593 Commits

Author SHA1 Message Date
Kenta Yamaguchi
b2bf3cccae chore(i18n): add IAM_LOGIN_CLIENT (#9681)
# Which Problems Are Solved

The i18n element `IAM_LOGIN_CLIENT` is missing a translation.

# How the Problems Are Solved

Added translations for `IAM_LOGIN_CLIENT` in each language.

Please note that the translations were generated using Copilot, so they
may not be entirely accurate (I'm only confident that they are correct
for English and Japanese). I appreciate any corrections or improvements.

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>

(cherry picked from commit 3b8a2ab811)
2025-04-17 07:51:00 +02:00
Trong Huu Nguyen
a0c847aa10 fix(console): correct count for users list, show create timestamp in user details (#9705)
This pull request fixes a couple of minor issues with the user list and
details pages in Console.

# Which Problems Are Solved

1. The total count in the users list was the total number of results
returned. This made the pagination not work when there were more than
`pageSize * 2` users.
2. The user details page did not show the created timestamp when viewing
a
user.

# How the Problems Are Solved

1. The response includes the total number calculated by the backend. Use
that instead.
2. Inverse the ternary returning the creation date.

# Additional Changes

None

# Additional Context

None

---------

Co-authored-by: Thomas Krampl <thomas.siegfried.krampl@nav.no>
(cherry picked from commit bb59192e3e)
2025-04-17 07:51:00 +02:00
Ramon
4c90e78b19 fix: update console deps (#9628)
# Which Problems Are Solved
Closes most of the dependabot alerts

# How the Problems Are Solved
Updating Versions as much as possible. Angular upgrade was left out on
purpose.

# Additional Changes
Some refactoring of unused code, which I stumbled upon looking at our
used deps.

(cherry picked from commit b04babb4ef)
2025-03-28 07:40:40 +01:00
Livio Spring
7f954afab7 fix(console): pass verification code for phone verification (#9616)
# Which Problems Are Solved

While testing totally unrelated issues, I noticed that the phone
verification in Console didn't work anymore.

# How the Problems Are Solved

Pass the verification `code` entered by the user to the API.

# Additional Changes

None

# Additional Context

probably relates to https://github.com/zitadel/zitadel/pull/9312

(cherry picked from commit 54e513f312)
2025-03-28 07:40:16 +01:00
Ramon
d869e21939 fix: allow native applications to use https:// on loopback redirect addresses (#9073)
# Which Problems Are Solved

- The current validation for native redirect URIs does not allow HTTPS
loopback addresses.

# How the Problems Are Solved

- Enhanced the validation logic to permit HTTPS loopback addresses,
ensuring that developers can use these addresses without encountering
validation errors.
- Updated zitadel/oidc to latest version

# Additional Context

- Closes #4091
- This pr need to be closed first in our OIDC lib:
https://github.com/zitadel/oidc/pull/691

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>

(cherry picked from commit 8b1b9cbb98)
2025-03-28 07:40:00 +01:00
Livio Spring
9277e2b706 fix(console): allow management of metadata of users of other organizations again (#9490)
# Which Problems Are Solved

With the recent change in Console to use the User V2 API
(https://github.com/zitadel/zitadel/pull/9312), some functionality still
needs to call the management API, which requires the organization
context. The context was not passed anymore, leading to error in cases
where the calling user (e.g. an IAM_OWNER) was not part of the same
organization.

# How the Problems Are Solved

Added an interceptor to provide the `x-zitadel-orgid` header for the new
management client.

# Additional Changes

None

# Additional Context

- closes #9488

(cherry picked from commit 61c4b1c3fd)
2025-03-17 17:39:38 +01:00
Ramon
b0f70626c8 fix: load metadata using user service (#9429)
# Which Problems Are Solved
- #9382 "When I log in and get to my user profile page, I get an empty
error message at the top:"

# How the Problems Are Solved
load metadata using user service

# Additional Changes
- The roles observable returns an empty array instead of never emiting
- Small refactorings in app.component.ts because at first I thought the
errors stems from there.
- Added withLatestFromSynchronousFix RXJS operator because
withLatestFrom has confusing behavior when used in synchronous contexts.
Why this operator is needed is described here:
https://github.com/ReactiveX/rxjs/issues/7068

# Additional Context
- Closes #9382
2025-03-03 09:24:55 +01:00
Ramon
83614562a2 fix: Create Human V1 (#9425)
# Which Problems Are Solved
- Correctly load Avatar on first load

# How the Problems Are Solved
- The Avatar issue was mostly due to how we resolved the current user, I
changed this behaviour

# Additional Changes
- Removed V2 create human code till seperate page is finished
- Remove Console Use V2 API feature flag from features page (till new
page is added)

# Additional Context
- Partially fixes #9382
- This will get implemented next week
https://github.com/zitadel/zitadel/issues/9382#issuecomment-2681347477
2025-02-27 09:31:48 +01:00
Kenta Yamaguchi
3c471944c2 chore(i18n): add ORG_USER_SELF_MANAGER (#9392)
# Which Problems Are Solved

The i18n element `ORG_USER_SELF_MANAGER` is missing a translation.

