From 604c118e0810e385a5655491836ec921a97cb636 Mon Sep 17 00:00:00 2001 From: Ramkumar Chinchani Date: Tue, 30 Jul 2024 21:34:11 +0000 Subject: [PATCH] chore: update deps to github.com/zitadel/oidc/v3 Signed-off-by: Ramkumar Chinchani --- go.mod | 7 ++++--- go.sum | 20 ++++++++++++-------- pkg/api/authn.go | 12 ++++++------ pkg/api/controller.go | 2 +- pkg/api/routes.go | 30 +++++++++++++++--------------- pkg/api/routes_test.go | 4 ++-- 6 files changed, 40 insertions(+), 35 deletions(-) diff --git a/go.mod b/go.mod index 851ef252c8..9c5f30e8e8 100644 --- a/go.mod +++ b/go.mod @@ -58,7 +58,7 @@ require ( github.com/project-zot/mockoidc v0.0.0-20240610203808-d69d9e02020a github.com/sigstore/cosign/v2 v2.3.0 github.com/swaggo/http-swagger v1.3.4 - github.com/zitadel/oidc v1.13.5 + github.com/zitadel/oidc/v3 v3.26.0 golang.org/x/oauth2 v0.21.0 modernc.org/sqlite v1.31.1 oras.land/oras-go/v2 v2.5.0 @@ -175,6 +175,7 @@ require ( github.com/moby/sys/user v0.2.0 // indirect github.com/moby/term v0.5.0 // indirect github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect + github.com/muhlemmer/gu v0.3.1 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect github.com/ncruces/go-strftime v0.1.9 // indirect @@ -210,6 +211,8 @@ require ( github.com/xeipuuv/gojsonschema v1.2.0 // indirect github.com/xlab/treeprint v1.2.0 // indirect github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect + github.com/zitadel/logging v0.6.0 // indirect + github.com/zitadel/schema v1.3.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.52.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0 // indirect go.opentelemetry.io/otel/metric v1.28.0 // indirect @@ -362,7 +365,6 @@ require ( github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect github.com/googleapis/gax-go/v2 v2.12.5 // indirect github.com/gopherjs/gopherjs v1.17.2 // indirect - github.com/gorilla/schema v1.4.1 // indirect github.com/gorilla/websocket v1.5.0 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect @@ -483,7 +485,6 @@ require ( gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.67.0 // indirect - gopkg.in/square/go-jose.v2 v2.6.0 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect k8s.io/api v0.30.2 // indirect diff --git a/go.sum b/go.sum index 28509d1c55..c14a170c56 100644 --- a/go.sum +++ b/go.sum @@ -682,6 +682,8 @@ github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec= github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ= +github.com/go-chi/chi/v5 v5.1.0 h1:acVI1TYaD+hhedDJ3r54HyA6sExp3HfXq7QWEEY/xMw= +github.com/go-chi/chi/v5 v5.1.0/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8= github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA= github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= @@ -932,8 +934,6 @@ github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyE github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w= github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI= github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So= -github.com/gorilla/schema v1.4.1 h1:jUg5hUjCSDZpNGLuXQOgIWGdlgrIdYvgQ0wZtdK1M3E= -github.com/gorilla/schema v1.4.1/go.mod