Commit Graph

3859 Commits

Author SHA1 Message Date
Stefan Benz
7eb45c6cfd feat: project v2beta resource API (#9742)
# Which Problems Are Solved

Resource management of projects and sub-resources was before limited by
the context provided by the management API, which would mean you could
only manage resources belonging to a specific organization.

# How the Problems Are Solved

With the addition of a resource-based API, it is now possible to manage
projects and sub-resources on the basis of the resources themselves,
which means that as long as you have the permission for the resource,
you can create, read, update and delete it.

- CreateProject to create a project under an organization
- UpdateProject to update an existing project
- DeleteProject to delete an existing project
- DeactivateProject and ActivateProject to change the status of a
project
- GetProject to query for a specific project with an identifier
- ListProject to query for projects and granted projects
- CreateProjectGrant to create a project grant with project and granted
organization
- UpdateProjectGrant to update the roles of a project grant
- DeactivateProjectGrant and ActivateProjectGrant to change the status
of a project grant
- DeleteProjectGrant to delete an existing project grant
- ListProjectGrants to query for project grants
- AddProjectRole to add a role to an existing project
- UpdateProjectRole to change texts of an existing role
- RemoveProjectRole to remove an existing role
- ListProjectRoles to query for project roles

# Additional Changes

- Changes to ListProjects, which now contains granted projects as well
- Changes to messages as defined in the
[API_DESIGN](https://github.com/zitadel/zitadel/blob/main/API_DESIGN.md)
- Permission checks for project functionality on query and command side
- Added testing to unit tests on command side
- Change update endpoints to no error returns if nothing changes in the
resource
- Changed all integration test utility to the new service
- ListProjects now also correctly lists `granted projects`
- Permission checks for project grant and project role functionality on
query and command side
- Change existing pre checks so that they also work resource specific
without resourceowner
- Added the resourceowner to the grant and role if no resourceowner is
provided
- Corrected import tests with project grants and roles
- Added testing to unit tests on command side
- Change update endpoints to no error returns if nothing changes in the
resource
- Changed all integration test utility to the new service
- Corrected some naming in the proto files to adhere to the API_DESIGN

# Additional Context

Closes #9177

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-05-21 14:40:47 +02:00
alfa-alex
6889d6a1da feat: add custom org ID to AddOrganizationRequest (#9720)
# Which Problems Are Solved

- It is not possible to specify a custom organization ID when creating
an organization. According to
https://github.com/zitadel/zitadel/discussions/9202#discussioncomment-11929464
this is "an inconsistency in the V2 API".

# How the Problems Are Solved

- Adds the `org_id` as an optional parameter to the
`AddOrganizationRequest` in the `v2beta` API.

# Additional Changes

None. 

# Additional Context

- Discussion
[#9202](https://github.com/zitadel/zitadel/discussions/9202)
- I was mostly interested in how much work it'd be to add this field.
Then after completing this, I thought I'd submit this PR. I won't be
angry if you just close this PR with the reasoning "we didn't ask for
it". 😄
- Even though I don't think this is a breaking change, I didn't add this
to the `v2` API yet (don't know what the process for this is TBH). The
changes should be analogous, so if you want me to, just request it.

---------

Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
2025-05-21 12:55:40 +02:00
Marco A.
490e4bd623 feat: instance requests implementation for resource API (#9830)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

These changes introduce resource-based API endpoints for managing
instances and custom domains.

There are 4 types of changes:

- Endpoint implementation: consisting of the protobuf interface and the
implementation of the endpoint. E.g:
606439a172
- (Integration) Tests: testing the implemented endpoint. E.g:
cdfe1f0372
- Fixes: Bugs found during development that are being fixed. E.g:
acbbeedd32
- Miscellaneous: code needed to put everything together or that doesn't
fit any of the above categories. E.g:
529df92abc or
6802cb5468

# How the Problems Are Solved

_Ticked checkboxes indicate that the functionality is complete_

- [x] Instance
  - [x] Create endpoint
  - [x] Create endpoint tests
  - [x] Update endpoint
  - [x] Update endpoint tests
  - [x] Get endpoint
  - [x] Get endpoint tests
  - [x] Delete endpoint
  - [x] Delete endpoint tests
- [x] Custom Domains
  - [x] Add custom domain
  - [x] Add custom domain tests
  - [x] Remove custom domain
  - [x] Remove custom domain tests
  - [x] List custom domains
  - [x] List custom domains tests
- [x] Trusted Domains
  - [x] Add trusted domain
  - [x] Add trusted domain tests
  - [x] Remove trusted domain
  - [x] Remove trusted domain tests
  - [x] List trusted domains
  - [x] List trusted domains tests

