Commit Graph

6037 Commits

Author SHA1 Message Date
Tim Möhlmann
bb56b362a7 perf(eventstore): add instance position index (#9837)
# Which Problems Are Solved

Some projection queries took a long time to run. It seems that 1 or more
queries couldn't make proper use of the `es_projection` index. This
might be because of a specific complexity aggregate_type and event_type
arguments, making the index unfeasible for postgres.

# How the Problems Are Solved

Following the index recommendation, add and index that covers just
instance_id and position.

# Additional Changes

- none

# Additional Context

- Related to https://github.com/zitadel/zitadel/issues/9832
2025-05-02 13:40:22 +02:00
Max Peintner
ed37eaff80 authorizeOrDenyDeviceAuthorization 2025-05-02 09:01:42 +02:00
Elio Bischof
74ace1aec3 fix(actions): default sorting column to creation date (#9795)
# Which Problems Are Solved

The sorting column of action targets and executions defaults to the ID
column instead of the creation date column.
This is only relevant, if the sorting column is explicitly passed as
unspecified.
If the sorting column is not passed, it correctly defaults to the
creation date.

```bash
#  Sorts by ID
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" -d '{"sortingColumn": "TARGET_FIELD_NAME_UNSPECIFIED"}' localhost:8080 zitadel.action.v2beta.ActionService.ListTargets
#  Sorts by ID
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" -d '{"sortingColumn": 0}' localhost:8080 zitadel.action.v2beta.ActionService.ListTargets
#  Sorts by creation date
grpcurl -plaintext -H "Authorization: Bearer ${ZITADEL_ACCESS_TOKEN}" localhost:8080 zitadel.action.v2beta.ActionService.ListTargets
``` 

# How the Problems Are Solved

`action.TargetFieldName_TARGET_FIELD_NAME_UNSPECIFIED` maps to the
sorting column `query.TargetColumnCreationDate`.

# Additional Context

As IDs are also generated in ascending, like creation dates, the the bug
probably only causes unexpected behavior for cases, where the ID is
specified during target or execution creation. This is currently not
supported, so this bug probably has no impact at all. It doesn't need to
be backported.

Found during implementation of #9763

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-05-01 05:41:57 +00:00
Ramon
02acc93242 fix: Improve Actions V2 translations (#9826)
# Which Problems Are Solved
The translation for event was not loaded correctly.

![grafik](https://github.com/user-attachments/assets/3fa8d72f-f55a-44b7-997d-0f0976f66b85)

# How the Problems Are Solved
Correct translations to have the correct key.

# Additional Changes
Improved the translation for all events.
2025-04-30 13:20:39 +00:00
Stefan Benz
a05f7ce3fc fix: correct handling of removed targets (#9824)
# Which Problems Are Solved

In Actions v2, if a target is removed, which is still used in an
execution, the target is still listed when list executions.

# How the Problems Are Solved

Removed targets are now also removed from the executions.

# Additional Changes

To be sure the list executions include a check if the target is still
existing.

# Additional Context

None

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-30 12:58:10 +00:00
Max Peintner
833669792b also run on qa 2025-04-30 14:38:53 +02:00
Ramon
48c1f7e49f fix: Actions V2 improve deleted target handling in executions (#9822)
# Which Problems Are Solved
Previously, if a target was deleted but still referenced by an
execution, it became impossible to load the executions.

# How the Problems Are Solved
Missing targets in the execution table are now gracefully ignored,
allowing executions to load without errors.

