TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-03-15 08:20:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
205229f0d1
zitadel/internal/query
History
Livio Spring 4e1868e9bb
fix: prevent panic when retrieving session by id in internal calls () 
# Which Problems Are Solved

 introduced more possibilities to search for "own" sessions. Due to
this the permission checks for retrieving a session had to be updated
accordingly. Internal calls, such as retrieving them for sending
notifications do not require a permission, but the code was not properly
adjusted and thus could lead to panics.

# How the Problems Are Solved

- Properly handled (do not require) permission check for internal only
calls when retrieving the session by id.

# Additional Changes

None

# Additional Context

- needs backports to 2.68.x, 2.69.x, 2.70.x
- closes
2025-03-03 11:24:52 +01:00
..
projection
feat: add PKCE option to generic OAuth2 / OIDC identity providers ()
2025-02-26 12:20:47 +00:00
testdata
feat: saml application configuration for login version ()
2025-02-13 16:03:05 +00:00
access_token.go
perf(oidc): nest position clause for session terminated query ()
2024-10-07 12:49:55 +00:00
action_flow_test.go
fix(actions): preserve order of execution ()
2024-11-14 14:04:39 +00:00
action_flow.go
fix(actions): preserve order of execution ()
2024-11-14 14:04:39 +00:00
action_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
action.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
app_oidc_project_permission.sql
feat: permission check on OIDC and SAML service session API ()
2025-02-11 18:45:09 +00:00
app_saml_project_permission.sql
feat: permission check on OIDC and SAML service session API ()
2025-02-11 18:45:09 +00:00
app_test.go
feat: saml application configuration for login version ()
2025-02-13 16:03:05 +00:00
app.go
feat: saml application configuration for login version ()
2025-02-13 16:03:05 +00:00
auth_request_by_id.sql
feat(oidc): optimize the userinfo endpoint ()
2024-04-09 15:15:35 +02:00
auth_request_test.go
feat: specify login UI version on instance and apps ()
2024-12-19 10:37:46 +01:00
auth_request.go
feat: specify login UI version on instance and apps ()
2024-12-19 10:37:46 +01:00
authn_key_test.go
perf(oidc): remove get user by ID from jwt profile grant ()
2024-09-11 12:04:09 +03:00
authn_key_user.sql
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
authn_key.go
perf(oidc): remove get user by ID from jwt profile grant ()
2024-09-11 12:04:09 +03:00
cache.go
refactor(handler): cache active instances ()
2024-12-06 11:32:53 +00:00
certificate_test.go
feat(v3alpha): web key resource ()
2024-08-14 14:18:14 +00:00
certificate.go
feat(v3alpha): web key resource ()
2024-08-14 14:18:14 +00:00
converter.go
feat(api): feature flags ()
2024-02-28 10:55:54 +02:00
current_state_test.go
fix(eventstore): revert precise decimal () ()
2024-09-25 06:31:46 +02:00
current_state.go
fix(eventstore): revert precise decimal () ()
2024-09-24 18:43:29 +02:00
custom_text_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
custom_text.go
fix: automatically link user without prompt ()
2024-08-28 05:33:20 +00:00
debug_events_state_by_id.sql
feat: add debug events API ()
2024-09-11 08:24:00 +00:00
debug_events_states.sql
feat: add debug events API ()
2024-09-11 08:24:00 +00:00
debug_events.go
feat: add debug events API ()
2024-09-11 08:24:00 +00:00
device_auth_test.go
feat(api): allow Device Authorization Grant using custom login UI ()
2025-02-25 07:33:13 +01:00
device_auth.go
feat(api): allow Device Authorization Grant using custom login UI ()
2025-02-25 07:33:13 +01:00
domain_policy_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
domain_policy.go
refactor(fmt): run gci on complete project ()
2024-04-03 10:43:43 +00:00
event.go
chore: remove bloating span ()
2024-04-16 11:19:17 +00:00
execution_targets.sql
feat: add action v2 execution on requests and responses ()
2024-05-04 11:55:57 +02:00
execution_test.go
feat(v3alpha): read actions ()
2024-08-12 22:32:01 +02:00
execution.go
feat: action v2 signing ()
2024-11-28 10:06:52 +00:00
failed_events_test.go
feat(eventstore): increase parallel write capabilities ()