# Additional Changes

When looking for instances (through the `ListInstances` endpoint)
matching a given query, if you ask for the results to be order by a
specific column, the query will fail due to a syntax error. This is
fixed in acbbeedd32 . Further explanation
can be found in the commit message

# Additional Context

- Relates to #9452 
- CreateInstance has been excluded:
https://github.com/zitadel/zitadel/issues/9930
- Permission checks / instance retrieval (middleware) needs to be
changed to allow context based permission checks
(https://github.com/zitadel/zitadel/issues/9929), required for
ListInstances

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-05-21 10:50:44 +02:00
Livio Spring
a73acbcfc3 fix(login): render error properly when auto creation fails (#9871)
# Which Problems Are Solved

If an IdP has the `automatic creation` option enabled without the
`account creation allowed (manually)` and does not provide all the
information required (given name, family name, ...) the wrong error
message was presented to the user.

# How the Problems Are Solved

Prevent overwrite of the error when rendering the error in the
`renderExternalNotFoundOption` function.

# Additional Changes

none

# Additional Context

- closes #9766
- requires backport to 2.x and 3.x

Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
2025-05-20 17:18:32 +00:00
Elio Bischof
6929c680c4 docs: specify deprecations (#9915)
# Which Problems Are Solved

We have no standard way of deprecating API methods.

# How the Problems Are Solved

The API_DESIGN.md contains a section that describes how to deprecate
APIs.
Most importantly, deprecated APIs should link to replacement APIs for
good UX.

# Additional Context

- [x] Discussed with @stebenz during review of
https://github.com/zitadel/zitadel/pull/9743#discussion_r2081736144
- [ ] Inform backend engineers when this is merged.

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-05-20 16:14:30 +02:00
Marco A.
7861024ea2 docs: fix Go backend example (#9864)
# Which Problems Are Solved

This PR aims to clarify how to use the zitadel SDK with OAuth token
introspection.

# How the Problems Are Solved

Reworked the setup process on console needed to create the JSON key and
a PAT.

# Additional Changes

- Closes #5559
2025-05-20 15:21:30 +03:00
Stefan Benz
6b07e57e5c test: fix list orgs test with sort (#9909)
# Which Problems Are Solved

List organization integration test fails sometimes due to incorrect
sorting of results.

# How the Problems Are Solved

Add sorting column to request on list organizations endpoint and sort
expected results.

# Additional Changes

None

# Additional Context

None
2025-05-20 09:32:09 +02:00
Livio Spring
968d91a3e0 chore: update dependencies (#9784)
# Which Problems Are Solved

Some dependencies are out of date and published new version including
(unaffected) vulnerability fixes.

# How the Problems Are Solved

- Updated at least all direct dependencies apart from i18n, webauthn
(existing issues),
  -  crewjam (https://github.com/zitadel/zitadel/issues/9783) and
- github.com/gorilla/csrf (https://github.com/gorilla/csrf/issues/190,
https://github.com/gorilla/csrf/issues/189,
https://github.com/gorilla/csrf/issues/188,
https://github.com/gorilla/csrf/issues/187,
https://github.com/gorilla/csrf/issues/186)
      -  noteworthy: https://github.com/golang/go/issues/73626
- Some dependencies require Go 1.24, which triggered an update for
zitadel to go 1.24 as well.

# Additional Changes

None

# Additional Context

None
2025-05-19 10:16:49 +00:00
Livio Spring
1b2fd23e0b fix: idp user information mapping (#9892)
# Which Problems Are Solved

When retrieving the information of an IdP intent, depending on the IdP
type (e.g. Apple), there was issue when mapping the stored (event)
information back to the specific IdP type, potentially leading to a
panic.

# How the Problems Are Solved

- Correctly initialize the user struct to map the information to.

# Additional Changes

none

# Additional Context

- reported by a support request
- needs backport to 3.x and 2.x
2025-05-19 09:25:17 +00:00
Daniel Fabian
056b01f78d fix: typoe in "Migrate from ZITADEL" documentation (#9867)
# Which Problems Are Solved

- Fixed a typoe in ["Migrate from ZITADEL"
documentation](https://zitadel.com/docs/guides/migrate/sources/zitadel#authorization)

Co-authored-by: Fabienne Bühler <fabienne@zitadel.com>
2025-05-19 07:11:54 +00:00
Juriaan Kennedy
38013d0e84 feat(crypto): support for SHA2 and PHPass password hashes (#9809)
# Which Problems Are Solved

- Allow users to use SHA-256 and SHA-512 hashing algorithms. These
algorithms are used by Linux's crypt(3) function.
- Allow users to import passwords using the PHPass algorithm. This
algorithm is used by older PHP systems, WordPress in particular.

