Commit Graph

1314 Commits

Author SHA1 Message Date
Livio Spring
3bc9a60986
fix: allow webauthn checks for users of other orgs (#6915) 2023-11-14 09:42:39 +00:00
Livio Spring
1344760369
fix: set samesite mode for CSRF cookie based on security policy (#6914) 2023-11-14 10:01:59 +01:00
Tim Möhlmann
081a0b4cb7
chore(deps): upgrade all go modules (#6895)
* chore(deps): upgrade all go modules

This change upgrades all go.mod dependecies. As well as Makefile tools.

There where some imports that still used the old and deprecated
`github.com/golang/protobuf/ptypes` package.
These have been moved to the equivelant
`google.golang.org/protobuf/types/known` package.

The `internal/proto` package is removed as was only used once.
With a simple refactor in the Validator it became completely obsolete.

* fix validate unit test

* cleanup merge

* update otel

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-11-13 10:41:29 +00:00
Livio Spring
0386fe7f96
fix: improve login_hint usage on IDPs (#6899)
* only set prompt if no login_hint is set

* update to current state and cleanup
2023-11-13 09:25:26 +01:00
Tim Möhlmann
42a2c0093d
fix: use x-zitadel-forwarded header (#6900)
fix: use x-zitadel-forward header
2023-11-10 15:02:53 +00:00
Ahmed Fwela
3f22fb3a5c
feat(user/v1): support composite queries (#6361)
* feat(user/v1): support composite queries

* fix: added proper error handling for NotQuery

* Added error when there are too many levels of nesting

* Add localization keys for english

* Update internal/api/grpc/user/query.go
2023-11-09 11:38:34 +01:00
Elio Bischof
e0a5f8661d
feat: improve UX for external configuration (#6861)
* docs: simplify traefik external tls

* remove pass host header

* docs: simplify and fix nginx external tls

* fix: readiness with enabled tls

* improve proxy docs

* improve proxy docs

* fix(ready): don't verify server cert

* complete nginx docs

* cleanup

* complete traefik docs

* add caddy docs

* simplify traefik

* standardize

* fix caddy

* add httpd docs

* improve external config docs

* guiding error message

* docs(defaults.yaml): remove misleading comments

* guiding error message cs and ru

* improve proxy testability

* fix compose up command

* improve commands

* fix nginx tls disabled

* fix nginx tls enabled

* fix: serve gateway when tls is enabled

* fmt caddy files

* fix caddy enabled tls

* remove not-working commands

* review

* fix checks

* fix link

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-11-09 11:30:15 +01:00
Livio Spring
22e2d55999
Merge pull request from GHSA-7h8m-vrxx-vr4m
* fix: handle locking policy correctly for multiple simultaneous password checks

* recheck events
2023-11-08 14:19:13 +01:00
sp132
9a708b1b78
feat: extend session search service (#6746)
* feat: extend session search service (#6029)

add two more searching criteria - human user id and session creation date

optional sorting by the session creation date

* fix: use correct column identifier

* fix: implement Col()

* chore: fix unit tests

* chore: fix linter warnings

---------

Co-authored-by: Fabi <fabienne@zitadel.com>
2023-11-08 11:32:13 +01:00
Alexei
9ccdfdc196
feat: Add translations for Russian (#6864)
* wip

* add Russian (autotranslate)
TODO: review translations

* fix console linting

* add russian language to login translations

* docs

* missing console translations

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-11-08 07:38:55 +00:00
petrmifek
e839f03f57
feat(i18n): Czech language support (#6870)
feat(i18n): Add Czech language support
2023-11-08 07:55:41 +01:00
Livio Spring
e342e3d99b
fix: prevent panic in loginNameInformation (#6876) 2023-11-07 11:16:49 +01:00
Tim Möhlmann
b3ff359fc1
fix(system-api): use distinct in intances filter query (#6867) 2023-11-07 06:12:16 +00:00
Livio Spring
f3b8a3aece
feat: add possibility to set an expiration to a session (#6851)
* add lifetime to session api

* extend session with lifetime

* check session token expiration

* fix typo

* integration test to check session token expiration

* integration test to check session token expiration

* i18n

* cleanup

* improve tests

* prevent negative lifetime

* fix error message

* fix lifetime check
2023-11-06 10:48:28 +01:00
Livio Spring
ce322323aa
perf(oidc): remove db call for discovery configuration (#6857) 2023-11-03 15:18:57 +00:00
Elio Bischof
1b6e3dcf27
fix: creation date argument in search events filters (#6855)
* fix: creation date filter in event queries

* fix: creation date with ordering filter

* simplify code

* simplify review

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-11-03 14:52:48 +00:00
Livio Spring
9378e19090
fix: payload (de)serialization of some events (#6858) 2023-11-03 11:02:17 +00:00
Stefan Benz
d874628f77
fix: use username with external idp linking (#6846)
Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-11-02 11:28:59 +00:00
Stefan Benz
f84eb19637
fix: change error message from metadata query User.NotFound to Metada… (#6830)
fix: change error message from metadata query User.NotFound to Metadata.NotFound

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-11-02 08:35:15 +00:00
Tim Möhlmann
0a1da1f02c
fix: reset custom texts to default (#6833)
* Revert "fix: add texts after template reset (#6237)"

This reverts commit d937ee3dda.