# Additional Changes
Enhanced permission handling in the settings sidenav to ensure users
have the correct access rights.
2025-04-30 12:22:27 +00:00
Max Peintner
08d34b87a8 cleanup 2025-04-30 14:21:23 +02:00
Max Peintner
b49c2be471 await response 2025-04-30 13:45:15 +02:00
Max Peintner
79043c2f34 eliminate duplicate constructurl 2025-04-30 13:39:02 +02:00
Max Peintner
74dee578c0 import 2025-04-30 13:34:14 +02:00
Max Peintner
54cb3b086e fix imports 2025-04-30 13:31:05 +02:00
Max Peintner
65da744d9a fix zlib export 2025-04-30 13:27:50 +02:00
Max Peintner
4cca720f05 route handler for middleware 2025-04-30 13:20:03 +02:00
Ramon
002c3eb025 fix: Use ID ordering for the executions in Actions v2 (#9820)
# Which Problems Are Solved

Sort Executions by ID in the Actions V2 view. This way All is the first
element in the table.

# How the Problems Are Solved
Pass ID sorting to the Backend.

# Additional Changes
Cleaned up some imports.

# Additional Context
- Part of Make actions sortable by hirarchie #9688
2025-04-30 11:16:44 +00:00
Stefan Benz
3953879fe9 fix: correct unmarshalling of IdP user when using Google (#9799)
# Which Problems Are Solved

Users from Google IDP's are not unmarshalled correctly in intent
endpoints and not returned to callers.

# How the Problems Are Solved

Provided correct type for unmarshalling of the information.

# Additional Changes

None

# Additional Context

None

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-30 09:12:48 +00:00
Max Peintner
06e69ace5e log 2025-04-30 11:08:21 +02:00
Max Peintner
9d43c3f6b8 log policy, csp 2025-04-30 10:56:20 +02:00
Tim Möhlmann
0465d5093e fix(features): remove the improved performance enumer (#9819)
# Which Problems Are Solved

Instance that had improved performance flags set, got event errors when
getting instance features. This is because the improved performance
flags were marshalled using the enumerated integers, but now needed to
be unmashalled using the added UnmarshallText method.

# How the Problems Are Solved

- Remove emnumer generation

# Additional Changes

- none

# Additional Context

- reported on QA
- Backport to next-rc / v3
2025-04-30 08:26:04 +00:00
Max Peintner
d9ada6e79d Merge pull request #444 from zitadel/iframe
fix(security-settings): override csp for allowed iframe
2025-04-30 10:17:05 +02:00
Max Peintner
91087f12fc Merge branch 'main' into qa 2025-04-30 10:15:36 +02:00
Max Peintner
6c7fa7308d Merge pull request #443 from zitadel/1.2.0
Version packages 1.2.0
2025-04-30 10:15:09 +02:00
Max Peintner
449e632766 remove fallback 2025-04-30 10:05:24 +02:00
Max Peintner
a6cf9a6db6 empty security settings as default for integration tests 2025-04-30 09:58:29 +02:00
Max Peintner
0568aed6e0 lint 2025-04-30 09:52:03 +02:00
Max Peintner
43dff470bd csp import 2025-04-30 09:47:51 +02:00
Max Peintner
77e9f6f2e9 override cookie sameSite settings 2025-04-30 09:41:00 +02:00
Max Peintner
a690b254c4 import 2025-04-30 09:23:56 +02:00
Max Peintner
a31c17f5fa @ ns 2025-04-30 09:20:26 +02:00
Max Peintner
231ecdc5c5 change import 2025-04-30 09:18:01 +02:00
Max Peintner
7a25dce936 fix: override csp for allowed iframe 2025-04-30 09:14:11 +02:00
Silvan
181186e477 fix(mirror): add max auth request age configuration (#9812)
# Which Problems Are Solved

The `auth.auth_requests` table is not cleaned up so long running Zitadel
installations can contain many rows.
 
The mirror command can take long because a the data are first copied
into memory (or disk) on cockroach and users do not get any output from
mirror. This is unfortunate because people don't know if Zitadel got
stuck.

# How the Problems Are Solved

Enhance logging throughout the projection processes and introduce a
configuration option for the maximum age of authentication requests.

# Additional Changes

None

# Additional Context

closes https://github.com/zitadel/zitadel/issues/9764

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-29 15:29:16 +00:00
Tim Möhlmann
91bc71db74 fix(instance): add web key generation to instance defaults (#9815)
# Which Problems Are Solved

Webkeys were not generated with new instances when the webkey feature
flag was enabled for instance defaults. This would cause a redirect loop
with console for new instances on QA / coud.