h1:Dg5SSm5PV60mhF2NFaTV1xuYYj8tV8NOPRo4FggUMnM= github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4= github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA= github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo= @@ -1198,6 +1198,10 @@ github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A= github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc= github.com/mozillazg/docker-credential-acr-helper v0.3.0 h1:DVWFZ3/O8BP6Ue3iS/Olw+G07u1hCq1EOVCDZZjCIBI= github.com/mozillazg/docker-credential-acr-helper v0.3.0/go.mod h1:cZlu3tof523ujmLuiNUb6JsjtHcNA70u1jitrrdnuyA= +github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM= +github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM= +github.com/muhlemmer/httpforwarded v0.1.0 h1:x4DLrzXdliq8mprgUMR0olDvHGkou5BJsK/vWUetyzY= +github.com/muhlemmer/httpforwarded v0.1.0/go.mod h1:yo9czKedo2pdZhoXe+yDkGVbU0TJ0q9oQ90BVoDEtw0= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= @@ -1560,10 +1564,12 @@ github.com/zclconf/go-cty-yaml v1.0.3 h1:og/eOQ7lvA/WWhHGFETVWNduJM7Rjsv2RRpx1sd github.com/zclconf/go-cty-yaml v1.0.3/go.mod h1:9YLUH4g7lOhVWqUbctnVlZ5KLpg7JAprQNgxSZ1Gyxs= github.com/zeebo/errs v1.3.0 h1:hmiaKqgYZzcVgRL1Vkc1Mn2914BbzB0IBxs+ebeutGs= github.com/zeebo/errs v1.3.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4= -github.com/zitadel/logging v0.3.4 h1:9hZsTjMMTE3X2LUi0xcF9Q9EdLo+FAezeu52ireBbHM= -github.com/zitadel/logging v0.3.4/go.mod h1:aPpLQhE+v6ocNK0TWrBrd363hZ95KcI17Q1ixAQwZF0= -github.com/zitadel/oidc v1.13.5 h1:7jhh68NGZitLqwLiVU9Dtwa4IraJPFF1vS+4UupO93U= -github.com/zitadel/oidc v1.13.5/go.mod h1:rHs1DhU3Sv3tnI6bQRVlFa3u0lCwtR7S21WHY+yXgPA= +github.com/zitadel/logging v0.6.0 h1:t5Nnt//r+m2ZhhoTmoPX+c96pbMarqJvW1Vq6xFTank= +github.com/zitadel/logging v0.6.0/go.mod h1:Y4CyAXHpl3Mig6JOszcV5Rqqsojj+3n7y2F591Mp/ow= +github.com/zitadel/oidc/v3 v3.26.0 h1:BG3OUK+JpuKz7YHJIyUxL5Sl2JV6ePkG42UP4Xv3J2w= +github.com/zitadel/oidc/v3 v3.26.0/go.mod h1:Cx6AYPTJO5q2mjqF3jaknbKOUjpq1Xui0SYvVhkKuXU= +github.com/zitadel/schema v1.3.0 h1:kQ9W9tvIwZICCKWcMvCEweXET1OcOyGEuFbHs4o5kg0= +github.com/zitadel/schema v1.3.0/go.mod h1:NptN6mkBDFvERUCvZHlvWmmME+gmZ44xzwRXwhzsbtc= go.etcd.io/bbolt v1.3.10 h1:+BqfJTcCzTItrop8mq/lbzL8wSGtj94UO/3U31shqG0= go.etcd.io/bbolt v1.3.10/go.mod h1:bK3UQLPJZly7IlNmV7uVHJDxfe5aK9Ll93e/74Y9oEQ= go.mongodb.org/mongo-driver v1.14.0 h1:P98w8egYRjYe3XDjxhYJagTokP/H6HzlsnojRgZRd80= @@ -2228,8 +2234,6 @@ gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA= gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/resty.v1 v1.12.0 h1:CuXP0Pjfw9rOuY6EP+UvtNvt5DSqHpIxILZKT/quCZI= gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo= -gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI= -gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME= diff --git a/pkg/api/authn.go b/pkg/api/authn.go index 0813273e27..dca550f38e 100644 --- a/pkg/api/authn.go +++ b/pkg/api/authn.go @@ -25,9 +25,9 @@ import ( "github.com/gorilla/securecookie" "github.com/gorilla/sessions" godigest "github.com/opencontainers/go-digest" - "github.com/zitadel/oidc/pkg/client/rp" - httphelper "github.com/zitadel/oidc/pkg/http" - "github.com/zitadel/oidc/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/client/rp" + httphelper "github.com/zitadel/oidc/v3/pkg/http" + "github.com/zitadel/oidc/v3/pkg/oidc" "golang.org/x/crypto/bcrypt" "golang.org/x/oauth2" githubOAuth "golang.org/x/oauth2/github" @@ -334,7 +334,7 @@ func (amw *AuthnMiddleware) tryAuthnHandlers(ctlr *Controller) mux.MiddlewareFun for provider := range ctlr.Config.HTTP.Auth.OpenID.Providers { if config.IsOpenIDSupported(provider) { - rp := NewRelyingPartyOIDC(ctlr.Config, provider, ctlr.Log) + rp := NewRelyingPartyOIDC(context.TODO(), ctlr.Config, provider, ctlr.Log) ctlr.RelyingParties[provider] = rp } else if config.IsOauth2Supported(provider) { rp := NewRelyingPartyGithub(ctlr.Config, provider, ctlr.Log) @@ -610,10 +610,10 @@ func (rh *RouteHandler) AuthURLHandler() http.HandlerFunc { } } -func NewRelyingPartyOIDC(config *config.Config, provider string, log log.Logger) rp.RelyingParty { +func NewRelyingPartyOIDC(ctx context.Context, config *config.Config, provider string, log log.Logger) rp.RelyingParty { issuer, clientID, clientSecret, redirectURI, scopes, options := getRelyingPartyArgs(config, provider, log) - relyingParty, err := rp.NewRelyingPartyOIDC(issuer, clientID, clientSecret, redirectURI, scopes, options...) + relyingParty, err := rp.NewRelyingPartyOIDC(ctx, issuer, clientID, clientSecret, redirectURI, scopes, options...) if err != nil { log.Panic().Err(err).Str("issuer", issuer).Str("redirectURI", redirectURI).Strs("scopes", scopes). Msg("failed to get new relying party oicd") diff --git a/pkg/api/controller.go b/pkg/api/controller.go index 8408f4c99e..5a6d37a0eb 100644 --- a/pkg/api/controller.go +++ b/pkg/api/controller.go @@ -15,7 +15,7 @@ import ( "time" "github.com/gorilla/mux" - "github.com/zitadel/oidc/pkg/client/rp" + "github.com/zitadel/oidc/v3/pkg/client/rp" "zotregistry.dev/zot/errors" "zotregistry.dev/zot/pkg/api/config" diff --git a/pkg/api/routes.go b/pkg/api/routes.go index e4da26fec3..b3468edbbb 100644 --- a/pkg/api/routes.go +++ b/pkg/api/routes.go @@ -29,8 +29,8 @@ import ( "github.com/opencontainers/distribution-spec/specs-go/v1/extensions" godigest "github.com/opencontainers/go-digest" ispec "github.com/opencontainers/image-spec/specs-go/v1" - "github.com/zitadel/oidc/pkg/client/rp" - "github.com/zitadel/oidc/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/client/rp" + "github.com/zitadel/oidc/v3/pkg/oidc" zerr "zotregistry.dev/zot/errors" "zotregistry.dev/zot/pkg/api/config" @@ -77,10 +77,10 @@ func (rh *RouteHandler) SetupRoutes() { for provider, relyingParty := range rh.c.RelyingParties { if config.IsOauth2Supported(provider) { rh.c.Router.HandleFunc(constants.CallbackBasePath+"/"+provider, - rp.CodeExchangeHandler(rh.GithubCodeExchangeCallback(), relyingParty)) + rp.CodeExchangeHandler(GithubCodeExchangeCallback(rh.c), relyingParty)) } else if config.IsOpenIDSupported(provider) { rh.c.Router.HandleFunc(constants.CallbackBasePath+"/"+provider, - rp.CodeExchangeHandler(rp.UserinfoCallback(rh.OpenIDCodeExchangeCallback()), relyingParty)) + rp.CodeExchangeHandler(rp.UserinfoCallback(OpenIDCodeExchangeCallback(rh.c)), relyingParty)) } } } @@ -1873,22 +1873,22 @@ func (rh *RouteHandler) Logout(response http.ResponseWriter, request *http.Reque } // github Oauth2 CodeExchange callback. -func (rh *RouteHandler) GithubCodeExchangeCallback() rp.CodeExchangeCallback { +func GithubCodeExchangeCallback[C oidc.IDClaims](c *Controller) rp.CodeExchangeCallback[C] { return func(w http.ResponseWriter, r *http.Request, - tokens *oidc.Tokens, state string, relyingParty rp.RelyingParty, + tokens *oidc.Tokens[C], state string, relyingParty rp.RelyingParty, ) { ctx := r.Context() client := github.NewClient(relyingParty.OAuthConfig().Client(ctx, tokens.Token)) - email, groups, err := GetGithubUserInfo(ctx, client, rh.c.Log) + email, groups, err := GetGithubUserInfo(ctx, client, c.Log) if email == "" || err != nil { w.WriteHeader(http.StatusUnauthorized) return } - callbackUI, err := OAuth2Callback(rh.c, w, r, state, email, groups) //nolint: contextcheck + callbackUI, err := OAuth2Callback(c, w, r, state, email, groups) //nolint: contextcheck if err != nil { if errors.Is(err, zerr.ErrInvalidStateCookie) { w.WriteHeader(http.StatusUnauthorized) @@ -1908,13 +1908,13 @@ func (rh *RouteHandler) GithubCodeExchangeCallback() rp.CodeExchangeCallback { } // Openid CodeExchange callback. -func (rh *RouteHandler) OpenIDCodeExchangeCallback() rp.CodeExchangeUserinfoCallback { - return func(w http.ResponseWriter, r *http.Request, tokens *oidc.Tokens, state string, +func OpenIDCodeExchangeCallback[C oidc.IDClaims, U rp.SubjectGetter](c *Controller) rp.CodeExchangeUserinfoCallback[C, U] { + return func(w http.ResponseWriter, r *http.Request, tokens *oidc.Tokens[C], state string, relyingParty rp.RelyingParty, info oidc.UserInfo, ) { - email := info.GetEmail() + email := info.UserInfoEmail.Email if email == "" { - rh.c.Log.Error().Msg("failed to set user record for empty email value") + c.Log.Error().Msg("failed to set user record for empty email value") w.WriteHeader(http.StatusUnauthorized) return @@ -1922,16 +1922,16 @@ func (rh *RouteHandler) OpenIDCodeExchangeCallback() rp.CodeExchangeUserinfoCall var groups []string - val, ok := info.GetClaim("groups").([]interface{}) + val, ok := info.Claims["groups"].([]interface{}) if !ok { - rh.c.Log.Info().Msgf("failed to find any 'groups' claim for user %s", email) + c.Log.Info().Msgf("failed to find any 'groups' claim for user %s", email) } for _, group := range val { groups = append(groups, fmt.Sprint(group)) } - callbackUI, err := OAuth2Callback(rh.c, w, r, state, email, groups) + callbackUI, err := OAuth2Callback(c, w, r, state, email, groups) if err != nil { if errors.Is(err, zerr.ErrInvalidStateCookie) { w.WriteHeader(http.StatusUnauthorized) diff --git a/pkg/api/routes_test.go b/pkg/api/routes_test.go index 3de2521553..0669fd9cf5 100644 --- a/pkg/api/routes_test.go +++ b/pkg/api/routes_test.go @@ -19,8 +19,8 @@ import ( ispec "github.com/opencontainers/image-spec/specs-go/v1" "github.com/project-zot/mockoidc" . "github.com/smartystreets/goconvey/convey" - "github.com/zitadel/oidc/pkg/client/rp" - "github.com/zitadel/oidc/pkg/oidc" + "github.com/zitadel/oidc/v3/pkg/client/rp" + "github.com/zitadel/oidc/v3/pkg/oidc" "golang.org/x/oauth2" zerr "zotregistry.dev/zot/errors"