Overview - Zitadel/zitadel

zitadel/zitadel

7 days30 days

Latest CI Pipeline Executions

Fuzzy

Succeeded
examples_sdks
d365eccc docs: update example titles
8 days ago by hifabienne
Succeeded
examples_sdks
d365eccc Merge 5dcae4781786a66d9e4542478ab7157c4c85f2fa into 11d48edd84de9ebc28609c01fa2290aaddf4e555
8 days ago by hifabienne
Succeeded
examples_sdks
8 days ago
Succeeded
examples_sdks
8 days ago
Succeeded
examples_sdks
6fe0b45f fix(login): update login logic to correctly handle email and phone re… (#11618) ## Problem Enabling `Disable Phone Login` (or `Disable Email Login`) in the login policy caused some users to receive "User not found in the system" even when logging in with a valid, non-phone identifier. Users whose preferred login name looked like an email address (e.g. `user@test.com` in an org-scoped context) were rejected incorrectly. Toggling the setting back off immediately restored login for those users. Fixes #11518 ## Root Cause In `loginname.ts` and `password.ts`, the post-lookup guard that enforces the disable-phone/email restriction used `||` instead of `&&`: ```ts // BEFORE (buggy): rejects if preferredLoginName doesn't match OR email doesn't match // → any user whose preferredLoginName ≠ raw email is rejected if (user.preferredLoginName !== concatLoginname || humanUser?.email?.email !== command.loginName) { return preventUserEnumeration(...); } // AFTER (correct): rejects only if preferredLoginName doesn't match AND email doesn't match // → user passes through if they matched by either their preferred login name or their email if (user.preferredLoginName !== concatLoginname && humanUser?.email?.email !== command.loginName) { return preventUserEnumeration(...); } ``` The intent is to allow the user through if they matched by their preferred login name **or** by the still-permitted identifier. By De Morgan's law, the rejection condition must be `¬A ∧ ¬B`, not `¬A ∨ ¬B`. ## Changes - **`loginname.ts`**: fixed 2 `||` → `&&` in the `disableLoginWithEmail` and `disableLoginWithPhone` guards - **`password.ts`**: fixed 4 `||` → `&&` across the same guards in both `resetPassword` and `sendPassword` - **`loginname.test.ts`**: added two regression tests: - `disableLoginWithPhone=true`, user logs in with their email-format preferred login name → must succeed (was broken) - `disableLoginWithPhone=true`, user logs in with their actual phone number → must be blocked (feature still works) ## Testing All 654 unit tests pass. Co-authored-by: Max Peintner <max@caos.ch>
8 days ago by hifabienne
Succeeded
examples_sdks
6fe0b45f Merge 8ad041566bf6c95d6085561f80093aa8fc392bd7 into 11d48edd84de9ebc28609c01fa2290aaddf4e555
8 days ago by hifabienne
Succeeded
examples_sdks
8 days ago
Succeeded
examples_sdks
a5a88094 docs: update sdks section
13 days ago by mridang
Succeeded
examples_sdks
a5a88094 Merge ae9b1a378ca90e8b04d719ed7e24aa61d62146a7 into b0609aa861cba58f9176157c5f32d1494b6dae0c
13 days ago by mridang
Succeeded
examples_sdks
13 days ago
Succeeded
examples_sdks
952de3fd docs: update sdks section
13 days ago by hifabienne
Succeeded
examples_sdks
952de3fd Merge c1df0fd6ac0279dc7d7b5e39cecc3f61e1a2ef86 into b0609aa861cba58f9176157c5f32d1494b6dae0c
13 days ago by hifabienne
Succeeded
examples_sdks
13 days ago
Succeeded
examples_sdks
14 days ago
Succeeded
examples_sdks
14 days ago