# How the Problems Are Solved

Added translations for `ORG_USER_SELF_MANAGER` in each language.

Please note that the translations were generated using Copilot, so they
may not be entirely accurate (I'm only confident that they are correct
for English and Japanese). I appreciate any corrections or improvements.

Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-02-27 06:50:40 +00:00
Kenta Yamaguchi
696b00e329 chore(i18n): add ORG_SETTINGS_MANAGER (#9393)
# Which Problems Are Solved

The i18n element `ORG_SETTINGS_MANAGER` is missing a translation.

# How the Problems Are Solved

Added translations for `ORG_SETTINGS_MANAGER` in each language.

Please note that the translations were generated using Copilot, so they
may not be entirely accurate (I'm only confident that they are correct
for English and Japanese). I appreciate any corrections or improvements.
2025-02-27 06:26:53 +00:00
Livio Spring
8f88c4cf5b feat: add PKCE option to generic OAuth2 / OIDC identity providers (#9373)
# Which Problems Are Solved

Some OAuth2 and OIDC providers require the use of PKCE for all their
clients. While ZITADEL already recommended the same for its clients, it
did not yet support the option on the IdP configuration.

# How the Problems Are Solved

- A new boolean `use_pkce` is added to the add/update generic OAuth/OIDC
endpoints.
- A new checkbox is added to the generic OAuth and OIDC provider
templates.
- The `rp.WithPKCE` option is added to the provider if the use of PKCE
has been set.
- The `rp.WithCodeChallenge` and `rp.WithCodeVerifier` options are added
to the OIDC/Auth BeginAuth and CodeExchange function.
- Store verifier or any other persistent argument in the intent or auth
request.
- Create corresponding session object before creating the intent, to be
able to store the information.
- (refactored session structs to use a constructor for unified creation
and better overview of actual usage)

Here's a screenshot showing the URI including the PKCE params:


![use_pkce_in_url](https://github.com/zitadel/zitadel/assets/30386061/eaeab123-a5da-4826-b001-2ae9efa35169)

# Additional Changes

None.

# Additional Context

- Closes #6449
- This PR replaces the existing PR (#8228) of @doncicuto. The base he
did was cherry picked. Thank you very much for that!

---------

Co-authored-by: Miguel Cabrerizo <doncicuto@gmail.com>
Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
2025-02-26 12:20:47 +00:00
Ramon
70234289cf fix: v2 user console errors (#9386)
# Which Problems Are Solved

- Fixed filtering in overview
- Only get users from current organization
- Use V2 api to get auth user

# How the Problems Are Solved

Added the organization filter to the List queries
Get current User ID from ID Token to get auth user by id

# Additional Changes

Refactored the UserList

# Additional Context
- Closes #9382
2025-02-21 14:57:09 +01:00
Kenta Yamaguchi
9b35b98cae fix(i18n): add some missing elements in Japanese (#9353)
# Which Problems Are Solved

Some i18n elements are not translated in Japanese yet.

# How the Problems Are Solved

Add some missing i18n elements to `console/src/assets/i18n/ja.json`,
`internal/api/ui/login/static/i18n/ja.yaml`, and
`internal/static/i18n/ja.yaml`.