# How the Problems Are Solved

- Upgrade passwap to
[v0.9.0](https://github.com/zitadel/passwap/releases/tag/v0.9.0)
- Add sha2 and phpass as a new verifier option in defaults.yaml

# Additional Changes

- Updated docs to explain the two algorithms

# Additional Context
Implements the changes in the passwap library from
https://github.com/zitadel/passwap/pull/59 and
https://github.com/zitadel/passwap/pull/60
2025-05-16 15:53:45 +00:00
Fabienne Bühler
fefe9d27a0 docs: fix typo in email notification provider description (#9890) 2025-05-16 10:07:02 +00:00
Tim Möhlmann
4480cfcf56 docs(advisory): position precision fix (#9882)
# Which Problems Are Solved

We are deploying precision fixes on the `position` values of the
eventstore. The fix itself might break systems that were already
affected by the bug.

# How the Problems Are Solved

Add a technical advisory that explains background and steps to fix the
Zitadel database when affected.

# Additional Context

- Original issue: [8671](https://github.com/zitadel/zitadel/issues/8671)
- Follow-up issue:
[8863](https://github.com/zitadel/zitadel/issues/8863)
- Re-fix: https://github.com/zitadel/zitadel/pull/9881
2025-05-16 10:41:35 +02:00
Stefan Benz
1383cb0702 fix: correctly "or"-join ldap userfilters (#9855)
# Which Problems Are Solved

LDAP userfilters are joined, but as it not handled as a list of filters
but as a string they are not or-joined.

# How the Problems Are Solved

Separate userfilters as list of filters and join them correctly with
"or" condition.

# Additional Changes

None

# Additional Context

Closes #7003

---------

Co-authored-by: Marco A. <kwbmm1990@gmail.com>
2025-05-13 10:32:48 +02:00
Elio Bischof
d79d5e7b96 fix(projection): remove users with factors (#9877)
# Which Problems Are Solved

When users are removed, their auth factors stay in the projection. This
data inconsistency is visible if a removed user is recreated with the
same ID. In such a case, the login UI and the query API methods show the
removed users auth methods. This is unexpected behavior.

The old users auth methods are not usable to log in and they are not
found by the command side. This is expected behavior.

# How the Problems Are Solved

The auth factors projection reduces the user removed event by deleting
all factors.

# Additional Context

- Reported by support request
- requires backport to 2.x and 3.x
2025-05-12 12:05:12 +02:00
subaru
28856015d6 feat(console): Add organization ID filter to organization list (#9823)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

Replace this example text with a concise list of problems that this PR
solves.
- Organization list lacked the ability to filter by organization ID
- No efficient method was provided for users to search organizations by
ID


# How the Problems Are Solved

Replace this example text with a concise list of changes that this PR
introduces.
- Added organization ID filtering functionality to
`filter-org.component.ts`
  - Added `ID` to the `SubQuery` enum
- Added `ID` case handling to `changeCheckbox`, `setValue`, and
`getSubFilter` methods
- Added ID filter UI to `filter-org.component.html`
  - Added checkbox and text input field
  - Used translation key to display "Organization ID" label
- Added new translation key to translation file (`en.json`)
  - Added `FILTER.ORGID` key with "Organization ID" value


# Additional Changes

Replace this example text with a concise list of additional changes that
this PR introduces, that are not directly solving the initial problem
but are related.
- Maintained consistency with existing filtering functionality
- Ensured intuitive user interface usability
- Added new key while maintaining translation file structure


# Additional Context

Replace this example with links to related issues, discussions, discord
threads, or other sources with more context.
Use the Closing #issue syntax for issues that are resolved with this PR.
- Closes #8792
- Discussion #xxx
- Follow-up for PR #xxx
- https://discord.com/channels/xxx/xxx

---------

Co-authored-by: Marco A. <kwbmm1990@gmail.com>
2025-05-12 10:04:32 +02:00
Silvan
60ce32ca4f fix(setup): reenable index creation (#9868)
# Which Problems Are Solved

We saw high CPU usage if many events were created on the database. This
was caused by the new actions which query for all event types and
aggregate types.

