mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-12 02:54:20 +00:00
73d37459bb
* feat: label policy proto extension * feat: label policy and activate event * feat: label policy asset events * feat: label policy asset commands * feat: add storage key * feat: storage key validation * feat: label policy asset tests * feat: label policy query side * feat: avatar * feat: avatar event * feat: human avatar * feat: avatar read side * feat: font on iam label policy * feat: label policy font * feat: possiblity to create bucket on put file * uplaoder * login policy logo * set bucket prefix * feat: avatar upload * feat: avatar upload * feat: use assets on command side * feat: fix human avatar removed event * feat: remove human avatar * feat: mock asset storage * feat: remove human avatar * fix(operator): add configuration of asset storage to zitadel operator * feat(console): private labeling policy (#1697) * private labeling component, routing, preview * font, colors, upload, i18n * show logo * fix: uniqueness (#1710) * fix: uniqueconstraint to lower * feat: change org * feat: org change test * feat: change org * fix: tests * fix: handle domain claims correctly * feat: update org Co-authored-by: fabi <fabienne.gerschwiler@gmail.com> * fix: handle domain claimed event correctly for service users (#1711) * fix: handle domain claimed event correctly on user view * fix: ignore domain claimed events for email notifications * fix: change org * handle org changed in read models correctly * fix: change org in user grant handler Co-authored-by: fabi <fabienne.gerschwiler@gmail.com> * fix: correct value (#1695) * docs(api): correct link (#1712) * upload service Co-authored-by: Livio Amstutz <livio.a@gmail.com> Co-authored-by: fabi <fabienne.gerschwiler@gmail.com> Co-authored-by: Florian Forster <florian@caos.ch> * feat: fix tests, * feat: remove assets from label policy * fix npm, set environment * lint ts * remove stylelinting * fix(operator): add mapping for console with changed unit tests * fix(operator): add secrets as env variables to pod * feat: remove human avatar * fix(operator): add secrets as env variables to pod * feat: map label policy * feat: labelpolicy, admin, mgmt, adv settings (#1715) * fetch label policy, mgmt, admin service * feat: advanced beh, links, add, update * lint ts * feat: watermark * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: custom css * css * css * css * css * css * getobject * feat: dynamic handler * feat: varibale css * content info * css overwrite * feat: variablen css * feat: generate css file * feat: dark mode * feat: dark mode * fix logo css * feat: upload logos * dark mode with cookie * feat: handle images in login * avatar css and begin font * feat: avatar * feat: user avatar * caching of static assets in login * add avatar.js to main.html * feat: header dont show logo if no url * feat: label policy colors * feat: mock asset storage * feat: mock asset storage * feat: fix tests * feat: user avatar * feat: header logo * avatar * avatar * make it compatible with go 1.15 * feat: remove unused logos * fix handler * fix: styling error handling * fonts * fix: download func * switch to mux * fix: change upload api to assets * fix build * fix: download avatar * fix: download logos * fix: my avatar * font * fix: remove error msg popup possibility * fix: docs * fix: svalidate colors * rem msg popup from frontend * fix: email with private labeling * fix: tests * fix: email templates * fix: change migration version * fix: fix duplicate imports * fix(console): assets, service url, upload, policy current and preview (#1781) * upload endpoint, layout * fetch current, preview, fix upload * cleanup private labeling * fix linting * begin generated asset handler * generate asset api in dockerfile * features for label policy * features for label policy * features * flag for asset generator * change asset generator flag * fix label policy view in grpc * fix: layout, activate policy (#1786) * theme switcher up on top * change layout * activate policy * feat(console): label policy back color, layout (#1788) * theme switcher up on top * change layout * activate policy * fix overwrite value fc * reset policy, reset service * autosave policy, preview desc, layout impv * layout, i18n * background colors, inject material styles * load images * clean, lint * fix layout * set custom hex * fix content size conversion * remove font format in generated css * fix features for assets * fix(console): label policy colors, image downloads, preview (#1804) * load images * colors, images binding * lint * refresh emitter * lint * propagate font colors * upload error handling * label policy feature check * add blob in csp for console * log * fix: feature edits for label policy, refresh state on upload (#1807) * show error on load image, stop spinner * fix merge * fix migration versions * fix assets * fix csp * fix background color * scss * fix build * lint scss * fix statik for console * fix features check for label policy * cleanup * lint * public links * fix notifications * public links * feat: merge main * feat: fix translation files * fix migration * set api domain * fix logo in email * font face in email * font face in email * validate assets on upload * cleanup * add missing translations * add missing translations Co-authored-by: Livio Amstutz <livio.a@gmail.com> Co-authored-by: Stefan Benz <stefan@caos.ch> Co-authored-by: Max Peintner <max@caos.ch> Co-authored-by: Florian Forster <florian@caos.ch>
332 lines
11 KiB
Go
332 lines
11 KiB
Go
package command
|
|
|
|
import (
|
|
"context"
|
|
"github.com/caos/zitadel/internal/eventstore"
|
|
|
|
"github.com/caos/zitadel/internal/domain"
|
|
caos_errs "github.com/caos/zitadel/internal/errors"
|
|
"github.com/caos/zitadel/internal/eventstore/v1/models"
|
|
"github.com/caos/zitadel/internal/repository/user"
|
|
)
|
|
|
|
func (c *Commands) getHuman(ctx context.Context, userID, resourceowner string) (*domain.Human, error) {
|
|
human, err := c.getHumanWriteModelByID(ctx, userID, resourceowner)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if !isUserStateExists(human.UserState) {
|
|
return nil, caos_errs.ThrowNotFound(nil, "COMMAND-M9dsd", "Errors.User.NotFound")
|
|
}
|
|
return writeModelToHuman(human), nil
|
|
}
|
|
|
|
func (c *Commands) AddHuman(ctx context.Context, orgID string, human *domain.Human) (*domain.Human, error) {
|
|
if orgID == "" {
|
|
return nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-XYFk9", "Errors.ResourceOwnerMissing")
|
|
}
|
|
orgIAMPolicy, err := c.getOrgIAMPolicy(ctx, orgID)
|
|
if err != nil {
|
|
return nil, caos_errs.ThrowPreconditionFailed(err, "COMMAND-33M9f", "Errors.Org.OrgIAMPolicy.NotFound")
|
|
}
|
|
pwPolicy, err := c.getOrgPasswordComplexityPolicy(ctx, orgID)
|
|
if err != nil {
|
|
return nil, caos_errs.ThrowPreconditionFailed(err, "COMMAND-M5Fsd", "Errors.Org.PasswordComplexity.NotFound")
|
|
}
|
|
events, addedHuman, err := c.addHuman(ctx, orgID, human, orgIAMPolicy, pwPolicy)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
