Overview - Zitadel/zitadel

zitadel/zitadel

7 days30 days

Latest CI Pipeline Executions

Fuzzy

Succeeded
next
eeae2c60 feat: Add recovery code MFA support (#9954)  One-time recovery codes are a common multi-factor authentication (MFA) backup method, letting users access their account if they lose other MFA devices. Support for recovery codes can also reduce support burden for users locked out of their accounts and provide a more secure and reliable form of verification than security questions. # Which Problems Are Solved Zitadel currently lacks support for recovery codes. # How the Problems Are Solved This PR partially addresses recovery code support in Zitadel. Importantly, it adds recovery codes as a new 2FA `Factor` and an additional `Check` type for the Session API. ``` Example recovery code flow: 1. User generates N new recovery codes using `POST /v2/users/{user_id}/recovery_codes` 2. Zitadel hashes and stores these codes and returns the un-hashed codes in the response 3. User creates new session with an additional check: `recoveryCode` 4. Code is checked against hash and, if valid, cannot be used again 5. User attempts to adds N more codes using the same endpoint 6. If `remaining_codes + N <= RecoveryCodes->MaxCount` config value, then recovery codes are added in addition to original codes 7. User can remove all recovery codes using `DEL /v2/users/:userId/recovery_codes` ``` This PR adds: - [x] Session recovery_code check support on `POST+PATCH /v2/sessions` endpoints - [x] Adds `mfa_recovery_code_checked_at` column (default null) to `projections.sessions8` table - [x] Support for `SECOND_FACTOR_TYPE_RECOVERY_CODES` as available 2FA method on login policy - [x] Support for importing recovery codes in /import code Missing, will _not_ implement in this PR: - [ ] Admin console support for displaying Recovery Code settings for user(s) - [ ] Zitadel Typescript login support for recovery codes TODO: - [x] Additional unit and integration tests - [x] Error translations # Additional Changes None # Additional Context - Closes #6898 --------- Co-authored-by: Livio Spring <livio.a@gmail.com> (cherry picked from commit 5beeb5738a9be3cedb64e7820c6bad75ab624c2e)
3 days ago by livio-a
Failed
next
3 days ago
Succeeded
next
10a24db2 fix(email): accept SMTPUTF8 addresses (#11115) # Which Problems Are Solved Zitadel only accepted ASCII email addresses, while some users need to enter internationalized addresses. For example `möhlmann@example.com` # How the Problems Are Solved - Use `net/mail` to validate email addresses, instead of a custom regex. `net/mail` correctly accepts UTF-8 characters. - In the management/v1 API email address validation is removed (only string limits are applied) # Additional Changes - none # Additional Context Closes https://github.com/zitadel/zitadel/issues/9821
4 days ago by muhlemmer
Succeeded
next
10a24db2 fix(email): accept SMTPUTF8 addresses (#11115) # Which Problems Are Solved Zitadel only accepted ASCII email addresses, while some users need to enter internationalized addresses. For example `möhlmann@example.com` # How the Problems Are Solved - Use `net/mail` to validate email addresses, instead of a custom regex. `net/mail` correctly accepts UTF-8 characters. - In the management/v1 API email address validation is removed (only string limits are applied) # Additional Changes - none # Additional Context Closes https://github.com/zitadel/zitadel/issues/9821
4 days ago by muhlemmer
Succeeded
next
4 days ago
Succeeded
next
14a103bd linting
11 days ago by livio-a
Succeeded
next
11 days ago
Failed
next
dcbaaca1 linting and uncomment unit tests
11 days ago by livio-a
Succeeded
next
11 days ago
Failed
next
a0d71c0e fix merge
11 days ago by livio-a
Succeeded
next
11 days ago
Failed
next