# How the Problems Are Solved

- the handler of action execution does not filter for aggregate and
event types.
- the index for `instance_id` and `position` is reenabled.

# Additional Changes

none

# Additional Context

none
2025-05-08 15:13:57 +00:00
Livio Spring
867e9cb15a fix: correctly use single matching user (by loginname) (#9865)
# Which Problems Are Solved

In rare cases there was a possibility that multiple users were found by
a loginname. This prevented the corresponding user to sign in.

# How the Problems Are Solved

Fixed the corresponding query (to correctly respect the org domain
policy).

# Additional Changes

None

# Additional Context

Found during the investigation of a support request
2025-05-08 07:32:41 +00:00
Livio Spring
d71795c433 fix: remove index es_instance_position (#9862)
# Which Problems Are Solved

#9837 added a new index `es_instance_position` on the events table with
the idea to improve performance for some projections. Unfortunately, it
makes it worse for almost all projections and would only improve the
situation for the events handler of the actions V2 subscriptions.

# How the Problems Are Solved

Remove the index again.

# Additional Changes

None

# Additional Context

relates to #9837
relates to #9863
2025-05-08 08:35:34 +02:00
Maximilian
577bf9c710 docs(legal): Update to DPA and privacy policy documents (May 2025) (#9566)
We are bringing our DPA and privacy policy document in line with our
changes to the corporate structure, changes to subprocessors, and new
cookie technologies.

This PR replaces #3055 which included more changes to terms of service.
The changes to terms of service will follow in a second step.

---------

Co-authored-by: Florian Forster <florian@zitadel.com>
2025-05-07 15:58:21 +00:00
Stefan Benz
21167a4bba fix: add current state for execution handler into setup (#9863)
# Which Problems Are Solved

The execution handler projection handles all events to check if an
execution has to be provided to the worker to execute.
In this logic all events would be processed from the beginning which is
not necessary.

# How the Problems Are Solved

Add the current state to the execution handler projection, to avoid
processing all existing events.

# Additional Changes

Add custom configuration to the default, so that the transactions are
limited to some events.

# Additional Context

None
2025-05-07 14:26:53 +00:00
Stefan Benz
c6aa6385b6 docs: add invalid information to member requests (#9858)
# Which Problems Are Solved

Misleading information on member endpoint requests.

# How the Problems Are Solved

Add comment to member endpoint requests that the request is invalid if
no roles are provided.

# Additional Changes

None

# Additional Context

Closes #9415

Co-authored-by: Fabienne Bühler <fabienne@zitadel.com>
2025-05-07 13:59:02 +00:00
Elio Bischof
898366c537 fix: allow user self deletion (#9828)
# Which Problems Are Solved

Currently, users can't delete themselves using the V2 RemoveUser API
because of the redunant API middleware permission check.

On main, using a machine user PAT to delete the same machine user:

```bash
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" -d '{"userId": "318838604669387137"}' localhost:8080 zitadel.user.v2.UserService.DeleteUser
ERROR:
  Code: NotFound
  Message: membership not found (AUTHZ-cdgFk)
  Details:
  1)	{
    	  "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
    	  "id": "AUTHZ-cdgFk",
    	  "message": "membership not found"
    	}
```

Same on this PRs branch:

```bash
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" -d '{"userId": "318838604669387137"}' localhost:8080 zitadel.user.v2.UserService.DeleteUser
{
  "details": {
    "sequence": "3",
    "changeDate": "2025-05-06T13:44:54.349048Z",
    "resourceOwner": "318838541083804033"
  }
}
```

Repeated call
```bash
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" -d '{"userId": "318838604669387137"}' localhost:8080 zitadel.user.v2.UserService.DeleteUser
ERROR:
  Code: Unauthenticated
  Message: Errors.Token.Invalid (AUTH-7fs1e)
  Details:
  1)	{
    	  "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
    	  "id": "AUTH-7fs1e",
    	  "message": "Errors.Token.Invalid"
    	}
```

# How the Problems Are Solved

The middleware permission check is disabled and the
domain.PermissionCheck is used exclusively.

# Additional Changes

A new type command.PermissionCheck allows to optionally accept a
permission check for commands, so APIs with middleware permission checks
can omit redundant permission checks by passing nil while APIs without
middleware permission checks can pass one to the command.