pushedEvents, err := c.eventstore.PushEvents(ctx, events...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
err = AppendAndReduce(addedHuman, pushedEvents...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return writeModelToHuman(addedHuman), nil
|
|
}
|
|
|
|
func (c *Commands) ImportHuman(ctx context.Context, orgID string, human *domain.Human) (*domain.Human, error) {
|
|
if orgID == "" {
|
|
return nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-5N8fs", "Errors.ResourceOwnerMissing")
|
|
}
|
|
orgIAMPolicy, err := c.getOrgIAMPolicy(ctx, orgID)
|
|
if err != nil {
|
|
return nil, caos_errs.ThrowPreconditionFailed(err, "COMMAND-2N9fs", "Errors.Org.OrgIAMPolicy.NotFound")
|
|
}
|
|
pwPolicy, err := c.getOrgPasswordComplexityPolicy(ctx, orgID)
|
|
if err != nil {
|
|
return nil, caos_errs.ThrowPreconditionFailed(err, "COMMAND-4N8gs", "Errors.Org.PasswordComplexity.NotFound")
|
|
}
|
|
events, addedHuman, err := c.importHuman(ctx, orgID, human, orgIAMPolicy, pwPolicy)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
pushedEvents, err := c.eventstore.PushEvents(ctx, events...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
err = AppendAndReduce(addedHuman, pushedEvents...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return writeModelToHuman(addedHuman), nil
|
|
}
|
|
|
|
func (c *Commands) addHuman(ctx context.Context, orgID string, human *domain.Human, orgIAMPolicy *domain.OrgIAMPolicy, pwPolicy *domain.PasswordComplexityPolicy) ([]eventstore.EventPusher, *HumanWriteModel, error) {
|
|
if orgID == "" || !human.IsValid() {
|
|
return nil, nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-67Ms8", "Errors.User.Invalid")
|
|
}
|
|
if human.Password != nil && human.SecretString != "" {
|
|
human.ChangeRequired = true
|
|
}
|
|
return c.createHuman(ctx, orgID, human, nil, false, orgIAMPolicy, pwPolicy)
|
|
}
|
|
|
|
func (c *Commands) importHuman(ctx context.Context, orgID string, human *domain.Human, orgIAMPolicy *domain.OrgIAMPolicy, pwPolicy *domain.PasswordComplexityPolicy) ([]eventstore.EventPusher, *HumanWriteModel, error) {
|
|
if orgID == "" || !human.IsValid() {
|
|
return nil, nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-00p2b", "Errors.User.Invalid")
|
|
}
|
|
return c.createHuman(ctx, orgID, human, nil, false, orgIAMPolicy, pwPolicy)
|
|
}
|
|
|
|
func (c *Commands) RegisterHuman(ctx context.Context, orgID string, human *domain.Human, externalIDP *domain.ExternalIDP, orgMemberRoles []string) (*domain.Human, error) {
|
|
userEvents, registeredHuman, err := c.registerHuman(ctx, orgID, human, externalIDP)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
orgMemberWriteModel := NewOrgMemberWriteModel(orgID, registeredHuman.AggregateID)
|
|
orgAgg := OrgAggregateFromWriteModel(&orgMemberWriteModel.WriteModel)
|
|
if len(orgMemberRoles) > 0 {
|
|
orgMember := &domain.Member{
|
|
ObjectRoot: models.ObjectRoot{
|
|
AggregateID: orgID,
|
|
},
|
|
UserID: human.AggregateID,
|
|
Roles: orgMemberRoles,
|
|
}
|
|
memberEvent, err := c.addOrgMember(ctx, orgAgg, orgMemberWriteModel, orgMember)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
userEvents = append(userEvents, memberEvent)
|
|
}
|
|
|
|
pushedEvents, err := c.eventstore.PushEvents(ctx, userEvents...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
err = AppendAndReduce(registeredHuman, pushedEvents...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return writeModelToHuman(registeredHuman), nil
|
|
}
|
|
|
|