More details are following:
- `console/src/assets/i18n/ja.json`
  - `POLICY.PRIVATELABELING.BACKGROUNDCOLOR`
  - `POLICY.PRIVATELABELING.PRIMARYCOLOR`
  - `POLICY.PRIVATELABELING.WARNCOLOR`
  - `POLICY.PRIVATELABELING.FONTCOLOR`
  - `POLICY.LOGIN_TEXTS.MESSAGE_TEXTS.TYPES.IU`
  - `IDP.CREATE.APPLE.TITLE`
  - `IDP.CREATE.APPLE.DESCRIPTION`
  - `IDP.CREATE.SAML.TITLE`
  - `IDP.CREATE.SAML.DESCRIPTION`
  - `IDP.APPLE.TEAMID`
  - `IDP.APPLE.KEYID`
  - `IDP.APPLE.PRIVATEKEY`
  - `IDP.APPLE.UPDATEPRIVATEKEY`
  - `IDP.APPLE.UPLOADPRIVATEKEY`
  - `IDP.KEYMAXSIZEEXCEEDED`
  - `IDP.SAML.METADATAXML`
  - `IDP.SAML.METADATAURL`
  - `IDP.SAML.BIDNING`
  - `IDP.SAML.SIGNEDREQUEST`
  - `IDP.SAML.NAMEIDFORMAT`
  - `IDP.SAML.TRANSIENTMAPPINGATTRIBUTENAME`
  - `IDP.SAML.TRANSIENTMAPPINGATTRIBUTENAME_DESC`
  - `SMTP.LIST.DIALOG.TEST_TITLE`
  - `SMTP.LIST.DIALOG.TEST_DESCRIPTION`
  - `SMTP.LIST.DIALOG.TEST_EMAIL`
  - `SMTP.LIST.DIALOG.TEST_RESULT`
- `internal/api/ui/login/static/i18n/ja.yaml`
  - `LDAP.Title`
  - `LDAP.Description`
  - `LDAP.LoginNameLabel`
  - `LDAP.PasswordLabel`
  - `LDAP.NextButtonText`
  - `PasswordChange.Footer`
  - `Footer.SupportEmail`
  - `Errors.User.AlreadyExists`
  - `Errors.User.Profile.NotFound`
  - `Errors.User.Profile.NotChanged`
  - `Errors.User.Profile.Empty`
  - `Errors.User.Profile.FirstNameEmpty`
  - `Errors.User.Profile.LastNameEmpty`
  - `Errors.User.Profile.IDMissing`
  - `Errors.User.Email.NotFound`
  - `Errors.User.Email.Invalid`
  - `Errors.User.Email.AlreadyVerified`
  - `Errors.User.Email.NotChanged`
  - `Errors.User.Email.Empty`
  - `Errors.User.Email.IDMissing`
  - `Errors.User.Phone.NotFound`
  - `Errors.User.Phone.Invalid`
  - `Errors.User.Phone.AlreadyVerified`
  - `Errors.User.Phone.Empty`
  - `Errors.User.Phone.NotChanged`
  - `Errors.User.Address.NotFound`
  - `Errors.User.Address.NotChanged`
  - `Errors.User.Username.AlreadyExists`
  - `Errors.User.Username.Reserved`
  - `Errors.User.Username.Empty`
  - `Errors.Org.LoginPolicy.RegistrationNotAllowed`
- `internal/static/i18n/ja.yaml`
  - `Errors.SMSConfig.NotExternalVerification`
  - `Errors.User.Profile.Empty`
  - `Errors.User.Profile.FirstNameEmpty`
  - `Errors.User.Profile.LastNameEmpty`
  - `Errors.User.Email.Empty`
  - `Errors.User.Email.IDMissing`
  - `Errors.User.Phone.Empty`
  - `Errors.User.Phone.NotChanged`
  - `Errors.User.Username.Empty`
  - `Errors.Org.LabelPolicy.NotFound`
  - `Errors.Org.LabelPolicy.NotChanged`
  - `EventTypes.project.application.oidc.key.added`
  - `EventTypes.project.application.oidc.key.removed`

# Additional Changes

- Change some order of the elements in `internal/static/i18n/ja.yaml`
  - `EventTypes.user.human.password.change.sent`
  - `EventTypes.user.human.password.hash.updated`
- Remove an element which is not used in the `us.yaml` from
`internal/static/i18n/ja.yaml`
  - `EventTypes.user.phone.removed`
- Correct a translation in `internal/static/i18n/ja.yaml`
  - `EventTypes.user.human.password.change.sent`
2025-02-19 12:51:53 +00:00
Ramon
3042bbb993 feat: Use V2 API's in Console (#9312)
# Which Problems Are Solved
Solves #8976

# Additional Changes
I have done some intensive refactorings and we are using the new
@zitadel/client package for GRPC access.

# Additional Context
- Closes #8976

---------

Co-authored-by: Max Peintner <peintnerm@gmail.com>
2025-02-17 19:25:46 +01:00
David Skewis
4498f9c8f3 feat: Posthog integration (#9077)
# Which Problems Are Solved

- Adds a service in the console to enable Posthog integration based on
upon user environment variables

# How the Problems Are Solved

- A new service has been created in console for posthog
- This is only initiated based upon provided environment variables

# Additional Changes

N/A

# Additional Context

- Closes #[9076](https://github.com/zitadel/zitadel/issues/9076)
- Cannot be merged until this is completed
#[9070](https://github.com/zitadel/zitadel/issues/9070)
2025-01-30 07:57:51 +01:00
Livio Spring
50d2b26a28 feat: specify login UI version on instance and apps (#9071)
# Which Problems Are Solved

To be able to migrate or test the new login UI, admins might want to
(temporarily) switch individual apps.
At a later point admin might want to make sure all applications use the
new login UI.

# How the Problems Are Solved

- Added a feature flag `` on instance level to require all apps to use
the new login and provide an optional base url.
- if the flag is enabled, all (OIDC) applications will automatically use
the v2 login.
  - if disabled, applications can decide based on their configuration
- Added an option on OIDC apps to use the new login UI and an optional
base url.
- Removed the requirement to use `x-zitadel-login-client` to be
redirected to the login V2 and retrieve created authrequest and link
them to SSO sessions.
- Added a new "IAM_LOGIN_CLIENT" role to allow management of users,
sessions, grants and more without `x-zitadel-login-client`.