# Additional Context

This is a subtask of #9763

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-05-07 15:24:24 +02:00
Stefan Benz
0d7d4e6af0 docs: extend api design with additional information and examples (#9856)
# Which Problems Are Solved

There were some misunderstandings on how different points would be
needed to be applied into existing API definitions.

# How the Problems Are Solved

- Added structure to the API design
- Added points to context information in requests and responses
- Added examples to responses with context information
- Corrected available pagination messages
- Added pagination and filter examples

# Additional Changes

None

# Additional Context

None
2025-05-07 10:14:01 +02:00
Zach Hirschtritt
8cb1d24b36 fix: add user id index on sessions8 (#9834)
# Which Problems Are Solved

When a user changes their password, Zitadel needs to terminate all of
that user's active sessions. This query can take many seconds on
deployments with large session and user tables. This happens as part of
session projection handling, so doesn't directly impact user experience,
but potentially bogs down the projection handler which isn't great. In
the future, this index could be used to power a "see all of my current
sessions" feature in Zitadel.

# How the Problems Are Solved

Adds new index on `user_id` column on `projections.sessions8` table.
Alternatively, we can index on `(instance_id, user_id)` instead but
opted for keeping the index smaller as we already index on `instance_id`
separately.

# Additional Changes

None

# Additional Context

None

---------

Co-authored-by: Silvan <27845747+adlerhurst@users.noreply.github.com>
2025-05-06 06:38:19 +00:00
Silvan
a626678004 fix(setup): execute s54 (#9849)
# Which Problems Are Solved

Step 54 was not executed during setup.

# How the Problems Are Solved

Added the step to setup jobs

# Additional Changes

none

# Additional Context

- the step was added in https://github.com/zitadel/zitadel/pull/9837
- thanks to @zhirschtritt for raising this.
2025-05-06 06:15:45 +00:00
Livio Spring
b1e60e7398 Merge commit from fork
* fix: prevent intent token reuse and add expiry

* fix duplicate

* fix expiration
2025-05-02 13:44:24 +02:00
Tim Möhlmann
bb56b362a7 perf(eventstore): add instance position index (#9837)
# Which Problems Are Solved

Some projection queries took a long time to run. It seems that 1 or more
queries couldn't make proper use of the `es_projection` index. This
might be because of a specific complexity aggregate_type and event_type
arguments, making the index unfeasible for postgres.

# How the Problems Are Solved

Following the index recommendation, add and index that covers just
instance_id and position.

# Additional Changes

- none

# Additional Context

- Related to https://github.com/zitadel/zitadel/issues/9832
2025-05-02 13:40:22 +02:00
Elio Bischof
74ace1aec3 fix(actions): default sorting column to creation date (#9795)
# Which Problems Are Solved

The sorting column of action targets and executions defaults to the ID
column instead of the creation date column.
This is only relevant, if the sorting column is explicitly passed as
unspecified.
If the sorting column is not passed, it correctly defaults to the
creation date.

```bash
#  Sorts by ID
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" -d '{"sortingColumn": "TARGET_FIELD_NAME_UNSPECIFIED"}' localhost:8080 zitadel.action.v2beta.ActionService.ListTargets
#  Sorts by ID
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" -d '{"sortingColumn": 0}' localhost:8080 zitadel.action.v2beta.ActionService.ListTargets
#  Sorts by creation date
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" localhost:8080 zitadel.action.v2beta.ActionService.ListTargets
``` 

# How the Problems Are Solved

`action.TargetFieldName_TARGET_FIELD_NAME_UNSPECIFIED` maps to the
sorting column `query.TargetColumnCreationDate`.

# Additional Context

As IDs are also generated in ascending, like creation dates, the the bug
probably only causes unexpected behavior for cases, where the ID is
specified during target or execution creation. This is currently not
supported, so this bug probably has no impact at all. It doesn't need to
be backported.

Found during implementation of #9763

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-05-01 05:41:57 +00:00
Ramon
02acc93242 fix: Improve Actions V2 translations (#9826)
# Which Problems Are Solved
The translation for event was not loaded correctly.

![grafik](https://github.com/user-attachments/assets/3fa8d72f-f55a-44b7-997d-0f0976f66b85)

# How the Problems Are Solved
Correct translations to have the correct key.

# Additional Changes
Improved the translation for all events.
2025-04-30 13:20:39 +00:00
Stefan Benz
a05f7ce3fc fix: correct handling of removed targets (#9824)
# Which Problems Are Solved

In Actions v2, if a target is removed, which is still used in an
execution, the target is still listed when list executions.

