mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-12 19:14:23 +00:00
af4e0484d0
* fix: uniform oidc errors sanitize oidc error reporting when passing package boundary towards oidc. * add should TriggerBulk in get audiences for auth request * upgrade to oidc 3.10.1 * provisional oidc upgrade to error branch * pin oidc 3.10.2
41 lines
1.2 KiB
Go
41 lines
1.2 KiB
Go
package oidc
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/zitadel/oidc/v3/pkg/oidc"
|
|
"github.com/zitadel/oidc/v3/pkg/op"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
func (o *OPStorage) JWTProfileTokenType(ctx context.Context, request op.TokenRequest) (_ op.AccessTokenType, err error) {
|
|
ctx, span := tracing.NewSpan(ctx)
|
|
defer func() {
|
|
err = oidcError(err)
|
|
span.EndWithError(err)
|
|
}()
|
|
|
|
mapJWTProfileScopesToAudience(ctx, request)
|
|
user, err := o.query.GetUserByID(ctx, false, request.GetSubject())
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
// the user should always be a machine, but let's just be sure
|
|
if user.Machine == nil {
|
|
return 0, zerrors.ThrowInvalidArgument(nil, "OIDC-jk26S", "invalid client type")
|
|
}
|
|
return accessTokenTypeToOIDC(user.Machine.AccessTokenType), nil
|
|
}
|
|
|
|
func mapJWTProfileScopesToAudience(ctx context.Context, request op.TokenRequest) {
|
|
// the request should always be a JWTTokenRequest, but let's make sure
|
|
jwt, ok := request.(*oidc.JWTTokenRequest)
|
|
if !ok {
|
|
return
|
|
}
|
|
jwt.Audience = domain.AddAudScopeToAudience(ctx, jwt.Audience, jwt.Scopes)
|
|
}
|