* fix: reset of custom text template

* add custom bulk limits from issue

https://github.com/zitadel/zitadel/issues/6766#issuecomment-1778721782
2023-10-27 17:43:13 +00:00
Silvan
f8bf8ea256
fix(eventstore): differentiate unique constraint error (#6832)
* fix(eventstore): differentiate unique constraint error format

* docs: add comment to eventstore vars

* fix(eventstore): return correct error type if unique constraint already exists
2023-10-27 14:10:01 +02:00
Elio Bischof
a4626f9bdb
fix: return unauthenticated code (#6819)
* fix: return unauthenticated code

* remove cfg.yaml

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-10-27 06:09:07 +00:00
Silvan
0187487f26
chore: correct tracing of trigger function (#6825)
* chore: correct tracing of trigger function

* refactor: remove import
2023-10-26 17:07:56 +02:00
Stefan Benz
0dec125e6b
fix: list mapping of saml provider configuration type (#6815)
Co-authored-by: Max Peintner <max@caos.ch>
2023-10-26 10:06:37 +00:00
Stefan Benz
cb7b50b513
feat: add attribute to only enable specific themes (#6798)
* feat: enable only specific themes in label policy

* feat: enable only specific themes in label policy

* feat: enable only specific themes in label policy

* feat: enable only specific themes in label policy

* add management in console

* pass enabledTheme

* render login ui based on enabled theme

* add in branding / settings service and name consistently

* update console to latest proto state

* fix console linting

* fix linting

* cleanup

* add translations

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
2023-10-26 05:54:09 +00:00
Tim Möhlmann
ad26ca88d7
feat(system api): list instances by domains (#6806)
Allow to list instances by their domains on the system API.

closes #6785
2023-10-25 19:20:12 +00:00
Stefan Benz
b51ad53e5a
fix: list mapping of saml provider configuration (#6804)
Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
2023-10-25 17:05:00 +00:00
Tim Möhlmann
94cf30c547
feat(oidc): use the new oidc server interface (#6779)
* feat(oidc): use the new oidc server interface

* rename from provider to server

* pin logging and oidc packages

* use oidc introspection fix branch

* add overloaded methods with tracing

* cleanup unused code

* include latest oidc fixes

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-10-25 15:44:05 +00:00
Elio Bischof
4980cd6a0c
feat: add SYSTEM_OWNER role (#6765)
* define roles and permissions

* support system user memberships

* don't limit system users

* cleanup permissions

* restrict memberships to aggregates

* default to SYSTEM_OWNER

* update unit tests

* test: system user token test (#6778)

* update unit tests

* refactor: make authz testable

* move session constants

* cleanup

* comment

* comment

* decode member type string to enum (#6780)

* decode member type string to enum

* handle all membership types

* decode enums where necessary

* decode member type in steps config

* update system api docs

* add technical advisory

* tweak docs a bit

* comment in comment

* lint

* extract token from Bearer header prefix

* review changes

* fix tests

* fix: add fix for activityhandler

* add isSystemUser

* remove IsSystemUser from activity info

* fix: add fix for activityhandler

---------

Co-authored-by: Stefan Benz <stefan@caos.ch>
2023-10-25 15:10:45 +00:00
Stefan Benz
48ae5d58ac
feat: add activity logs on user actions with authentication, resource… (#6748)
* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* feat: add activity logs on user actions with authentication, resourceAPI and sessionAPI

* fix: add unit tests to info package for context changes

* fix: add activity_interceptor.go suggestion

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>

* fix: refactoring and fixes through PR review

* fix: add auth service to lists of resourceAPIs

---------

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
Co-authored-by: Fabi <fabienne@zitadel.com>
2023-10-25 12:09:15 +00:00
Elio Bischof
385a55bd21
feat: limit audit trail (#6744)
* feat: enable limiting audit trail

* support AddExclusiveQuery

* fix invalid condition

* register event mappers

* fix NullDuration validity

* test query side for limits

* lint

* acceptance test audit trail limit

* fix acceptance test

* translate limits not found

* update tests

* fix linting

* add audit log retention to default instance

* fix tests

* update docs

* remove todo

* improve test name
2023-10-25 11:42:00 +00:00
Elio Bischof
1c839e308b
perf: query projected milestones for onboarding view (#6760)
* feat: support list milestones api

* show milestones in onboarding view

* add authenticated milestone

* add icon to login milestone

* update main

* lint

* fix import

* fix import

* lint

* reuse proto milestone type mapping
2023-10-25 11:16:34 +00:00
Livio Spring
73dbf31368
Merge pull request from GHSA-954h-jrpm-72pm 2023-10-25 11:15:22 +02:00
Fabi
93122efe9f
fix: cryptic error message for user not found (#6787)
* fix: cryptic error message for user not found

* fix: cryptic error message for user not found, fix test
2023-10-24 21:19:12 +00:00
Tim Möhlmann
ab79855cf0
fix(eventstore): prevent allocation of filtered events (#6749)
* fix(eventstore): prevent allocation of filtered events

Directly reduce each event obtained from a sql.Rows scan,
so that we do not have to allocate all events in a slice.

