mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-24 08:41:33 +00:00
ba9b807854
* get key by id and cache them * userinfo from events for v2 tokens * improve keyset caching * concurrent token and client checks * client and project in single query * logging and otel * drop owner_removed column on apps and authN tables * userinfo and project roles in go routines * get oidc user info from projections and add actions * add avatar URL * some cleanup * pull oidc work branch * remove storage from server * add config flag for experimental introspection * legacy introspection flag * drop owner_removed column on user projections * drop owner_removed column on useer_metadata * query userinfo unit test * query introspection client test * add user_grants to the userinfo query * handle PAT scopes * bring triggers back * test instance keys query * add userinfo unit tests * unit test keys * go mod tidy * solve some bugs * fix missing preferred login name * do not run triggers in go routines, they seem to deadlock * initialize the trigger handlers late with a sync.OnceValue * Revert "do not run triggers in go routines, they seem to deadlock" This reverts commit 2a03da2127b7dc74552ec25d4772282a82cc1cba. * add missing translations * chore: update go version for linting * pin oidc version * parse a global time location for query test * fix linter complains * upgrade go lint * fix more linting issues --------- Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
34 lines
1014 B
Go
34 lines
1014 B
Go
package oidc
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/zitadel/oidc/v3/pkg/oidc"
|
|
"github.com/zitadel/oidc/v3/pkg/op"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/errors"
|
|
)
|
|
|
|
func (o *OPStorage) JWTProfileTokenType(ctx context.Context, request op.TokenRequest) (op.AccessTokenType, error) {
|
|
mapJWTProfileScopesToAudience(ctx, request)
|
|
user, err := o.query.GetUserByID(ctx, false, request.GetSubject())
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
// the user should always be a machine, but let's just be sure
|
|
if user.Machine == nil {
|
|
return 0, errors.ThrowInvalidArgument(nil, "OIDC-jk26S", "invalid client type")
|
|
}
|
|
return accessTokenTypeToOIDC(user.Machine.AccessTokenType), nil
|
|
}
|
|
|
|
func mapJWTProfileScopesToAudience(ctx context.Context, request op.TokenRequest) {
|
|
// the request should always be a JWTTokenRequest, but let's make sure
|
|
jwt, ok := request.(*oidc.JWTTokenRequest)
|
|
if !ok {
|
|
return
|
|
}
|
|
jwt.Audience = domain.AddAudScopeToAudience(ctx, jwt.Audience, jwt.Scopes)
|
|
}
|