameQuery + `) AS preferred_login_name` +
|
||||
` ON preferred_login_name.user_id = projections.users8.id AND preferred_login_name.instance_id = projections.users8.instance_id` +
|
||||
` ON preferred_login_name.user_id = projections.users9.id AND preferred_login_name.instance_id = projections.users9.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
notifyUserCols = []string{
|
||||
"id",
|
||||
@@ -246,43 +246,43 @@ var (
|
||||
"password_set",
|
||||
"count",
|
||||
}
|
||||
usersQuery = `SELECT projections.users8.id,` +
|
||||
` projections.users8.creation_date,` +
|
||||
` projections.users8.change_date,` +
|
||||
` projections.users8.resource_owner,` +
|
||||
` projections.users8.sequence,` +
|
||||
` projections.users8.state,` +
|
||||
` projections.users8.type,` +
|
||||
` projections.users8.username,` +
|
||||
usersQuery = `SELECT projections.users9.id,` +
|
||||
` projections.users9.creation_date,` +
|
||||
` projections.users9.change_date,` +
|
||||
` projections.users9.resource_owner,` +
|
||||
` projections.users9.sequence,` +
|
||||
` projections.users9.state,` +
|
||||
` projections.users9.type,` +
|
||||
` projections.users9.username,` +
|
||||
` login_names.loginnames,` +
|
||||
` preferred_login_name.login_name,` +
|
||||
` projections.users8_humans.user_id,` +
|
||||
` projections.users8_humans.first_name,` +
|
||||
` projections.users8_humans.last_name,` +
|
||||
` projections.users8_humans.nick_name,` +
|
||||
` projections.users8_humans.display_name,` +
|
||||
` projections.users8_humans.preferred_language,` +
|
||||
` projections.users8_humans.gender,` +
|
||||
` projections.users8_humans.avatar_key,` +
|
||||
` projections.users8_humans.email,` +
|
||||
` projections.users8_humans.is_email_verified,` +
|
||||
` projections.users8_humans.phone,` +
|
||||
` projections.users8_humans.is_phone_verified,` +
|
||||
` projections.users8_machines.user_id,` +
|
||||
` projections.users8_machines.name,` +
|
||||
` projections.users8_machines.description,` +
|
||||
` projections.users8_machines.has_secret,` +
|
||||
` projections.users8_machines.access_token_type,` +
|
||||
` projections.users9_humans.user_id,` +
|
||||
` projections.users9_humans.first_name,` +
|
||||
` projections.users9_humans.last_name,` +
|
||||
` projections.users9_humans.nick_name,` +
|
||||
` projections.users9_humans.display_name,` +
|
||||
` projections.users9_humans.preferred_language,` +
|
||||
` projections.users9_humans.gender,` +
|
||||
` projections.users9_humans.avatar_key,` +
|
||||
` projections.users9_humans.email,` +
|
||||
` projections.users9_humans.is_email_verified,` +
|
||||
` projections.users9_humans.phone,` +
|
||||
` projections.users9_humans.is_phone_verified,` +
|
||||
` projections.users9_machines.user_id,` +
|
||||
` projections.users9_machines.name,` +
|
||||
` projections.users9_machines.description,` +
|
||||
` projections.users9_machines.has_secret,` +
|
||||
` projections.users9_machines.access_token_type,` +
|
||||
` COUNT(*) OVER ()` +
|
||||
` FROM projections.users8` +
|
||||
` LEFT JOIN projections.users8_humans ON projections.users8.id = projections.users8_humans.user_id AND projections.users8.instance_id = projections.users8_humans.instance_id` +
|
||||
` LEFT JOIN projections.users8_machines ON projections.users8.id = projections.users8_machines.user_id AND projections.users8.instance_id = projections.users8_machines.instance_id` +
|
||||
` FROM projections.users9` +
|
||||
` LEFT JOIN projections.users9_humans ON projections.users9.id = projections.users9_humans.user_id AND projections.users9.instance_id = projections.users9_humans.instance_id` +
|
||||
` LEFT JOIN projections.users9_machines ON projections.users9.id = projections.users9_machines.user_id AND projections.users9.instance_id = projections.users9_machines.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + loginNamesQuery + `) AS login_names` +
|
||||
` ON login_names.user_id = projections.users8.id AND login_names.instance_id = projections.users8.instance_id` +
|
||||
` ON login_names.user_id = projections.users9.id AND login_names.instance_id = projections.users9.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + preferredLoginNameQuery + `) AS preferred_login_name` +
|
||||
` ON preferred_login_name.user_id = projections.users8.id AND preferred_login_name.instance_id = projections.users8.instance_id` +
|
||||
` ON preferred_login_name.user_id = projections.users9.id AND preferred_login_name.instance_id = projections.users9.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
usersCols = []string{
|
||||
"id",
|
||||
|
||||
Reference in New Issue
Block a user