2023-10-19 12:19:10 +02:00
failed_events.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
generic.go
feat: query side for executions and targets for actions v2 ()
2024-03-14 09:56:23 +00:00
iam_member_test.go
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
iam_member.go
feat(/internal): Add User Resource Owner ()
2025-01-15 09:40:30 +01:00
idp_login_policy_link_test.go
feat: add exclusion of criteria for active idp query ()
2024-12-18 16:19:05 +00:00
idp_login_policy_link.go
feat: add exclusion of criteria for active idp query ()
2024-12-18 16:19:05 +00:00
idp_template_test.go
feat: add PKCE option to generic OAuth2 / OIDC identity providers ()
2025-02-26 12:20:47 +00:00
idp_template.go
feat: add PKCE option to generic OAuth2 / OIDC identity providers ()
2025-02-26 12:20:47 +00:00
idp_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
idp_user_link_test.go
fix: generalise permission check for query user information ()
2024-08-23 06:44:18 +00:00
idp_user_link.go
fix: generalise permission check for query user information ()
2024-08-23 06:44:18 +00:00
idp.go
refactor(fmt): run gci on complete project ()
2024-04-03 10:43:43 +00:00
instance_by_domain.sql
feat(fields): add instance domain ()
2024-12-04 18:10:10 +00:00
instance_by_id.sql
feat(storage): generic cache interface ()
2024-09-25 21:40:21 +02:00
instance_domain_test.go
feat(storage): read only transactions for queries ()
2023-08-22 10:49:22 +00:00
instance_domain.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
instance_features_model.go
feat: Use V2 API's in Console ()
2025-02-17 19:25:46 +01:00
instance_features_test.go
fix: add action v2 execution to features ()
2024-04-09 20:21:21 +03:00
instance_features.go
feat: Use V2 API's in Console ()
2025-02-17 19:25:46 +01:00
instance_test.go
feat(api): feature flags ()
2024-02-28 10:55:54 +02:00
instance_trusted_domain_test.go
feat: trusted (instance) domains ()
2024-07-31 18:00:38 +03:00
instance_trusted_domain.go
feat: trusted (instance) domains ()
2024-07-31 18:00:38 +03:00
instance.go
refactor(handler): cache active instances ()
2024-12-06 11:32:53 +00:00
instanceindex_enumer.go
perf(cache): pgx pool connector ()
2024-10-04 13:15:41 +00:00
introspection_client_by_id.sql
fix: correctly check app state on authentication ()
2024-09-17 11:34:14 +00:00
introspection_test.go
fix: correctly check app state on authentication ()
2024-09-17 11:34:14 +00:00
introspection.go
fix: correctly check app state on authentication ()
2024-09-17 11:34:14 +00:00
key_test.go
feat(v3alpha): web key resource ()
2024-08-14 14:18:14 +00:00
key.go
feat(v3alpha): web key resource ()
2024-08-14 14:18:14 +00:00
label_policy.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
lockout_policy_test.go
feat: provide option to limit (T)OTP checks ()
2024-04-10 09:14:55 +00:00
lockout_policy.go
fix: correct error messages for policy queries ()
2024-10-03 17:53:03 +02:00
login_name.go
perf: remove owner removed columns from projections for oidc ()
2023-11-20 17:21:08 +02:00
login_policy_test.go
chore: use pgx v5 ()
2024-03-27 15:48:22 +02:00
login_policy.go
refactor(fmt): run gci on complete project ()
2024-04-03 10:43:43 +00:00
mail_template.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
member_roles.go
fix(query): realtime data on defined requests ()
2022-06-14 07:51:00 +02:00
member.go
feat(/internal): Add User Resource Owner ()
2025-01-15 09:40:30 +01:00
message_text_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
message_text.go
feat: invite user link ()
2024-09-11 10:53:55 +00:00
milestone_test.go
fix(milestones): use previous spelling for milestone types ()
2024-11-11 11:28:27 +00:00
milestone.go
perf(milestones): refactor ()
2024-10-28 08:29:34 +00:00
notification_policy_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
notification_policy.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
notification_provider_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
notification_provider.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
oidc_client_by_id.sql
feat: specify login UI version on instance and apps ()
2024-12-19 10:37:46 +01:00
oidc_client_test.go
feat: saml application configuration for login version ()
