mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-22 07:47:29 +00:00
d8e42744b4
* fix: move eventstore pkgs * fix: move eventstore pkgs * fix: remove v2 view * fix: remove v2 view
321 lines
11 KiB
Go
321 lines
11 KiB
Go
package model
|
|
|
|
import (
|
|
"encoding/json"
|
|
"reflect"
|
|
"time"
|
|
|
|
"github.com/caos/logging"
|
|
|
|
"github.com/caos/zitadel/internal/crypto"
|
|
"github.com/caos/zitadel/internal/errors"
|
|
es_models "github.com/caos/zitadel/internal/eventstore/v1/models"
|
|
key_model "github.com/caos/zitadel/internal/key/model"
|
|
"github.com/caos/zitadel/internal/project/model"
|
|
)
|
|
|
|
type OIDCConfig struct {
|
|
es_models.ObjectRoot
|
|
Version int32 `json:"oidcVersion,omitempty"`
|
|
AppID string `json:"appId"`
|
|
ClientID string `json:"clientId,omitempty"`
|
|
ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"`
|
|
RedirectUris []string `json:"redirectUris,omitempty"`
|
|
ResponseTypes []int32 `json:"responseTypes,omitempty"`
|
|
GrantTypes []int32 `json:"grantTypes,omitempty"`
|
|
ApplicationType int32 `json:"applicationType,omitempty"`
|
|
AuthMethodType int32 `json:"authMethodType,omitempty"`
|
|
PostLogoutRedirectUris []string `json:"postLogoutRedirectUris,omitempty"`
|
|
DevMode bool `json:"devMode,omitempty"`
|
|
AccessTokenType int32 `json:"accessTokenType,omitempty"`
|
|
AccessTokenRoleAssertion bool `json:"accessTokenRoleAssertion,omitempty"`
|
|
IDTokenRoleAssertion bool `json:"idTokenRoleAssertion,omitempty"`
|
|
IDTokenUserinfoAssertion bool `json:"idTokenUserinfoAssertion,omitempty"`
|
|
ClockSkew time.Duration `json:"clockSkew,omitempty"`
|
|
ClientKeys []*ClientKey `json:"-"`
|
|
}
|
|
|
|
func (c *OIDCConfig) Changes(changed *OIDCConfig) map[string]interface{} {
|
|
changes := make(map[string]interface{}, 1)
|
|
changes["appId"] = c.AppID
|
|
if !reflect.DeepEqual(c.RedirectUris, changed.RedirectUris) {
|
|
changes["redirectUris"] = changed.RedirectUris
|
|
}
|
|
if !reflect.DeepEqual(c.ResponseTypes, changed.ResponseTypes) {
|
|
changes["responseTypes"] = changed.ResponseTypes
|
|
}
|
|
if !reflect.DeepEqual(c.GrantTypes, changed.GrantTypes) {
|
|
changes["grantTypes"] = changed.GrantTypes
|
|
}
|
|
if c.ApplicationType != changed.ApplicationType {
|
|
changes["applicationType"] = changed.ApplicationType
|
|
}
|
|
if c.AuthMethodType != changed.AuthMethodType {
|
|
changes["authMethodType"] = changed.AuthMethodType
|
|
}
|
|
if c.Version != changed.Version {
|
|
changes["oidcVersion"] = changed.Version
|
|
}
|
|
if !reflect.DeepEqual(c.PostLogoutRedirectUris, changed.PostLogoutRedirectUris) {
|
|
changes["postLogoutRedirectUris"] = changed.PostLogoutRedirectUris
|
|
}
|
|
if c.DevMode != changed.DevMode {
|
|
changes["devMode"] = changed.DevMode
|
|
}
|
|
if c.AccessTokenType != changed.AccessTokenType {
|
|
changes["accessTokenType"] = changed.AccessTokenType
|
|
}
|
|
if c.AccessTokenRoleAssertion != changed.AccessTokenRoleAssertion {
|
|
changes["accessTokenRoleAssertion"] = changed.AccessTokenRoleAssertion
|
|
}
|
|
if c.IDTokenRoleAssertion != changed.IDTokenRoleAssertion {
|
|
changes["idTokenRoleAssertion"] = changed.IDTokenRoleAssertion
|
|
}
|
|
if c.IDTokenUserinfoAssertion != changed.IDTokenUserinfoAssertion {
|
|
changes["idTokenUserinfoAssertion"] = changed.IDTokenUserinfoAssertion
|
|
}
|
|
if c.ClockSkew != changed.ClockSkew {
|
|
changes["clockSkew"] = changed.ClockSkew
|
|
}
|
|
return changes
|
|
}
|
|
|
|
func OIDCConfigFromModel(config *model.OIDCConfig) *OIDCConfig {
|
|
responseTypes := make([]int32, len(config.ResponseTypes))
|
|
for i, rt := range config.ResponseTypes {
|
|
responseTypes[i] = int32(rt)
|
|
}
|
|
grantTypes := make([]int32, len(config.GrantTypes))
|
|
for i, rt := range config.GrantTypes {
|
|
grantTypes[i] = int32(rt)
|
|
}
|
|
return &OIDCConfig{
|
|
ObjectRoot: config.ObjectRoot,
|
|