func (c *Commands) registerHuman(ctx context.Context, orgID string, human *domain.Human, externalIDP *domain.ExternalIDP) ([]eventstore.EventPusher, *HumanWriteModel, error) {
|
|
if human != nil && human.Username == "" {
|
|
human.Username = human.EmailAddress
|
|
}
|
|
if orgID == "" || !human.IsValid() || externalIDP == nil && (human.Password == nil || human.SecretString == "") {
|
|
return nil, nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-9dk45", "Errors.User.Invalid")
|
|
}
|
|
orgIAMPolicy, err := c.getOrgIAMPolicy(ctx, orgID)
|
|
if err != nil {
|
|
return nil, nil, caos_errs.ThrowPreconditionFailed(err, "COMMAND-33M9f", "Errors.Org.OrgIAMPolicy.NotFound")
|
|
}
|
|
pwPolicy, err := c.getOrgPasswordComplexityPolicy(ctx, orgID)
|
|
if err != nil {
|
|
return nil, nil, caos_errs.ThrowPreconditionFailed(err, "COMMAND-M5Fsd", "Errors.Org.PasswordComplexity.NotFound")
|
|
}
|
|
if human.Password != nil && human.SecretString != "" {
|
|
human.ChangeRequired = false
|
|
}
|
|
return c.createHuman(ctx, orgID, human, externalIDP, true, orgIAMPolicy, pwPolicy)
|
|
}
|
|
|
|
func (c *Commands) createHuman(ctx context.Context, orgID string, human *domain.Human, externalIDP *domain.ExternalIDP, selfregister bool, orgIAMPolicy *domain.OrgIAMPolicy, pwPolicy *domain.PasswordComplexityPolicy) ([]eventstore.EventPusher, *HumanWriteModel, error) {
|
|
if err := human.CheckOrgIAMPolicy(orgIAMPolicy); err != nil {
|
|
return nil, nil, err
|
|
}
|
|
userID, err := c.idGenerator.Next()
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
human.AggregateID = userID
|
|
human.SetNamesAsDisplayname()
|
|
if human.Password != nil {
|
|
if err := human.HashPasswordIfExisting(pwPolicy, c.userPasswordAlg, human.ChangeRequired); err != nil {
|
|
return nil, nil, err
|
|
}
|
|
}
|
|
|
|
addedHuman := NewHumanWriteModel(human.AggregateID, orgID)
|
|
//TODO: adlerhurst maybe we could simplify the code below
|
|
userAgg := UserAggregateFromWriteModel(&addedHuman.WriteModel)
|
|
var events []eventstore.EventPusher
|
|
|
|
if selfregister {
|
|
events = append(events, createRegisterHumanEvent(ctx, userAgg, human, orgIAMPolicy.UserLoginMustBeDomain))
|
|
} else {
|
|
events = append(events, createAddHumanEvent(ctx, userAgg, human, orgIAMPolicy.UserLoginMustBeDomain))
|
|
}
|
|
|
|
if externalIDP != nil {
|
|
event, err := c.addHumanExternalIDP(ctx, userAgg, externalIDP)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
events = append(events, event)
|
|
}
|
|
|
|
if human.IsInitialState() {
|
|
initCode, err := domain.NewInitUserCode(c.initializeUserCode)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
events = append(events, user.NewHumanInitialCodeAddedEvent(ctx, userAgg, initCode.Code, initCode.Expiry))
|
|
}
|
|
|
|
if human.Email != nil && human.EmailAddress != "" && human.IsEmailVerified {
|
|
events = append(events, user.NewHumanEmailVerifiedEvent(ctx, userAgg))
|
|
}
|
|
|
|
if human.Phone != nil && human.PhoneNumber != "" && !human.IsPhoneVerified {
|
|
phoneCode, err := domain.NewPhoneCode(c.phoneVerificationCode)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
events = append(events, user.NewHumanPhoneCodeAddedEvent(ctx, userAgg, phoneCode.Code, phoneCode.Expiry))
|
|
} else if human.Phone != nil && human.PhoneNumber != "" && human.IsPhoneVerified {
|
|
events = append(events, user.NewHumanPhoneVerifiedEvent(ctx, userAgg))
|
|
}
|
|
|
|
return events, addedHuman, nil
|
|
}
|
|
|
|
func (c *Commands) HumanSkipMFAInit(ctx context.Context, userID, resourceowner string) (err error) {
|
|