2025-02-13 16:03:05 +00:00
oidc_client.go
feat: specify login UI version on instance and apps ()
2024-12-19 10:37:46 +01:00
oidc_settings_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
oidc_settings.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
org_domain_test.go
feat(storage): read only transactions ()
2023-08-22 14:49:02 +02:00
org_domain.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
org_member_test.go
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
org_member.go
feat(/internal): Add User Resource Owner ()
2025-01-15 09:40:30 +01:00
org_metadata_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
org_metadata.go
refactor(fmt): run gci on complete project ()
2024-04-03 10:43:43 +00:00
org_test.go
fix: generalise permission check for query user information ()
2024-08-23 06:44:18 +00:00
org.go
refactor(handler): cache active instances ()
2024-12-06 11:32:53 +00:00
orgindex_enumer.go
feat(cache): organization ()
2024-11-21 08:05:03 +02:00
password_age_policy_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
password_age_policy.go
fix: correct error messages for policy queries ()
2024-10-03 17:53:03 +02:00
password_complexity_policy_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
password_complexity_policy.go
fix: correct error messages for policy queries ()
2024-10-03 17:53:03 +02:00
permission.go
fix(permissions): return current user when calling ListUsers() when user does not have permissions ()
2025-02-20 15:39:48 +00:00
prepare_test.go
feat: list users scim v2 endpoint ()
2025-01-21 13:31:54 +01:00
privacy_policy_test.go
feat(cnsl): docs link can be customized and custom button is available ()
2024-05-13 16:01:50 +02:00
privacy_policy.go
feat(cnsl): docs link can be customized and custom button is available ()
2024-05-13 16:01:50 +02:00
project_grant_member_test.go
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
project_grant_member.go
feat(/internal): Add User Resource Owner ()
2025-01-15 09:40:30 +01:00
project_grant_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
project_grant.go
refactor(fmt): run gci on complete project ()
2024-04-03 10:43:43 +00:00
project_member_test.go
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
project_member.go
feat(/internal): Add User Resource Owner ()
2025-01-15 09:40:30 +01:00
project_role_test.go
perf: remove owner removed columns from projections for oidc ()
2023-11-20 17:21:08 +02:00
project_role.go
refactor(fmt): run gci on complete project ()
2024-04-03 10:43:43 +00:00
project_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
project.go
refactor(fmt): run gci on complete project ()
2024-04-03 10:43:43 +00:00
query_test.go
fix(setup): init projections ()
2024-01-25 17:28:20 +01:00
query.go
refactor(handler): cache active instances ()
2024-12-06 11:32:53 +00:00
quota_notifications_test.go
perf: project quotas and usages ()
2023-09-15 16:58:45 +02:00
quota_notifications.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
quota_periods_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
quota_periods.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
quota_test.go
chore: use pgx v5 ()
2024-03-27 15:48:22 +02:00
quota.go
chore: use pgx v5 ()
2024-03-27 15:48:22 +02:00
restrictions_test.go
fix: projection version of restrictions ()
2023-12-06 10:30:56 +00:00
restrictions.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
saml_request_by_id.sql
feat: add saml request to link to sessions ()
2024-12-19 11:11:40 +00:00
saml_request_test.go
feat: add saml request to link to sessions ()
2024-12-19 11:11:40 +00:00
saml_request.go
feat: add saml request to link to sessions ()
2024-12-19 11:11:40 +00:00
saml_sp_by_id.sql
feat: saml application configuration for login version ()
2025-02-13 16:03:05 +00:00
saml_sp_test.go
feat: saml application configuration for login version ()
2025-02-13 16:03:05 +00:00
saml_sp.go
feat: saml application configuration for login version ()
2025-02-13 16:03:05 +00:00
search_query_test.go
fix: scim 2 filter: the username should be treated case-insensitive ()
2025-01-29 15:22:22 +02:00
search_query.go
fix: scim 2 filter: the username should be treated case-insensitive ()