# How the Problems Are Solved

Removed targets are now also removed from the executions.

# Additional Changes

To be sure the list executions include a check if the target is still
existing.

# Additional Context

None

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-30 12:58:10 +00:00
Ramon
48c1f7e49f fix: Actions V2 improve deleted target handling in executions (#9822)
# Which Problems Are Solved
Previously, if a target was deleted but still referenced by an
execution, it became impossible to load the executions.

# How the Problems Are Solved
Missing targets in the execution table are now gracefully ignored,
allowing executions to load without errors.

# Additional Changes
Enhanced permission handling in the settings sidenav to ensure users
have the correct access rights.
2025-04-30 12:22:27 +00:00
Ramon
002c3eb025 fix: Use ID ordering for the executions in Actions v2 (#9820)
# Which Problems Are Solved

Sort Executions by ID in the Actions V2 view. This way All is the first
element in the table.

# How the Problems Are Solved
Pass ID sorting to the Backend.

# Additional Changes
Cleaned up some imports.

# Additional Context
- Part of Make actions sortable by hirarchie #9688
2025-04-30 11:16:44 +00:00
Stefan Benz
3953879fe9 fix: correct unmarshalling of IdP user when using Google (#9799)
# Which Problems Are Solved

Users from Google IDP's are not unmarshalled correctly in intent
endpoints and not returned to callers.

# How the Problems Are Solved

Provided correct type for unmarshalling of the information.

# Additional Changes

None

# Additional Context

None

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-30 09:12:48 +00:00
Tim Möhlmann
0465d5093e fix(features): remove the improved performance enumer (#9819)
# Which Problems Are Solved

Instance that had improved performance flags set, got event errors when
getting instance features. This is because the improved performance
flags were marshalled using the enumerated integers, but now needed to
be unmashalled using the added UnmarshallText method.

# How the Problems Are Solved

- Remove emnumer generation

# Additional Changes

- none

# Additional Context

- reported on QA
- Backport to next-rc / v3
2025-04-30 08:26:04 +00:00
Silvan
181186e477 fix(mirror): add max auth request age configuration (#9812)
# Which Problems Are Solved

The `auth.auth_requests` table is not cleaned up so long running Zitadel
installations can contain many rows.
 
The mirror command can take long because a the data are first copied
into memory (or disk) on cockroach and users do not get any output from
mirror. This is unfortunate because people don't know if Zitadel got
stuck.

# How the Problems Are Solved

Enhance logging throughout the projection processes and introduce a
configuration option for the maximum age of authentication requests.

# Additional Changes

None

# Additional Context

closes https://github.com/zitadel/zitadel/issues/9764

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-29 15:29:16 +00:00
Tim Möhlmann
91bc71db74 fix(instance): add web key generation to instance defaults (#9815)
# Which Problems Are Solved

Webkeys were not generated with new instances when the webkey feature
flag was enabled for instance defaults. This would cause a redirect loop
with console for new instances on QA / coud.

# How the Problems Are Solved

- uncomment the webkeys section on defaults.yaml
- Fix field naming of webkey config

# Additional Changes

- Add all available features as comments.
- Make the improved performance type enum parsable from the config,
untill now they were just ints.
- Running of the enumer command created missing enum entries for feature
keys.

# Additional Context

- Needs to be back-ported to v3 / next-rc

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-29 14:54:53 +00:00
Elio Bischof
fa3efd9da3 docs: fix Illegal byte sequence (#9750)
# Which Problems Are Solved

In some docs pages, we propose to generate a Zitadel masterkey using the
command `tr -dc A-Za-z0-9 </dev/urandom | head -c 32`. However, this
fails on some systems/locations with the error message `tr: Illegal byte
sequence`.

# How the Problems Are Solved

We replace the command by this more portable variant: `LC_ALL=C tr -dc
'[:graph:]' </dev/urandom | head -c 32`

# Additional Changes

None

# Additional Context

Found by @fcoppede while testing #9496. The new command works for him.
2025-04-29 14:33:23 +00:00
Elio Bischof
c36b0ab2e2 docs(self-hosting): add login to lb example (#9496)
# Which Problems Are Solved

We have no docs for self-hosting the login using the standard login as a
standalone docker container.

# How the Problems Are Solved

A common self-hosting case is to publish the login at the same domain as
Zitadel behind a reverse proxy.
That's why we extend the load balancing example.
We refocus the example from *making TLS work* to *running multiple
services behind the proxy and connect them using an internal network and
DNS*. I decided this together with @fforootd.