91b95bb7 feat(action v2): add JWT and JWE payload type options (#11196) # Which Problems Are Solved The payload in actions V2 is currently sent as JSON to the target endpoint. It might get exposed to intermediary infrastructure or logging systems. For these scenarios there needs to be an application-layer encryption, where the provider of the endpoint can define an key to be used for the encryption. # How the Problems Are Solved - Added an additional option to the target to specify the payload type: `JSON` (current and default), `JWT`, `JWE` (api and console) - added endpoints to upload and manage public keys (to be used for encryption) for a target - updated all action v2 executions (interceptors, oidc, saml, ...) to provide the `GetActiveSigningWebKey` from queries - implemented jwt and jwe in the exections incl. refactoring of code and tests - changes to the authn_keys table: - added a `fingerprint` column - dropped not null constraint on expiration - moved the `GetSignerOnce` into its own package to prevent circular dependencies # Additional Changes None # Additional Context closes #11061 --------- Co-authored-by: Marco A. <marco@zitadel.com> Co-authored-by: conblem <mail@conblem.me> Co-authored-by: Silvan <27845747+adlerhurst@users.noreply.github.com> (cherry picked from commit 791d0587aaa72aa38c9290b88fb0a3a841a7df1a)
11 days ago by livio-a
Succeeded
next
11 days ago
Succeeded
next
6d6e96cc fix(login v1): update password verification handling (#11202) # Which Problems Are Solved Failed password attempts in login V1 potentially created new session entries. # How the Problems Are Solved Correct handling to only update existing sessions. # Additional Changes None # Additional Context - reported through support - requires backport to v4.x (cherry picked from commit d79bfe6eba2e99ee13e3de3a2e88190df527ea25)
24 days ago by livio-a
Succeeded
next
24 days ago
Succeeded
next
1b8476af fix(login): CVE-2025-55184 and CVE-2025-55183, update next (#11179) # Which Problems Are Solved Updates `next` to version `15.5.9` to address the following security vulnerabilities: - **CVE-2025-55184** - **CVE-2025-55183** # How the Problems Are Solved - Bump `next` from `15.5.7` to `15.5.9` in `apps/login/package.json` --------- Co-authored-by: PhenixH <PhenixH@users.noreply.github.com> (cherry picked from commit 2221b5ef7473a2d372f597eeb0e1878c150a4c49)
28 days ago by livio-a
Succeeded
next
28 days ago
Succeeded
next
b5829284 fix(setup): member role synchronization execution check (#11180) The change was introduced in https://github.com/zitadel/zitadel/pull/11178. The fix is to prevent wiping the memberships because the projection did not init yet. ### Changes - Introduces a check to determine if the member role synchronization should be executed based on the existence of a specific database table (`projections.instance_members4`). - Ensures that the synchronization process only runs if the required table is present in the database. (cherry picked from commit 1b54a9eb057c65596671a456d612dd30ecba43b5)
29 days ago by livio-a
Succeeded
next
29 days ago
Succeeded
next
2e09effe fix(fields): sync membership roles from projections (#11178) # Which Problems Are Solved Zitadel v4.7.2 fixed a security issue by switching to the permission v2 framework for user APIs. It appears that systems that are running since before v2.68 that were affected by a precision bug in the eventstore, which was fixed in that version. The precision bug results in certain events being "skipped" while being projected into the fields table, used by the new permission system. This caused certain membership roles to be missing, resulting in empty user lists when executed by the affected member. The permission system basically finds no matching memberships and therefore returns no users at all. # How the Problems Are Solved After research we concluded that the legacy membership projections are projected correctly. This PR synchronizes the projected state into the fields table. As the membership roles are not marked unique, all rows are first deleted and then the correct membership roles are then inserted. The operation happens in a single transaction, during which the fields table will remain locked for modifications. This to prevent possible concurrent modifications to membership states. # Additional Changes - none # Additional Context - Introduced in https://github.com/zitadel/zitadel/commit/0e17d0005a98ccbf92139961ef702ef03208ffd3 - Released in [v4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2) - Related: https://github.com/zitadel/zitadel/issues/8863 --------- Co-authored-by: Silvan <27845747+adlerhurst@users.noreply.github.com> (cherry picked from commit 58612a6ef773afe7eb286c223328e0d5a19b2f74)
29 days ago by livio-a