# How the Problems Are Solved

- uncomment the webkeys section on defaults.yaml
- Fix field naming of webkey config

# Additional Changes

- Add all available features as comments.
- Make the improved performance type enum parsable from the config,
untill now they were just ints.
- Running of the enumer command created missing enum entries for feature
keys.

# Additional Context

- Needs to be back-ported to v3 / next-rc

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-29 14:54:53 +00:00
Elio Bischof
fa3efd9da3 docs: fix Illegal byte sequence (#9750)
# Which Problems Are Solved

In some docs pages, we propose to generate a Zitadel masterkey using the
command `tr -dc A-Za-z0-9 </dev/urandom | head -c 32`. However, this
fails on some systems/locations with the error message `tr: Illegal byte
sequence`.

# How the Problems Are Solved

We replace the command by this more portable variant: `LC_ALL=C tr -dc
'[:graph:]' </dev/urandom | head -c 32`

# Additional Changes

None

# Additional Context

Found by @fcoppede while testing #9496. The new command works for him.
2025-04-29 14:33:23 +00:00
Elio Bischof
c36b0ab2e2 docs(self-hosting): add login to lb example (#9496)
# Which Problems Are Solved

We have no docs for self-hosting the login using the standard login as a
standalone docker container.

# How the Problems Are Solved

A common self-hosting case is to publish the login at the same domain as
Zitadel behind a reverse proxy.
That's why we extend the load balancing example.
We refocus the example from *making TLS work* to *running multiple
services behind the proxy and connect them using an internal network and
DNS*. I decided this together with @fforootd.

For authenticating with the login application, we have to set up a
service user and give it the role IAM_LOGIN_CLIENT. We do so in the
use-new-login "job" container as `zitadel setup` only supports Zitadel
users with the role IAM_ADMIN AFAIR.

The login application relies on a healthy Zitadel API on startup, which
is why we fix the containers readiness reports.

# Additional Changes

- We deploy the init and setup jobs independently, because this better
reflects our production recommendatinons.
It gives more control over the upgrade process.
- We use the ExternalDomain *127.0.0.1.sslip.io* instead of *my.domain*,
because this doesn't require changing the local DNS resolution by
changing */etc/hosts* for local tests.

# Testing

The commands in the preview docs use to the configuration files on main.
This is fine when the PR is merged but not for testing the PR.
Replace the used links to make them point to the PRs changed files.
Instead of the commands in the preview docs, use these: 

```bash
# Download the docker compose example configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/docker-compose.yaml

# Download the Traefik example configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/example-traefik.yaml

# Download and adjust the example configuration file containing standard configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/example-zitadel-config.yaml

# Download and adjust the example configuration file containing secret configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/example-zitadel-secrets.yaml

# Download and adjust the example configuration file containing database initialization configuration.
wget https://raw.githubusercontent.com/zitadel/zitadel/refs/heads/docs-compose-login/docs/docs/self-hosting/deploy/loadbalancing-example/example-zitadel-init-steps.yaml

# A single ZITADEL instance always needs the same 32 bytes long masterkey
# Generate one to a file if you haven't done so already and pass it as environment variable
LC_ALL=C tr -dc '[:graph:]' </dev/urandom | head -c 32 > ./zitadel-masterkey
export ZITADEL_MASTERKEY="$(cat ./zitadel-masterkey)"

# Run the database and application containers
docker compose up --detach --wait
```

# Additional Context

- Closes https://github.com/zitadel/DevOps/issues/111
- Depends on https://github.com/zitadel/typescript/pull/412
- Contributes to road map item
https://github.com/zitadel/zitadel/issues/9481
2025-04-29 14:12:34 +00:00
Ramon
d930a09cb0 fix: Improve Actions V2 Texts and reenable in settings (#9814)
# Which Problems Are Solved
This pr includes improved texts to make the usage of Actions V2 more
easy.
Since the removal of the Actions V2 Feature Flag we removed the code
that checks if it's enabled in the settings sidenav.