For authenticating with the login application, we have to set up a
service user and give it the role IAM_LOGIN_CLIENT. We do so in the
use-new-login "job" container as `zitadel setup` only supports Zitadel
users with the role IAM_ADMIN AFAIR.

The login application relies on a healthy Zitadel API on startup, which
is why we fix the containers readiness reports.

# Additional Changes

- We deploy the init and setup jobs independently, because this better
reflects our production recommendatinons.
It gives more control over the upgrade process.
- We use the ExternalDomain *127.0.0.1.sslip.io* instead of *my.domain*,
because this doesn't require changing the local DNS resolution by
changing */etc/hosts* for local tests.

# Testing

The commands in the preview docs use to the configuration files on main.
This is fine when the PR is merged but not for testing the PR.
Replace the used links to make them point to the PRs changed files.
Instead of the commands in the preview docs, use these: 

```bash
# Download the docker compose example configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/docker-compose.yaml

# Download the Traefik example configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/example-traefik.yaml

# Download and adjust the example configuration file containing standard configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/example-zitadel-config.yaml

# Download and adjust the example configuration file containing secret configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/example-zitadel-secrets.yaml

# Download and adjust the example configuration file containing database initialization configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/example-zitadel-init-steps.yaml

# A single ZITADEL instance always needs the same 32 bytes long masterkey
# Generate one to a file if you haven't done so already and pass it as environment variable
LC_ALL=C tr -dc '[:graph:]' </dev/urandom | head -c 32 > ./zitadel-masterkey
export ZITADEL_MASTERKEY="$(cat ./zitadel-masterkey)"

# Run the database and application containers
docker compose up --detach --wait
```

# Additional Context

- Closes https://github.com/zitadel/DevOps/issues/111
- Depends on https://github.com/zitadel/typescript/pull/412
- Contributes to road map item
https://github.com/zitadel/zitadel/issues/9481
2025-04-29 14:12:34 +00:00
Ramon
d930a09cb0 fix: Improve Actions V2 Texts and reenable in settings (#9814)
# Which Problems Are Solved
This pr includes improved texts to make the usage of Actions V2 more
easy.
Since the removal of the Actions V2 Feature Flag we removed the code
that checks if it's enabled in the settings sidenav.

# How the Problems Are Solved
Added new texts to translations. Removed sidenav logic that checks for
Actions V2 Feature Flag

# Additional Context

- Part of #7248 
- Part of #9688

---------

Co-authored-by: Max Peintner <peintnerm@gmail.com>
Co-authored-by: Max Peintner <max@caos.ch>
2025-04-29 11:25:49 +00:00
David Skewis
ce823c9176 fix: update session recordings for posthog (#9775)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

- Updates to only capture 10% of events with posthog

# How the Problems Are Solved

- Uses a feature flag rolled out to 10% of users to enable the capture

# Additional Changes

N/A

# Additional Context

N/A
2025-04-29 09:42:49 +00:00
Silvan
ed4e226da9 fix(defaults): comment default SystemAPIUsers (#9813)
# Which Problems Are Solved

If I start a fresh instance and do not overwrite `SystemAPIUsers` I get
an error during startup `error="decoding failed due to the following
error(s):\n\n'SystemAPIUsers[0][path]' expected a map, got
'string'\n'SystemAPIUsers[0][memberships]' expected a map, got 'slice'"`

# How the Problems Are Solved

the configuration is commented so that the example is still there

# Additional Changes

-

# Additional Context

was added in https://github.com/zitadel/zitadel/pull/9757
2025-04-29 11:12:43 +02:00
intelli-joe
205beb607b fix: update link to postgres-insecure example in docs (#9802)
Fix reference to postgres-insecure example in docs
2025-04-28 13:22:04 +00:00
Allen Oyieke
a9dd78a132 docs: fix typo in Java SDK example document (#9804)
# Which Problems Are Solved
This PR resolves the issue #9648 

# How the Problems Are Solved
Resolves a typo in the documentation


# Additional Context

- Closes  #9648 
- Discussion  #9648
2025-04-28 09:53:31 +00:00
Stefan Benz
b8ba7bd5ba fix: remove action feature flag and include execution (#9727)
# Which Problems Are Solved

Actions v2 is not a feature flag anymore, include functionality on
executions is not used and json tags of proto messages are handled
incorrectly.