AppID: config.AppID,
|
|
Version: int32(config.OIDCVersion),
|
|
ClientID: config.ClientID,
|
|
ClientSecret: config.ClientSecret,
|
|
RedirectUris: config.RedirectUris,
|
|
ResponseTypes: responseTypes,
|
|
GrantTypes: grantTypes,
|
|
ApplicationType: int32(config.ApplicationType),
|
|
AuthMethodType: int32(config.AuthMethodType),
|
|
PostLogoutRedirectUris: config.PostLogoutRedirectUris,
|
|
DevMode: config.DevMode,
|
|
AccessTokenType: int32(config.AccessTokenType),
|
|
AccessTokenRoleAssertion: config.AccessTokenRoleAssertion,
|
|
IDTokenRoleAssertion: config.IDTokenRoleAssertion,
|
|
IDTokenUserinfoAssertion: config.IDTokenUserinfoAssertion,
|
|
ClockSkew: config.ClockSkew,
|
|
}
|
|
}
|
|
|
|
func OIDCConfigToModel(config *OIDCConfig) *model.OIDCConfig {
|
|
responseTypes := make([]model.OIDCResponseType, len(config.ResponseTypes))
|
|
for i, rt := range config.ResponseTypes {
|
|
responseTypes[i] = model.OIDCResponseType(rt)
|
|
}
|
|
grantTypes := make([]model.OIDCGrantType, len(config.GrantTypes))
|
|
for i, rt := range config.GrantTypes {
|
|
grantTypes[i] = model.OIDCGrantType(rt)
|
|
}
|
|
oidcConfig := &model.OIDCConfig{
|
|
ObjectRoot: config.ObjectRoot,
|
|
AppID: config.AppID,
|
|
OIDCVersion: model.OIDCVersion(config.Version),
|
|
ClientID: config.ClientID,
|
|
ClientSecret: config.ClientSecret,
|
|
RedirectUris: config.RedirectUris,
|
|
ResponseTypes: responseTypes,
|
|
GrantTypes: grantTypes,
|
|
ApplicationType: model.OIDCApplicationType(config.ApplicationType),
|
|
AuthMethodType: model.OIDCAuthMethodType(config.AuthMethodType),
|
|
PostLogoutRedirectUris: config.PostLogoutRedirectUris,
|
|
DevMode: config.DevMode,
|
|
AccessTokenType: model.OIDCTokenType(config.AccessTokenType),
|
|
AccessTokenRoleAssertion: config.AccessTokenRoleAssertion,
|
|
IDTokenRoleAssertion: config.IDTokenRoleAssertion,
|
|
IDTokenUserinfoAssertion: config.IDTokenUserinfoAssertion,
|
|
ClockSkew: config.ClockSkew,
|
|
ClientKeys: ClientKeysToModel(config.ClientKeys),
|
|
}
|
|
oidcConfig.FillCompliance()
|
|
return oidcConfig
|
|
}
|
|
|
|
func (p *Project) appendAddOIDCConfigEvent(event *es_models.Event) error {
|
|
config := new(OIDCConfig)
|
|
err := config.setData(event)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
config.ObjectRoot.CreationDate = event.CreationDate
|
|
if i, a := GetApplication(p.Applications, config.AppID); a != nil {
|
|
p.Applications[i].Type = int32(model.AppTypeOIDC)
|
|
p.Applications[i].OIDCConfig = config
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (p *Project) appendChangeOIDCConfigEvent(event *es_models.Event) error {
|
|
config := new(OIDCConfig)
|
|
err := config.setData(event)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if i, a := GetApplication(p.Applications, config.AppID); a != nil {
|
|
return p.Applications[i].OIDCConfig.setData(event)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (p *Project) appendAddClientKeyEvent(event *es_models.Event) error {
|
|
key := new(ClientKey)
|
|
err := key.SetData(event)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if i, a := GetApplication(p.Applications, key.ApplicationID); a != nil {
|
|
if a.OIDCConfig != nil {
|
|
p.Applications[i].OIDCConfig.ClientKeys = append(p.Applications[i].OIDCConfig.ClientKeys, key)
|
|
}
|
|
if a.APIConfig != nil {
|
|
p.Applications[i].APIConfig.ClientKeys = append(p.Applications[i].APIConfig.ClientKeys, key)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (p *Project) appendRemoveClientKeyEvent(event *es_models.Event) error {
|
|
key := new(ClientKey)
|
|
err := key.SetData(event)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if i, a := GetApplication(p.Applications, key.ApplicationID); a != nil {
|
|
if a.OIDCConfig != nil {
|
|
if j, k := GetClientKey(p.Applications[i].OIDCConfig.ClientKeys, key.KeyID); k != nil {
|
|