* reinstate the mutex as RWMutex

* scan data directly

* add todos

* fix(writemodels): add reduce of parent

* test: remove comment

* update comments

---------

Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2023-10-19 15:21:31 +00:00
Silvan
4d4f649eda
fix(db): allow unlimited connections (#6758) 2023-10-19 13:37:22 +00:00
adlerhurst
bd23a7a56f merge main into next 2023-10-19 12:34:00 +02:00
Silvan
b5564572bc
feat(eventstore): increase parallel write capabilities (#5940)
This implementation increases parallel write capabilities of the eventstore.
Please have a look at the technical advisories: [05](https://zitadel.com/docs/support/advisory/a10005) and  [06](https://zitadel.com/docs/support/advisory/a10006).
The implementation of eventstore.push is rewritten and stored events are migrated to a new table `eventstore.events2`.
If you are using cockroach: make sure that the database user of ZITADEL has `VIEWACTIVITY` grant. This is used to query events.
2023-10-19 12:19:10 +02:00
Elio Bischof
c0ddaf87e6 fix: origin from proxies (#6738)
* fix: origin from proxies

* test multiple forwarded header values
2023-10-19 10:35:47 +02:00
Livio Spring
426c4acbfe fix(notification): get origin from all relevant events and fix nil pointer (#6726) 2023-10-19 10:34:52 +02:00
Livio Spring
a272b1201f
fix(api): use (provided) organisation instead of resourceOwner of caller (#6714) 2023-10-12 10:00:36 +02:00
Miguel Cabrerizo
2d4cd331da
fix: allow unicode characters in org domains (#6675)
Co-authored-by: Elio Bischof <eliobischof@gmail.com>
2023-10-11 09:55:01 +02:00
Elio Bischof
8f6cb47567
fix: use triggering origin for notification links (#6628)
* take baseurl if saved on event

* refactor: make es mocks reusable

* Revert "refactor: make es mocks reusable"

This reverts commit 434ce12a6a.

* make messages testable

* test asset url

* fmt

* fmt

* simplify notification.Start

* test url combinations

* support init code added

* support password changed

* support reset pw

* support user domain claimed

* support add pwless login

* support verify phone

* Revert "support verify phone"

This reverts commit e40503303e.

* save trigger origin from ctx

* add ready for review check

* camel

* test email otp

* fix variable naming

* fix DefaultOTPEmailURLV2

* Revert "fix DefaultOTPEmailURLV2"

This reverts commit fa34d4d2a8.

* fix email otp challenged test

* fix email otp challenged test

* pass origin in login and gateway requests

* take origin from header

* take x-forwarded if present

* Update internal/notification/handlers/queries.go

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>

* Update internal/notification/handlers/commands.go

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>

* move origin header to ctx if available

* generate

* cleanup

* use forwarded header

* support X-Forwarded-* headers

* standardize context handling

* fix linting

---------

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
2023-10-10 13:20:53 +00:00
Fabian Deifuß
0180779d6d
fix(backend): include removed SMTP config in Query (#6624) (#6673)
closes #6624

Co-authored-by: Elio Bischof <elio@zitadel.com>
2023-10-10 12:45:45 +00:00
Miguel Cabrerizo
e66d476c47
fix: meaningful error messages for domain validation (#6677)
* feat: meaningful error messages for domain validation

* fix: duplicated error code and fix some org codes

* fix: add @peintnermax i18n suggestions

---------

Co-authored-by: Elio Bischof <elio@zitadel.com>
2023-10-10 12:02:16 +00:00
Livio Spring
8549dd7a3d
fix(login): error case for unknown usernames correctly (#6689) 2023-10-09 15:05:25 +00:00
Stefan Benz
6ce11a416a
test: correct used client api call in integration test (#6685)
fix: correct used client api call in integration test

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-10-09 12:09:51 +00:00
Livio Spring
9696fde676
fix: reduce origin check to tokens issued through code and implicit flow (#6681)
fix: only check origin for tokens issued to users through apps (code / implicit flow)
2023-10-09 10:08:18 +00:00
Livio Spring
54676eda98
Merge pull request from GHSA-v683-rcxx-vpff 2023-10-09 11:47:43 +02:00
Livio Spring
e3ac217424
fix: ensure no events are skipped on token check (#6663)
fix: ensure no events are skipped on token check
2023-10-09 09:26:27 +02:00