# How the Problems Are Solved

- Remove actions from the feature flags on system and instance level
- Remove include type on executions, only in the API, later maybe in the
handling logic as well
- Use protojson in request and response handling of actions v2

# Additional Changes

- Correct integration tests for request and response handling
- Use json.RawMessage for events, so that the event payload is not
base64 encoded
- Added separate context for async webhook calls, that executions are
not cancelled when called async

# Additional Context

Related to #9759 
Closes #9710

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-28 11:24:50 +02:00
Livio Spring
84628671bd chore: only download release relevant artifacts (#9808)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

https://github.com/zitadel/zitadel/pull/9765 fixed an issue for with
actions cache service. The PR updated the push action, which now also
provides a build summary. The "release" step tries to download all
artifacts, which now fails:
https://github.com/zitadel/zitadel/actions/runs/14660464768/job/41145285454

# How the Problems Are Solved

Only download relevant artifacts, which are published as part of the
release.

# Additional Changes

None

# Additional Context

None
2025-04-28 11:02:33 +02:00
Iraq
65bb559bbe docs(API_DESIGN.md): adding guidlines around API returns when multiple resources created (#9797)
# Which Problems Are Solved

Updating API_Design.md to include guidelines to specify all created
resources created from an API call

# How the Problems Are Solved

This makes things clearer to the user if everything requested was
actually created and helps with testing.
See  https://github.com/zitadel/zitadel/pull/9352

# Additional Context

- Related https://github.com/zitadel/zitadel/issues/6305
- Related https://github.com/zitadel/zitadel/pull/9352

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-25 12:04:29 +00:00
Livio Spring
4ffd4ef381 fix(actions): handle empty deny list correctly (#9753)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

A customer reached out that after an upgrade, actions would always fail
with the error "host is denied" when calling an external API.
This is due to a security fix
(https://github.com/zitadel/zitadel/security/advisories/GHSA-6cf5-w9h3-4rqv),
where a DNS lookup was added to check whether the host name resolves to
a denied IP or subnet.
If the lookup fails due to the internal DNS setup, the action fails as
well. Additionally, the lookup was also performed when the deny list was
empty.

# How the Problems Are Solved

- Prevent DNS lookup when deny list is empty
- Properly initiate deny list and prevent empty entries

# Additional Changes

- Log the reason for blocked address (domain, IP, subnet)

# Additional Context

- reported by a customer
- needs backport to 2.70.x, 2.71.x and 3.0.0 rc
2025-04-25 07:12:42 +00:00
Michael Sacher
106e360c19 docs(adopters): Clean Energy Exchange AG (#9686)
doc: ADOPTERS.md ceex

# Which Problems Are Solved

Replace this example text with a concise list of problems that this PR
solves.
For example:
- If the property XY is not given, the system crashes with a nil pointer
exception.

# How the Problems Are Solved

Replace this example text with a concise list of changes that this PR
introduces.
For example:
- Validates if property XY is given and throws an error if not

# Additional Changes

Replace this example text with a concise list of additional changes that
this PR introduces, that are not directly solving the initial problem
but are related.
For example:
- The docs explicitly describe that the property XY is mandatory
- Adds missing translations for validations.

# Additional Context

Replace this example with links to related issues, discussions, discord
threads, or other sources with more context.
Use the Closing #issue syntax for issues that are resolved with this PR.
- Closes #xxx
- Discussion #xxx
- Follow-up for PR #xxx
- https://discord.com/channels/xxx/xxx
2025-04-25 06:45:39 +00:00
Stygmates
257bef974a fix: text buttons overflow in login page (#9637)
# Which Problems Are Solved

The text of some of the buttons in the login page overflows in some
languages


![image](https://github.com/user-attachments/assets/ef3d3bfe-8966-4be5-8d3b-3b0b72ce5e49)

# How the Problems Are Solved

Updated the css to set the overflow to hidden and text-overflow to
ellipsis, this is the simplest fix I could come up with, if you have a
better alternative feel free to tell me what you would prefer 🙏


![image](https://github.com/user-attachments/assets/cdfa1f7b-535a-419d-ba9d-a57ec332d976)


# Additional Changes

None

# Additional Context

I couldn't test the following case locally since I had trouble setting
up a SMTP provider locally, but the class affected by my change should
also target this case, if someone could test it before merging it
🙏:


![315957139-6a630056-82b9-42cd-85a6-8819f2e1873b](https://github.com/user-attachments/assets/f6860db3-d6a0-4e4d-b9e6-0b1968145047)

- Closes #7619

Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
2025-04-24 09:56:52 +00:00