# Additional Changes

None

# Additional Context

closes https://github.com/zitadel/zitadel/issues/8702
2024-12-19 10:37:46 +01:00
Fabi
26e936aec3 fix: miss-leading labels in the console (#8972)
# Which Problems Are Solved

On the login settings we do have the settings "Force MFA" and "Force MFA
for local authenticated users" this gives the impression, that i can
enable both and then all users should be forced to use an mfa.
But when both settings are enabled, only local users are forced to add
mfa.

# How the Problems Are Solved

The label was wrong, the second one should be "Force MFA for local
authneticated users only", I changed both labels to make it easier to
understand.
2024-12-02 16:52:55 +00:00
Kim JeongHyeon
c0a93944c3 feat(i18n): add korean language support (#8879)
Hello everyone,

To support Korean-speaking users who may experience challenges in using
this excellent tool due to language barriers, I have added Korean
language support with the help of ChatGPT.

I hope that this contribution allows ZITADEL to be more useful and
accessible to Korean-speaking users.

Thank you.

---

안녕하세요 여러분, 언어의 어려움으로 이 훌륭한 도구를 활용하는데 곤란함을 겪는 한국어 사용자들을 위하여 ChatGPT의 도움을
받아 한국어 지원을 추가하였습니다.

이 기여를 통해 ZITADEL이 한국어 사용자들에게 유용하게 활용되었으면 좋겠습니다.

감사합니다.

Co-authored-by: Max Peintner <max@caos.ch>
2024-12-02 13:11:31 +00:00
Luka Waymouth
33bff5a4b0 fix(console): bug fixes for ListProjectRoles and general pagination (#8938)
# Which Problems Are Solved

A number of small problems are fixed relating to the project roles
listed in various places in the UI:
- Fixes issue #8460
- Fixes an issue where the "Master checkbox" that's supposed to check
and uncheck all list items breaks when there's multiple pages of
results. Demonstration images are attached at the end of the PR.
- Fixes an issue where the "Edit Role" dialog opened by clicking on a
role in the list will not save any changes if the role's group is empty
even though empty groups are allowed during creation.
- Fixes issues where the list does not properly update after the user
modifies or deletes some of its entries.
- Fixes an issue for all paginated lists where the page number
information (like "0-25" specifying that items 0 through 25 are shown on
screen) was inaccurate, as described in #8460.


# How the Problems Are Solved

- Fixes buggy handling of pre-selected roles while editing a grant so
that all selected roles are saved instead of only the ones on the
current page.
- Triggers the entire page to be reloaded when a user modifies or
deletes a role to easily ensure the information on the screen is
accurate.
- Revises checkbox logic so that the "Master checkbox" will apply only
to rows on the current page. I think this is the correct behavior but
tell me if it should be changed.
- Other fixes to faulty logic.


# Additional Changes

- I made clicking on a group name toggle all the rows in that group on
the screen, instead of just turning them on. Tell me if this should be
changed back to what it was before.

# Additional Context

- Closes #8460

## An example of the broken checkboxes:


![2024-11-20_03-11-1732091377](https://github.com/user-attachments/assets/9f01f529-aac9-4669-92df-2abbe67e4983)

![2024-11-20_03-11-1732091365](https://github.com/user-attachments/assets/e7b8bed6-5cef-4c9f-9ecf-45ed41640dc6)

![2024-11-20_03-11-1732091357](https://github.com/user-attachments/assets/d404bc78-68fd-472d-b450-6578658f48ab)

![2024-11-20_03-11-1732091348](https://github.com/user-attachments/assets/a5976816-802b-4eab-bc61-58babc0b68f7)

---------

Co-authored-by: Max Peintner <max@caos.ch>
2024-11-26 09:00:21 +00:00
Mostafa Galal
4eeb2be36a fix: Negative values allowed by spinners of Login Lifetimes inputs (#8694)
Some checks are pending
ZITADEL CI/CD / core (push) Waiting to run
ZITADEL CI/CD / console (push) Waiting to run
ZITADEL CI/CD / version (push) Waiting to run
ZITADEL CI/CD / compile (push) Blocked by required conditions
ZITADEL CI/CD / core-unit-test (push) Blocked by required conditions
ZITADEL CI/CD / core-integration-test (push) Blocked by required conditions
ZITADEL CI/CD / lint (push) Blocked by required conditions
ZITADEL CI/CD / container (push) Blocked by required conditions
ZITADEL CI/CD / e2e (push) Blocked by required conditions
ZITADEL CI/CD / release (push) Blocked by required conditions
Code Scanning / CodeQL-Build (go) (push) Waiting to run
Code Scanning / CodeQL-Build (javascript) (push) Waiting to run
# Which Problems Are Solved

Previously, the login lifetime input fields allowed negative values and,
in some cases, zero values, which were not valid according to the
business rules.

# How the Problems Are Solved

The issue was resolved by adding min and step properties to the relevant
HTML input fields. This ensures that only valid values are entered,
adhering to the specific requirements for each field.

