mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-13 19:44:21 +00:00
3549a8b64e
* move mgmt pkg * begin package restructure * rename auth package to authz * begin start api * move auth * move admin * fix merge * configs and interceptors * interceptor * revert generate-grpc.sh * some cleanups * console * move console * fix tests and merging * js linting * merge * merging and configs * change k8s base to current ports * fixes * cleanup * regenerate proto * remove unnecessary whitespace * missing param * go mod tidy * fix merging * move login pkg * cleanup * move api pkgs again * fix pkg naming * fix generate-static.sh for login * update workflow * fixes * logging * remove duplicate * comment for optional gateway interfaces * regenerate protos * fix proto imports for grpc web * protos * grpc web generate * grpc web generate * fix changes * add translation interceptor * fix merging * regenerate mgmt proto
62 lines
2.0 KiB
Go
62 lines
2.0 KiB
Go
package eventstore
|
|
|
|
import (
|
|
"context"
|
|
"github.com/caos/zitadel/internal/authz/repository/eventsourcing/view"
|
|
"github.com/caos/zitadel/internal/crypto"
|
|
caos_errs "github.com/caos/zitadel/internal/errors"
|
|
iam_event "github.com/caos/zitadel/internal/iam/repository/eventsourcing"
|
|
proj_event "github.com/caos/zitadel/internal/project/repository/eventsourcing"
|
|
"time"
|
|
)
|
|
|
|
type TokenVerifierRepo struct {
|
|
TokenVerificationKey [32]byte
|
|
IamID string
|
|
IamEvents *iam_event.IamEventstore
|
|
ProjectEvents *proj_event.ProjectEventstore
|
|
View *view.View
|
|
}
|
|
|
|
func (repo *TokenVerifierRepo) VerifyAccessToken(ctx context.Context, tokenString, clientID string) (userID string, agentID string, err error) {
|
|
//TODO: use real key
|
|
tokenID, err := crypto.DecryptAESString(tokenString, string(repo.TokenVerificationKey[:32]))
|
|
if err != nil {
|
|
return "", "", caos_errs.ThrowPermissionDenied(nil, "APP-8EF0zZ", "invalid token")
|
|
}
|
|
token, err := repo.View.TokenByID(tokenID)
|
|
if err != nil {
|
|
return "", "", caos_errs.ThrowPermissionDenied(err, "APP-BxUSiL", "invalid token")
|
|
}
|
|
if !token.Expiration.After(time.Now().UTC()) {
|
|
return "", "", caos_errs.ThrowPermissionDenied(err, "APP-k9KS0", "invalid token")
|
|
}
|
|
|
|
for _, aud := range token.Audience {
|
|
if clientID == aud {
|
|
return token.UserID, token.UserAgentID, nil
|
|
}
|
|
}
|
|
return "", "", caos_errs.ThrowPermissionDenied(nil, "APP-Zxfako", "invalid audience")
|
|
}
|
|
|
|
func (repo *TokenVerifierRepo) ProjectIDByClientID(ctx context.Context, clientID string) (projectID string, err error) {
|
|
app, err := repo.View.ApplicationByOIDCClientID(clientID)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return app.ProjectID, nil
|
|
}
|
|
|
|
func (repo *TokenVerifierRepo) VerifierClientID(ctx context.Context, appName string) (string, error) {
|
|
iam, err := repo.IamEvents.IamByID(ctx, repo.IamID)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
app, err := repo.View.ApplicationByProjecIDAndAppName(iam.IamProjectID, appName)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return app.OIDCClientID, nil
|
|
}
|