2025-01-29 15:22:22 +02:00
secret_generator_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
secret_generators.go
fix(query): print log line on secret generator error ()
2024-08-13 14:52:43 +02:00
security_policy.go
feat: impersonation roles ()
2024-02-28 10:21:11 +00:00
session.go
fix: prevent panic when retrieving session by id in internal calls ()
2025-03-03 11:24:52 +01:00
sessions_test.go
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
sms_test.go
feat: Add Twilio Verification Service ()
2024-09-26 09:14:33 +02:00
sms.go
test(session): load tests for session api ()
2025-01-29 12:08:20 +00:00
smtp_test.go
fix: correctly create SMTP provider list ()
2024-10-04 09:34:44 +00:00
smtp.go
feat: add http as smtp provider ()
2024-09-12 06:27:29 +02:00
system_features_model.go
perf: role permissions in database ()
2025-01-16 10:09:15 +00:00
system_features_test.go
fix: add action v2 execution to features ()
2024-04-09 20:21:21 +03:00
system_features.go
perf: role permissions in database ()
2025-01-16 10:09:15 +00:00
target_test.go
feat: action v2 signing ()
2024-11-28 10:06:52 +00:00
target.go
feat: action v2 signing ()
2024-11-28 10:06:52 +00:00
targets_by_execution_id.sql
feat: action v2 signing ()
2024-11-28 10:06:52 +00:00
targets_by_execution_ids.sql
feat: action v2 signing ()
2024-11-28 10:06:52 +00:00
user_auth_method_test.go
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
user_auth_method.go
feat: v2 api add way to list authentication factors ()
2025-01-02 13:14:49 +00:00
user_by_id.sql
fix: scim v2 endpoints enforce user resource owner ()
2025-01-30 16:43:13 +01:00
user_by_login_name.sql
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
user_grant_test.go
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
user_grant.go
fix(eventstore): revert precise decimal () ()
2024-09-24 18:43:29 +02:00
user_membership_test.go
perf: remove owner removed columns from projections for oidc ()
2023-11-20 17:21:08 +02:00
user_membership.go
fix(eventstore): revert precise decimal () ()
2024-09-24 18:43:29 +02:00
user_metadata_test.go
feat: list users scim v2 endpoint ()
2025-01-21 13:31:54 +01:00
user_metadata.go
feat: list users scim v2 endpoint ()
2025-01-21 13:31:54 +01:00
user_notify_by_id.sql
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
user_notify_by_login_name.sql
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
user_otp.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
user_password.go
feat(crypto): use passwap for machine and app secrets ()
2024-04-05 09:35:49 +00:00
user_personal_access_token_test.go
refactor: rename package errors to zerrors ()
2023-12-08 15:30:55 +01:00
user_personal_access_token.go
refactor(fmt): run gci on complete project ()
2024-04-03 10:43:43 +00:00
user_schema_test.go
feat: add schema user create and remove ()
2024-08-28 19:46:45 +00:00
user_schema.go
feat: add schema user create and remove ()
2024-08-28 19:46:45 +00:00
user_test.go
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
user.go
fix(permissions): return current user when calling ListUsers() when user does not have permissions ()
2025-02-20 15:39:48 +00:00
userinfo_by_id.sql
feat(users/v2): return prompt information ()
2025-01-29 15:12:31 +00:00
userinfo_client_by_id.sql
feat(oidc): optimize the userinfo endpoint ()
2024-04-09 15:15:35 +02:00
userinfo_test.go
feat(oidc): organization roles scope ()
2024-06-14 10:00:43 +02:00
userinfo.go
feat(oidc): organization roles scope ()
2024-06-14 10:00:43 +02:00
web_key_by_state.sql
fix(webkeys): remove include private key from projection index ()
2024-08-16 11:41:09 +00:00
web_key_list.sql
fix(webkeys): remove include private key from projection index ()
2024-08-16 11:41:09 +00:00
web_key_model.go
feat(v3alpha): web key resource ()
2024-08-14 14:18:14 +00:00
web_key_public_keys.sql
fix(webkeys): remove include private key from projection index ()
2024-08-16 11:41:09 +00:00
web_key_test.go
feat(v3alpha): web key resource ()
2024-08-14 14:18:14 +00:00
web_key.go
feat(v3alpha): web key resource ()
2024-08-14 14:18:14 +00:00
zitadel_permission.go
perf: remove owner removed columns from projections for oidc ()
2023-11-20 17:21:08 +02:00