Co-authored-by: Max Peintner <max@caos.ch>
2024-10-25 10:44:15 +02:00
Mark Stosberg
70449caafb docs: standardize multi-factor spelling and related string updates (#8752)
Some checks are pending
Code Scanning / CodeQL-Build (javascript) (push) Waiting to run
ZITADEL CI/CD / core (push) Waiting to run
ZITADEL CI/CD / console (push) Waiting to run
ZITADEL CI/CD / version (push) Waiting to run
ZITADEL CI/CD / compile (push) Blocked by required conditions
ZITADEL CI/CD / core-unit-test (push) Blocked by required conditions
ZITADEL CI/CD / core-integration-test (push) Blocked by required conditions
ZITADEL CI/CD / lint (push) Blocked by required conditions
ZITADEL CI/CD / container (push) Blocked by required conditions
ZITADEL CI/CD / e2e (push) Blocked by required conditions
ZITADEL CI/CD / release (push) Blocked by required conditions
Code Scanning / CodeQL-Build (go) (push) Waiting to run
- **docs: s/Secondfactor/Second factor/**
- **docs: s/IDP/IdP/**
- **docs: s/Hardwaretokens/Hardware tokens/**
- **docs: standardize multi-factor vs multi factor vs multifactor**

# Which Problems Are Solved

 - English strings are improved

# How the Problems Are Solved

 - With better strings

---------

Co-authored-by: Fabi <fabienne@zitadel.com>
2024-10-22 14:59:16 +00:00
TrueQAP
c455b8b1eb feat(i18n): Add Hungarian language support to ZITADEL (#8645)
- Fully translated all UI elements, documentation, and error messages
- Added Hungarian as a new supported language option
- Updated language selection menus and related configuration files
- Ensured consistency across all translated content

# Which Problems Are Solved

- ZITADEL was not accessible for Hungarian-speaking users due to lack of
language support
- Hungarian users had to rely on English or other languages to use the
platform
- Potential user base was limited due to language barrier

# How the Problems Are Solved

- Translated all user interface elements, including console and login
interfaces
- Translated all documentation files to Hungarian
- Added Hungarian translations for all error messages and notifications
- Implemented Hungarian as a selectable language option in the system

# Additional Changes

- Updated language selection menus to include Hungarian
- Modified configuration files to support Hungarian language
- Ensured consistent terminology and style across all translated content
- Added Hungarian language option to relevant dropdown menus and
settings

# Additional Context

- Relates to the ongoing internationalization efforts of ZITADEL
- Enhances accessibility for Hungarian-speaking developers and users
- Expands ZITADEL's potential user base in Hungary and
Hungarian-speaking regions

---------

Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
2024-10-11 09:00:50 +00:00
Elio Bischof
464ca0bd00 fix: always create SAML with metadata (#8696)
# Which Problems Are Solved

Adding a SAML IDPs with an empty metadata XML and URL leads to failed
projection events. The main IDP template projection succeeds, but the
subtable projection for SAML template fails, because the metadata field
is not nullable in that table. The SAML IDP shows up in list queries,
because the list method only queries the main template projection.
However, getting a SAML IDP created without metadata by ID misses the
SAML specific IDP data.

# How the Problems Are Solved

- The command for adding a SAML IDP properly ensures that non-empty
metadata is either given by XML or resolved by URL.
- The console doesn't send requests with empty metadata anymore. This
works by explicitly setting a single oneof option for either XML or URL
and emptying the other one.

# Additional Context

Closes #8443
2024-10-11 08:09:51 +00:00
Livio Spring
14e2aba1bc feat: Add Twilio Verification Service (#8678)
# Which Problems Are Solved
Twilio supports a robust, multi-channel verification service that
notably supports multi-region SMS sender numbers required for our use
case. Currently, Zitadel does much of the work of the Twilio Verify (eg.
localization, code generation, messaging) but doesn't support the pool
of sender numbers that Twilio Verify does.

# How the Problems Are Solved
To support this API, we need to be able to store the Twilio Service ID
and send that in a verification request where appropriate: phone number
verification and SMS 2FA code paths.

This PR does the following: 
- Adds the ability to use Twilio Verify of standard messaging through
Twilio
- Adds support for international numbers and more reliable verification
messages sent from multiple numbers
- Adds a new Twilio configuration option to support Twilio Verify in the
admin console
- Sends verification SMS messages through Twilio Verify
- Implements Twilio Verification Checks for codes generated through the
same

# Additional Changes

# Additional Context
- base was implemented by @zhirschtritt in
https://github.com/zitadel/zitadel/pull/8268 ❤️
- closes https://github.com/zitadel/zitadel/issues/8581

---------

Co-authored-by: Zachary Hirschtritt <zachary.hirschtritt@klaviyo.com>
Co-authored-by: Joey Biscoglia <joey.biscoglia@klaviyo.com>
2024-09-26 09:14:33 +02:00
Livio Spring
ca1914e235 fix: user grants deactivation (#8634)
# Which Problems Are Solved

ZITADEL's user grants deactivation mechanism did not work correctly.
Deactivated user grants were still provided in token, which could lead
to unauthorized access to applications and resources.
Additionally, the management and auth API always returned the state as
active or did not provide any information about the state.

