mirror of
https://github.com/zitadel/zitadel.git
synced 2025-08-11 19:27:32 +00:00
81 lines
2.4 KiB
Go
81 lines
2.4 KiB
Go
package integration
|
|
|
|
import (
|
|
"context"
|
|
_ "embed"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/zitadel/oidc/v3/pkg/client"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/credentials/insecure"
|
|
|
|
http_util "github.com/zitadel/zitadel/internal/api/http"
|
|
"github.com/zitadel/zitadel/pkg/grpc/system"
|
|
)
|
|
|
|
var (
|
|
//go:embed config/system-user-key.pem
|
|
systemUserKey []byte
|
|
//go:embed config/system-user-with-no-permissions.pem
|
|
systemUserWithNoPermissions []byte
|
|
)
|
|
|
|
var (
|
|
// SystemClient creates a system connection once and reuses it on every use.
|
|
// Each client call automatically gets the authorization context for the system user.
|
|
SystemClient = sync.OnceValue[system.SystemServiceClient](systemClient)
|
|
SystemToken string
|
|
SystemUserWithNoPermissionsToken string
|
|
)
|
|
|
|
func systemClient() system.SystemServiceClient {
|
|
cc, err := grpc.NewClient(loadedConfig.Host(),
|
|
grpc.WithTransportCredentials(insecure.NewCredentials()),
|
|
grpc.WithChainUnaryInterceptor(func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
|
|
ctx = WithSystemAuthorization(ctx)
|
|
return invoker(ctx, method, req, reply, cc, opts...)
|
|
}),
|
|
)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return system.NewSystemServiceClient(cc)
|
|
}
|
|
|
|
func createSystemUserToken() string {
|
|
const ISSUER = "tester"
|
|
audience := http_util.BuildOrigin(loadedConfig.Host(), loadedConfig.Secure)
|
|
signer, err := client.NewSignerFromPrivateKeyByte(systemUserKey, "")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
token, err := client.SignedJWTProfileAssertion(ISSUER, []string{audience}, time.Hour, signer)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return token
|
|
}
|
|
|
|
func createSystemUserWithNoPermissionsToken() string {
|
|
const ISSUER = "system-user-with-no-permissions"
|
|
audience := http_util.BuildOrigin(loadedConfig.Host(), loadedConfig.Secure)
|
|
signer, err := client.NewSignerFromPrivateKeyByte(systemUserWithNoPermissions, "")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
token, err := client.SignedJWTProfileAssertion(ISSUER, []string{audience}, time.Hour, signer)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return token
|
|
}
|
|
|
|
func WithSystemAuthorization(ctx context.Context) context.Context {
|
|
return WithAuthorizationToken(ctx, SystemToken)
|
|
}
|
|
|
|
func WithSystemUserWithNoPermissionsAuthorization(ctx context.Context) context.Context {
|
|
return WithAuthorizationToken(ctx, SystemUserWithNoPermissionsToken)
|
|
}
|