p.Applications[i].OIDCConfig.ClientKeys[j] = p.Applications[i].OIDCConfig.ClientKeys[len(p.Applications[i].OIDCConfig.ClientKeys)-1]
|
|
p.Applications[i].OIDCConfig.ClientKeys[len(p.Applications[i].OIDCConfig.ClientKeys)-1] = nil
|
|
p.Applications[i].OIDCConfig.ClientKeys = p.Applications[i].OIDCConfig.ClientKeys[:len(p.Applications[i].OIDCConfig.ClientKeys)-1]
|
|
}
|
|
}
|
|
if a.APIConfig != nil {
|
|
if j, k := GetClientKey(p.Applications[i].APIConfig.ClientKeys, key.KeyID); k != nil {
|
|
p.Applications[i].APIConfig.ClientKeys[j] = p.Applications[i].APIConfig.ClientKeys[len(p.Applications[i].APIConfig.ClientKeys)-1]
|
|
p.Applications[i].APIConfig.ClientKeys[len(p.Applications[i].APIConfig.ClientKeys)-1] = nil
|
|
p.Applications[i].APIConfig.ClientKeys = p.Applications[i].APIConfig.ClientKeys[:len(p.Applications[i].APIConfig.ClientKeys)-1]
|
|
}
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (o *OIDCConfig) setData(event *es_models.Event) error {
|
|
o.ObjectRoot.AppendEvent(event)
|
|
if err := json.Unmarshal(event.Data, o); err != nil {
|
|
logging.Log("EVEN-d8e3s").WithError(err).Error("could not unmarshal event data")
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func GetClientKey(keys []*ClientKey, id string) (int, *ClientKey) {
|
|
for i, k := range keys {
|
|
if k.KeyID == id {
|
|
return i, k
|
|
}
|
|
}
|
|
return -1, nil
|
|
}
|
|
|
|
type ClientKey struct {
|
|
es_models.ObjectRoot `json:"-"`
|
|
ApplicationID string `json:"applicationId,omitempty"`
|
|
ClientID string `json:"clientId,omitempty"`
|
|
KeyID string `json:"keyId,omitempty"`
|
|
Type int32 `json:"type,omitempty"`
|
|
ExpirationDate time.Time `json:"expirationDate,omitempty"`
|
|
PublicKey []byte `json:"publicKey,omitempty"`
|
|
privateKey []byte
|
|
}
|
|
|
|
func (key *ClientKey) SetData(event *es_models.Event) error {
|
|
key.ObjectRoot.AppendEvent(event)
|
|
if err := json.Unmarshal(event.Data, key); err != nil {
|
|
logging.Log("EVEN-SADdg").WithError(err).Error("could not unmarshal event data")
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (key *ClientKey) AppendEvents(events ...*es_models.Event) error {
|
|
for _, event := range events {
|
|
err := key.AppendEvent(event)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (key *ClientKey) AppendEvent(event *es_models.Event) (err error) {
|
|
key.ObjectRoot.AppendEvent(event)
|
|
switch event.Type {
|
|
case ClientKeyAdded:
|
|
err = json.Unmarshal(event.Data, key)
|
|
if err != nil {
|
|
return errors.ThrowInternal(err, "MODEL-Fetg3", "Errors.Internal")
|
|
}
|
|
case ClientKeyRemoved:
|
|
key.ExpirationDate = event.CreationDate
|
|
}
|
|
return err
|
|
}
|
|
|
|
func ClientKeyFromModel(key *model.ClientKey) *ClientKey {
|
|
return &ClientKey{
|
|
ObjectRoot: key.ObjectRoot,
|
|
ExpirationDate: key.ExpirationDate,
|
|
ApplicationID: key.ApplicationID,
|
|
ClientID: key.ClientID,
|
|
KeyID: key.KeyID,
|
|
Type: int32(key.Type),
|
|
}
|
|
}
|
|
|
|
func ClientKeysToModel(keys []*ClientKey) []*model.ClientKey {
|
|
clientKeys := make([]*model.ClientKey, len(keys))
|
|
for i, key := range keys {
|
|
clientKeys[i] = ClientKeyToModel(key)
|
|
}
|
|
return clientKeys
|
|
}
|
|
|
|
func ClientKeyToModel(key *ClientKey) *model.ClientKey {
|
|
return &model.ClientKey{
|
|
ObjectRoot: key.ObjectRoot,
|
|
ExpirationDate: key.ExpirationDate,
|
|
ApplicationID: key.ApplicationID,
|
|
ClientID: key.ClientID,
|
|
KeyID: key.KeyID,
|
|
PrivateKey: key.privateKey,
|
|
Type: key_model.AuthNKeyType(key.Type),
|
|
}
|
|
}
|
|
|
|
func (key *ClientKey) GenerateClientKeyPair(keySize int) error {
|
|
privateKey, publicKey, err := crypto.GenerateKeyPair(keySize)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
key.PublicKey, err = crypto.PublicKeyToBytes(publicKey)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
key.privateKey = crypto.PrivateKeyToBytes(privateKey)
|
|
return nil
|
|
}
|