if userID == "" {
|
|
return caos_errs.ThrowInvalidArgument(nil, "COMMAND-2xpX9", "Errors.User.UserIDMissing")
|
|
}
|
|
|
|
existingHuman, err := c.getHumanWriteModelByID(ctx, userID, resourceowner)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !isUserStateExists(existingHuman.UserState) {
|
|
return caos_errs.ThrowNotFound(nil, "COMMAND-m9cV8", "Errors.User.NotFound")
|
|
}
|
|
|
|
_, err = c.eventstore.PushEvents(ctx,
|
|
user.NewHumanMFAInitSkippedEvent(ctx, UserAggregateFromWriteModel(&existingHuman.WriteModel)))
|
|
return err
|
|
}
|
|
|
|
///TODO: adlerhurst maybe we can simplify createAddHumanEvent and createRegisterHumanEvent
|
|
func createAddHumanEvent(ctx context.Context, aggregate *eventstore.Aggregate, human *domain.Human, userLoginMustBeDomain bool) *user.HumanAddedEvent {
|
|
addEvent := user.NewHumanAddedEvent(
|
|
ctx,
|
|
aggregate,
|
|
human.Username,
|
|
human.FirstName,
|
|
human.LastName,
|
|
human.NickName,
|
|
human.DisplayName,
|
|
human.PreferredLanguage,
|
|
human.Gender,
|
|
human.EmailAddress,
|
|
userLoginMustBeDomain,
|
|
)
|
|
if human.Phone != nil {
|
|
addEvent.AddPhoneData(human.PhoneNumber)
|
|
}
|
|
if human.Address != nil {
|
|
addEvent.AddAddressData(
|
|
human.Country,
|
|
human.Locality,
|
|
human.PostalCode,
|
|
human.Region,
|
|
human.StreetAddress)
|
|
}
|
|
if human.Password != nil {
|
|
addEvent.AddPasswordData(human.SecretCrypto, human.ChangeRequired)
|
|
}
|
|
return addEvent
|
|
}
|
|
|
|
func createRegisterHumanEvent(ctx context.Context, aggregate *eventstore.Aggregate, human *domain.Human, userLoginMustBeDomain bool) *user.HumanRegisteredEvent {
|
|
addEvent := user.NewHumanRegisteredEvent(
|
|
ctx,
|
|
aggregate,
|
|
human.Username,
|
|
human.FirstName,
|
|
human.LastName,
|
|
human.NickName,
|
|
human.DisplayName,
|
|
human.PreferredLanguage,
|
|
human.Gender,
|
|
human.EmailAddress,
|
|
userLoginMustBeDomain,
|
|
)
|
|
if human.Phone != nil {
|
|
addEvent.AddPhoneData(human.PhoneNumber)
|
|
}
|
|
if human.Address != nil {
|
|
addEvent.AddAddressData(
|
|
human.Country,
|
|
human.Locality,
|
|
human.PostalCode,
|
|
human.Region,
|
|
human.StreetAddress)
|
|
}
|
|
if human.Password != nil {
|
|
addEvent.AddPasswordData(human.SecretCrypto, human.ChangeRequired)
|
|
}
|
|
return addEvent
|
|
}
|
|
|
|
func (c *Commands) HumansSignOut(ctx context.Context, agentID string, userIDs []string) error {
|
|
if agentID == "" {
|
|
return caos_errs.ThrowInvalidArgument(nil, "COMMAND-2M0ds", "Errors.User.UserIDMissing")
|
|
}
|
|
if len(userIDs) == 0 {
|
|
return caos_errs.ThrowInvalidArgument(nil, "COMMAND-M0od3", "Errors.User.UserIDMissing")
|
|
}
|
|
events := make([]eventstore.EventPusher, 0)
|
|
for _, userID := range userIDs {
|
|
existingUser, err := c.getHumanWriteModelByID(ctx, userID, "")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !isUserStateExists(existingUser.UserState) {
|
|
continue
|
|
}
|
|
events = append(events, user.NewHumanSignedOutEvent(
|
|
ctx,
|
|
UserAggregateFromWriteModel(&existingUser.WriteModel),
|
|
agentID))
|
|
}
|
|
if len(events) == 0 {
|
|
return nil
|
|
}
|
|
_, err := c.eventstore.PushEvents(ctx, events...)
|
|
return err
|
|
}
|
|
|
|
func (c *Commands) getHumanWriteModelByID(ctx context.Context, userID, resourceowner string) (*HumanWriteModel, error) {
|
|
humanWriteModel := NewHumanWriteModel(userID, resourceowner)
|
|
err := c.eventstore.FilterToQueryReducer(ctx, humanWriteModel)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return humanWriteModel, nil
|
|
}
|