# How the Problems Are Solved
Added new texts to translations. Removed sidenav logic that checks for
Actions V2 Feature Flag

# Additional Context

- Part of #7248 
- Part of #9688

---------

Co-authored-by: Max Peintner <peintnerm@gmail.com>
Co-authored-by: Max Peintner <max@caos.ch>
2025-04-29 11:25:49 +00:00
David Skewis
ce823c9176 fix: update session recordings for posthog (#9775)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

- Updates to only capture 10% of events with posthog

# How the Problems Are Solved

- Uses a feature flag rolled out to 10% of users to enable the capture

# Additional Changes

N/A

# Additional Context

N/A
2025-04-29 09:42:49 +00:00
Silvan
ed4e226da9 fix(defaults): comment default SystemAPIUsers (#9813)
# Which Problems Are Solved

If I start a fresh instance and do not overwrite `SystemAPIUsers` I get
an error during startup `error="decoding failed due to the following
error(s):\n\n'SystemAPIUsers[0][path]' expected a map, got
'string'\n'SystemAPIUsers[0][memberships]' expected a map, got 'slice'"`

# How the Problems Are Solved

the configuration is commented so that the example is still there

# Additional Changes

-

# Additional Context

was added in https://github.com/zitadel/zitadel/pull/9757
2025-04-29 11:12:43 +02:00
Max Peintner
d8d3a032ec changelog 2025-04-29 10:22:48 +02:00
Max Peintner
93b6f9a4a2 Version packages 1.2.0 2025-04-29 10:09:57 +02:00
Max Peintner
22c1a73245 Merge pull request #442 from zitadel/revert-9692297
Revert CJS
2025-04-29 09:56:39 +02:00
Max Peintner
62ad3888ee version 2025-04-29 09:49:13 +02:00
Max Peintner
d4bb9a5331 Revert "Merge pull request #398 from tafaust/feat/395-add-cjs-support"
This reverts commit 9692297706, reversing
changes made to 830c2795e9.
2025-04-29 09:45:06 +02:00
Max Peintner
9692297706 Merge pull request #398 from tafaust/feat/395-add-cjs-support
feat(zitadel-proto): add CJS and ESM support; export in Zitadel api s…
2025-04-29 09:30:09 +02:00
Max Peintner
6eb72c9a97 use main 2025-04-29 09:20:33 +02:00
intelli-joe
205beb607b fix: update link to postgres-insecure example in docs (#9802)
Fix reference to postgres-insecure example in docs
2025-04-28 13:22:04 +00:00
Max Peintner
e2718483cc device page, code form 2025-04-28 14:57:08 +02:00
Max Peintner
87b2148c5d i18n 2025-04-28 12:57:37 +02:00
Allen Oyieke
a9dd78a132 docs: fix typo in Java SDK example document (#9804)
# Which Problems Are Solved
This PR resolves the issue #9648 

# How the Problems Are Solved
Resolves a typo in the documentation


# Additional Context

- Closes  #9648 
- Discussion  #9648
2025-04-28 09:53:31 +00:00
Stefan Benz
b8ba7bd5ba fix: remove action feature flag and include execution (#9727)
# Which Problems Are Solved

Actions v2 is not a feature flag anymore, include functionality on
executions is not used and json tags of proto messages are handled
incorrectly.

# How the Problems Are Solved

- Remove actions from the feature flags on system and instance level
- Remove include type on executions, only in the API, later maybe in the
handling logic as well
- Use protojson in request and response handling of actions v2

# Additional Changes

- Correct integration tests for request and response handling
- Use json.RawMessage for events, so that the event payload is not
base64 encoded
- Added separate context for async webhook calls, that executions are
not cancelled when called async

# Additional Context

Related to #9759 
Closes #9710

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-04-28 11:24:50 +02:00