# How the Problems Are Solved

- Correctly check the user grant state on active for tokens and user
information (userinfo, introspection, saml attributes)
- Map state in API and display in Console
2024-09-17 12:18:29 +00:00
Stefan Benz
289378713e fix: smtp provider (#8610)
There were some problems after changing from SMTP providers to email
providers (https://github.com/zitadel/zitadel/pull/8545):
- panic (nil pointer) on SMTP provider retrieval for HTTP configs
- old SMTP configuration created before the multi SMTP configurations
(without id)
  - were not projected / listed
  - could not be always be activated
- Console treated HTTP configs as SMTP

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2024-09-13 13:22:25 +00:00
Max Peintner
f6da528296 fix(console): dynamic documentation button (#8596)
This PR makes the documenation dynamic according to the external links
2024-09-11 12:55:19 +00:00
Stygmates
05af47b9ab feat(console): Display seconds and milliseconds in the tooltip of the user audit log (#8495)
# Which Problems Are Solved

The exact timestamp including the seconds and milliseconds in the user
audit log is not shown, either in the direct log or in the tooltip that
appears when hovering over the item.


![353743484-e9f18fa8-4691-4e8f-a0c9-e223e2c48ffe](https://github.com/user-attachments/assets/aaeff804-62a6-435d-a15d-e0d05106e6b5)


# How the Problems Are Solved

The exact timestamp is added to the tooltip that appears when hovering
over the item.


![image](https://github.com/user-attachments/assets/d1052d85-1558-45f4-9d7f-49340acc684e)

# Additional Changes

None

# Additional Context
- Closes #8371

---------

Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Fabi <fabienne@zitadel.com>
2024-09-11 11:52:44 +00:00
Livio Spring
a07b2f4677 feat: invite user link (#8578)
# Which Problems Are Solved

As an administrator I want to be able to invite users to my application
with the API V2, some user data I will already prefil, the user should
add the authentication method themself (password, passkey, sso).

# How the Problems Are Solved

- A user can now be created with a email explicitly set to false.
- If a user has no verified email and no authentication method, an
`InviteCode` can be created through the User V2 API.
  - the code can be returned or sent through email
- additionally `URLTemplate` and an `ApplicatioName` can provided for
the email
- The code can be resent and verified through the User V2 API
- The V1 login allows users to verify and resend the code and set a
password (analog user initialization)
- The message text for the user invitation can be customized

# Additional Changes

- `verifyUserPasskeyCode` directly uses `crypto.VerifyCode` (instead of
`verifyEncryptedCode`)
- `verifyEncryptedCode` is removed (unnecessarily queried for the code
generator)

# Additional Context

- closes #8310
- TODO: login V2 will have to implement invite flow:
https://github.com/zitadel/typescript/issues/166
2024-09-11 10:53:55 +00:00
Mark Stosberg
762efd0a20 docs: some English spelling and grammar fixes (#8592)
- English typo and grammar fixes.

Co-authored-by: Fabi <fabienne@zitadel.com>
2024-09-11 06:51:01 +00:00
Livio Spring
382a97c30f feat(oidc): end session by id_token_hint and without cookie (#8542)
# Which Problems Are Solved

The end_session_endpoint currently always requires the userAgent cookie
to be able to terminate session created through the hosted login UI.
Only tokens issued through the Login V2 can be used to directly
terminate a specific session and without the need of a cookie.
This PR adds the possibility to terminate a single V1 session or all V1
sessions belonging to the same user agent without the need of the
userAgent cookie by providing an id_token as `id_token_hint` which
contains the id of a V1 session as `sid`.

# How the Problems Are Solved

- #8525 added the `sid` claim for id_tokens issued through the login UI
- The `sid` can now be checked for the `V1_` prefix and queries for
either the userAgentID and depending on the
`OIDCSingleV1SessionTermination` flag all userIDs of active session from
the same user agent id
- The `OIDCSingleV1SessionTermination` flag is added with default value
false to keep the existing behavior of terminating all sessions even in
case of providing an id_token_hint

# Additional Changes

- pass `context.Context` into session view functions for querying the
database with that context

# Additional Context

- relates to #8499 
- closes #8501
2024-09-04 10:14:50 +00:00
Stygmates
d47ce93025 fix(console): Verify if the LDAP IDP has just been created (#8496)
# Which Problems Are Solved

After the creation of an LDAP IDP on instance or org level, the button
changes to 'Save' and with each click a new IDP will be created.

