zitadel/internal/auth/repository/eventsourcing/eventstore
Livio Spring 0af37d45e9
fix: handle user remove correctly in v1 sessions for login (#8432)
# Which Problems Are Solved

In case a user was deleted and recreated with the same id, they would
never be able to authenticate through the login UI, since it would
return an error "User not active".
This was due to the check in the auth request / session handling for the
login UI, where the user removed event would terminate an further event
check and ignore the newly added user.

# How the Problems Are Solved

- The user removed event no longer returns an error, but is handled as a
session termination event.
(A user removed event will already delete the user and the preceding
`activeUserById` function will deny the authentication.)

# Additional Changes

Updated tests to be able to handle multiple events in the mocks.

# Additional Context

closes https://github.com/zitadel/zitadel/issues/8201

Co-authored-by: Silvan <silvan.reusser@gmail.com>
2024-08-15 05:39:54 +00:00
..
auth_request_test.go fix: handle user remove correctly in v1 sessions for login (#8432) 2024-08-15 05:39:54 +00:00
auth_request.go fix: handle user remove correctly in v1 sessions for login (#8432) 2024-08-15 05:39:54 +00:00
org.go feat(eventstore): increase parallel write capabilities (#5940) 2023-10-19 12:19:10 +02:00
refresh_token.go fix: reduce eventual consistency (#7075) 2023-12-14 11:07:47 +01:00
token.go chore(oidc): add additional spans to userinfo code paths (#7749) 2024-04-10 17:05:13 +02:00
user_session.go refactor: cleanup unused code (#7130) 2024-01-02 14:26:31 +00:00
user.go fix: allow login with user created through v2 api without password (#8291) 2024-07-17 06:43:07 +02:00