mirror of
https://github.com/zitadel/zitadel.git
synced 2025-12-23 03:47:43 +00:00
ca510c52dd
# Which Problems Are Solved When the webkey feature flag was not enabled before an upgrade to v4, all JWT tokens became invalid. This created a couple of issues: - All users with JWT access tokens are logged-out - Clients that are unable to refresh keys based on key ID break - id_token_hint could no longer be validated. # How the Problems Are Solved Force-enable the webkey feature on the v3 version, so that the upgrade path is cleaner. Sessions now have time to role-over to the new keys before initiating the upgrade to v4. # Additional Changes - none # Additional Context - Related https://github.com/zitadel/zitadel/issues/10673 --------- Co-authored-by: Livio Spring <livio.a@gmail.com>
54 lines
1.4 KiB
Go
54 lines
1.4 KiB
Go
package setup
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/muhlemmer/gu"
|
|
"github.com/zitadel/logging"
|
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
|
"github.com/zitadel/zitadel/internal/command"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
"github.com/zitadel/zitadel/internal/repository/instance"
|
|
)
|
|
|
|
type SetupWebkeys struct {
|
|
eventstore *eventstore.Eventstore
|
|
commands *command.Commands
|
|
}
|
|
|
|
func (mig *SetupWebkeys) Execute(ctx context.Context, _ eventstore.Event) error {
|
|
instances, err := mig.eventstore.InstanceIDs(
|
|
ctx,
|
|
eventstore.NewSearchQueryBuilder(eventstore.ColumnsInstanceIDs).
|
|
OrderDesc().
|
|
AddQuery().
|
|
AggregateTypes(instance.AggregateType).
|
|
EventTypes(instance.InstanceAddedEventType).
|
|
Builder().ExcludeAggregateIDs().
|
|
AggregateTypes(instance.AggregateType).
|
|
EventTypes(instance.InstanceRemovedEventType).
|
|
Builder(),
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("%s get instance IDs: %w", mig, err)
|
|
}
|
|
|
|
for _, instance := range instances {
|
|
ctx := authz.WithInstanceID(ctx, instance)
|
|
logging.Info("prepare initial webkeys for instance", "instance_id", instance, "migration", mig)
|
|
_, err := mig.commands.SetInstanceFeatures(ctx, &command.InstanceFeatures{
|
|
WebKey: gu.Ptr(true),
|
|
})
|
|
if err != nil {
|
|
return fmt.Errorf("%s set webkey instance feature: %w", mig, err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (mig *SetupWebkeys) String() string {
|
|
return "59_setup_webkeys_2"
|
|
}
|