# How the Problems Are Solved

Similar to what was done in #7572, we check if the IDP was just created

# Additional Changes

None

# Additional Context

- Closes #8444
- Follow-up for PR #7572

Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Livio Spring <livio.a@gmail.com>
2024-09-04 05:52:42 +00:00
Eko Eryanto
889201568d feat: add indonesia translation (#8459)
Co-authored-by: Livio Spring <livio.a@gmail.com>
2024-09-03 16:05:47 +00:00
Livio Spring
ca8f82423a fix: automatically link user without prompt (#8487)
# Which Problems Are Solved

There were UX issue with the autolinking prompt page and users were not
able to link their account or would not understand what to do. Since the
trust to the IdP is already bound by the configuration, the user can
directly be linked without any user input.

# How the Problems Are Solved

- remove the prompt page and directly link the user if possible
- remove corresponding customization texts from the API and Console

# Additional Changes

None

# Additional Context

- relates to https://github.com/zitadel/zitadel/issues/7977
- discussed with customers
- created as a `fix` to be able to backport

---------

Co-authored-by: Max Peintner <max@caos.ch>
2024-08-28 05:33:20 +00:00
Max Peintner
5faaf87b22 fix(console): change external links dynamically (#8423)
This PR fixes a problem, where the external links were not replaced
dynamically on an org change.
2024-08-26 08:07:23 +00:00
Elio Bischof
fdf0434133 fix(console): remove navigation flakiness (#8439)
# Which Problems Are Solved

The navigation in the console default settings is flaky. Sometimes it
arbitrarily jumps to the organizations page.

# How the Problems Are Solved

The lifecycle hooks were extended to react differently to changes that
come from 'outside' and from the component itself.

# Additional Changes

The e2e tests are supposed to run against Firefox and Chrome. However
they are run twice against Electon. Fixing this revealed the console
navigation flakiness that was less visible on Electron.

The following issues are also fixed with this PR to reduce flakiness in
e2e tests.

- The custom command in the pipeline is removed from the e2e action
step, so the browser argument is respected.
- The npm packages of the e2e tests are updated to their latest version.
- Notification tests run against a clean state now so they don't depend
on each other anymore. This resolved some flakiness and improved
debuggability of the tests.
- E2E page load timeout is increased, reducing flakiness.
- E2E tests wait on some elements to be enabled before they interact
with them, reducing flakiness.

# Additional Context

- Closes #8404 
- Follow-up: https://github.com/zitadel/zitadel/issues/8471

The e2e tests ran three times in a row successfully in the pipeline
against both browsers.

---------

Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Livio Spring <livio.a@gmail.com>
Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
2024-08-22 09:48:36 +02:00
Livio Spring
11d01b9b35 fix(console): allow user filtering with read permission (#8152)
# Which Problems Are Solved

The filter option was not displayed on the user list page for users who
only have `user.read` permission, e.g. an IAM_OWNER_VIEWER or
ORG_OWNER_VIEWER

# How the Problems Are Solved

- Filter is correctly displayed.

# Additional Changes

None.

# Additional Context

- noticed by a customer
- needs backports
2024-08-15 22:08:52 +00:00
Livio Spring
e2e1100124 feat(idp): provide auto only options (#8420)
# Which Problems Are Solved

As of now, **automatic creation** and **automatic linking options** were
only considered if the corresponding **allowed option** (account
creation / linking allowed) was enabled.

With this PR, this is no longer needed and allows administrators to
address cases, where only an **automatic creation** is allowed, but
users themselves should not be allowed to **manually** create new
accounts using an identity provider or edit the information during the
process.
Also, allowing users to only link to the proposed existing account is
now possible with an enabled **automatic linking option**, while
disabling **account linking allowed**.

# How the Problems Are Solved

- Check for **automatic** options without the corresponding **allowed**
option.
- added technical advisory to notify about the possible behavior change

# Additional Changes

- display the error message on the IdP linking step in the login UI (in
case there is one)
- display an error in case no option is possible
- exchanged deprecated `eventstoreExpect` with `expectEventstore` in
touched test files

# Additional Context

closes https://github.com/zitadel/zitadel/issues/7393

---------

Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
2024-08-14 13:04:26 +00:00
Livio Spring
189505c80f fix: sanitize output for email (#8373)
# Which Problems Are Solved

ZITADEL uses HTML for emails and renders certain information such as
usernames dynamically. That information can be entered by users or
administrators. Due to a missing output sanitization, these emails could
include malicious code.
This may potentially lead to a threat where an attacker, without
privileges, could send out altered notifications that are part of the
registration processes. An attacker could create a malicious link, where
the injected code would be rendered as part of the email.

During investigation of this issue a related issue was found and
mitigated, where on the user's detail page the username was not
sanitized and would also render HTML, giving an attacker the same
vulnerability.

While it was possible to inject HTML including javascript, the execution
of such scripts would be prevented by most email clients and the Content
Security Policy in Console UI.

# How the Problems Are Solved

- All arguments used for email are sanitized (`html.EscapeString`)
- The email text no longer `html.UnescapeString` (HTML in custom text is
still possible)
- Console no longer uses `[innerHtml]` to render the username

# Additional Changes

None

# Additional Context

- raised via email

---------

Co-authored-by: peintnermax <max@caos.ch>
2024-07-31 14:21:10 +02:00
Max Peintner
918736c026 chore(console): upgrade dependencies (#8368)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-30 16:12:39 +02:00
Max Peintner
51210c8e34 fix(console): fill cachedorgs when read from local storage (#8363)
This fixes a problem where the org settings were hidden.
The console reads the context from either a query param or the local
storage. When one context was found, it executed a single request with
orgId filter. This let to a single org and then to a hidden org setting,
as we hide org settings for instances with a single result.
2024-07-30 11:38:20 +00:00
RedstonePfalz
57428a1281 fix: Fixed more spelling and grammar misstakes (#8359)
# Which Problems Are Solved

I fixed more spelling and grammar misstakes in the German language
files.

# Additional Context

- Follow-up for PR #8240

Co-authored-by: Fabi <fabienne@zitadel.com>
2024-07-26 11:33:01 +02:00
Livio Spring
8d13247413 revert: "feat(IDP): use single callback endpoint"
This reverts commit e126ccc9aa.

# Which Problems Are Solved

#8295 introduced the possibility to handle idps on a single callback,
but broke current setups.

# How the Problems Are Solved

- Revert the change until a proper solution is found. Revert is needed
as docs were also changed.

# Additional Changes

None.

# Additional Context

- relates to #8295
2024-07-24 12:29:05 +00:00
Elio Bischof
c3f8439a49 fix: vue logout url (#8353)
# Which Problems Are Solved

The default vue logout URL doesn't work with the @zitadel/vue defaults

# How the Problems Are Solved

A trailing slash is added to the default logout URL.

# Additional Context

Found while testing https://github.com/zitadel/zitadel-vue/pull/53
2024-07-24 11:03:02 +02:00
Max Peintner
215dbf0cf6 fix(console): reduce initial load time (#8273)
This reduces the initial payload of the `listMyProjectOrgs` to get the
active org by setting the limit of the initial orgs to 100.

Partial of #8272

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2024-07-22 14:18:26 +00:00
Miguel Cabrerizo
b3a60863f5 feat(console): replace secret generator dialogs with cards (#8307) 2024-07-18 05:33:10 +00:00
Livio Spring
e126ccc9aa feat(IDP): use single callback endpoint (#8295)
# Which Problems Are Solved

Both the login UI and the IdP intent flow have their own IdP callback
endpoints.

This makes configuration hard to impossible (e.g. Github only allows one
endpoint) for customers.

# How the Problems Are Solved

- The login UI prefixes the `state` parameter when creating an auth /
SAML request.
- All requests now use the `/idp/callback` or the corresponding
variation (e.g. SAML)
- On callback, the state, resp. its prefix is checked. In case of the
login UI prefix, the request will be forwarded to the existing login UI
handler without the prefix state.
Existing setups will therefore not be affected and also requests started
before this release can be handled without any impact.
- Console only lists the "new" endpoint(s). Any
`/login/externalidp/callback` is removed.

# Additional Changes

- Cleaned up some images  from the IdP documentation.
- fix the error handling in `handleExternalNotFoundOptionCheck`

# Additional Context

- closes #8236
2024-07-16 13:58:22 +00:00
Fabi
3d45c5dee5 fix: fix wrong translation (#8309)
# Which Problems Are Solved

In the console a wrong translation is shown for the password re auth
time, it is shown that it is the time after which users have to renew
their password, but it is the time, after which they have to
authenticate again with their password

# How the Problems Are Solved

Translations are changed in all languages

Co-authored-by: Livio Spring <livio.a@gmail.com>
2024-07-16 11:15:10 +00:00
Miguel Cabrerizo
832a55a78e feat(console): note about function names must match in action dialog (#8294)
# Which Problems Are Solved

- A note should be added to the ZITADEL management console showing that
the name and function in the javascript have to be the same

# How the Problems Are Solved

- A new cnsl-info-section is added to the create/update action dialog

# Additional Context

Here's a screenshot showing the note:

![Captura desde 2024-07-12
13-08-35](https://github.com/user-attachments/assets/62de5491-1895-4101-8bcf-1c8433661fd2)

- Closes #7874

Co-authored-by: Fabi <fabienne@zitadel.com>
2024-07-15 15:16:36 +00:00
Max Peintner
9d29098aa6 fix(console): identity provider title layout (#8302)
# Which Problems Are Solved

Fixes the alignment of the identity provider layouts

<img width="432" alt="Screenshot 2024-07-15 at 08 42 21"
src="https://github.com/user-attachments/assets/c45e4226-fc7e-4b5e-a25b-164bd31864c5">

# Context

- noted internally while implementing
https://github.com/zitadel/zitadel/pull/8295

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2024-07-15 11:25:59 +00:00