Introduce Flowpilot - integration #1532

Co-authored-by: Frederic Jahn <[email protected]>

The hook creating users is not aware of whether a user skipped passkey onboarding. In case of a skip no credential is created but the hook assumes there is a stringified credential avalable on the stash. It attempts to unmarshal it but this fails. This commit fixes it by first checking if a credential exists on the stash.

* fix: email regex match on empty or nil input value Input validation currently attempts a regex match on email input values even if the input is optional but empty or nil. The match fails and validation returns an error. This commit fixes it by first checking if the input is optional and whether it has an empty or nil value. * fix: email input regex validation when input is required

Skipping is now controlled by a boolean in the stash and is only available after a passcode verification or password registration.

The persister now loads the password credential from the DB. It also loads the webauthn credential transports from the DB now.

When generating the response after an action execution, schema generation and initialization of actions for the next state are skipped if the execution result already contains an execution schema (which should be the case if the action executed successfully). This leads to problems when the action that was executed is also an action for the next state (which is the case for profile actions, where e.g. after deleting an email the flow returns to the profile init state, which again may offer to execute the same action again, i.e. delete additional emails): if the action execution leads to a state (of data) where the "next execution" for the same action then should be suspended and the action should not be part of the response (e.g. when trying to delete the last webauthn credential if webauthn is the only auth method configured), then skipping the initialization results in creating a response based on old/stale data, i.e. the action is part of the response and is "offered" as a valid action when it actually should not. This commit fixes that by removing the check for an existing exexution. This has the drawback that the action is initialized twice.

This should no longer required due to the dedicated profile dto struct.

Rename the hook to make it more obvious that it is resonsible for persisting the verification status for an email after verification. Move it to the shared package because the login flow also needs it, e.g. if email verification was activated retroactively and users logging in with previously unverified email addresses also correctly have said email's verification status set to verified. Add a noop case if the email address already exists and is also already verfified.

Skipping schema generation for the next state actions if the schema already existed was previously removed. This results in errors added to inputs during execution not being part of the response because a new schema without error information was generated. This change reverts this. If any action changes data such that it leads to a state of data where the same action should be suspended for the next execution (esp. in case of the profile where successful actions result in the same state as the previous one and where the same action might be part of the available actions) then the action can/should now check the new state of data for suspension during execution and then set a flag on the context/execution result accordingly (capabilites to do so are introduced with these changes). Schema generation is then skipped if there already is a schema and if the suspension flag is set to true.

Allow hooks to be run before each action. Introduce Finalize interface method for actions.

* fix: nil pointer exception when accessing the flow error

* feat: passcode handling when email is unknown * feat: new passcode templates and improved behaviour to prevent email address enumeration

Co-authored-by: Frederic Jahn <[email protected]>

- Modifies the send_capabilities action by adding a new input for providing information about availability of conditional mediation on a client and stashing the value for further use. - Adds and applies a login flow hook that generates WebAuthn request options before the login_init state if conditional mediation is available (see point above) and applies the options to the response payload. - Applies the existing action for verifying a WebAuthn assertion to the login_init state. Because said action is now used on both mediated and un-mediated logins, it needs to know both the state the flow is in and the information about mediation availability in order to correctly suspend the action in the login_init state. Therefore I extended the InitalizationContext interface with a method to check whether the current state of a flow equals some other state. For this to work, the default implementation of the InitalizationContext had to be extended with a field to hold the FlowModel in order to have access to state information.

* feat: introduce flow-api sdk and adjust the response --------- Co-authored-by: merlindru <[email protected]>

…e' (#1437)

* chore: add back-action to the password creation state * fix: webauthn service errors corrected * chore: add back-action to the login passkey state * fix: the 'public_key' input of the verify attestation action is a string type * chore: add back-action to the profile verify attestation state * chore: set default PublicActions to the PublicResponse struct, when creating a flow result * fix: after state hook to persist webauthn creds returns an error * chore: also introduce the back-action to the passkey onboarding subflow

* fix: nil pointer exception while validating min and max length * chore: change public_key input type to json * chore: add the actual username to the related input field * chore: add a value for max_length to the password input

* feat: add user data to payload on success * Update backend/flow_api/flow/shared/hook_get_user_data.go Co-authored-by: Lennart Fleischmann <[email protected]> --------- Co-authored-by: Lennart Fleischmann <[email protected]>

* feat: hanko elements with flow api

* feat: try to add condUI * adjust abort signal handling * fix: do not show cui on registration input * chore: remove unnecessary code * chore: remove comments --------- Co-authored-by: bjoern-m <[email protected]>

…ion cycles

Current logic did not take into account whether auth methods/user details are enabled or not.

…orking when multiple hanko elements are embedded on a single page

* feat: add thirdparty login to elements * chore: remove todo

…ic...'

The current user's username is updated with the new provided username before we know whether the it is already used by another user. This commit postpones setting the username until after the approriate check for a duplicate is made.

* rework sub-flow behaviour and introduce after-flow-hooks

…date

… query param name

This reverts commit 7295a04.

… deletion is not possible

* feat: add flow api logging * chore: remove log

* fix: check email limit in profile * fix: check email length in profile * fix: check passkey limit in profile * fix: set passcode_template when adding an email at login * feat: increase flow TTL * feat: add debug flag to config * feat: add password & token exchange rate limiting * fix: fix password & exchange token rate limiting * fix: check if email already exists check if the email address already exists before storing it in the DB when the user should/must add an email address in a login flow.

…words are disabled

…profile

…stash-data Compress stash data

This commit fixes the following issues: - Generation of onboarding states on registration does not consider all possible values for the acquire_on_registration configuration option. - Generation of onboarding states on login does not consider WebAuthn availability/capability.

…cription

Co-authored-by: Frederic Jahn <[email protected]>

… doc

* chore: change default value of convertLegacyConfig * chore: remove double validation of config parameter * docs: fix docs for convert_legacy_config * chore: use new config options for docker compose

Commits on Jul 24, 2024

chore: improve error message styles

bjoern-m committed Jul 24, 2024

Configuration menu

View commit details

Copy full SHA for 88e4bf7

Browse repository at this point

Copy the full SHA

88e4bf7 View commit details

Browse the repository at this point in the history

Commits on Jul 25, 2024

feat: stash data can be compressed

bjoern-m committed Jul 25, 2024

Configuration menu

View commit details

Copy full SHA for e6e2c25

Browse repository at this point

Copy the full SHA

e6e2c25 View commit details

Browse the repository at this point in the history

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduce Flowpilot - integration #1532

Introduce Flowpilot - integration #1532

Commits on Jul 22, 2024

Commits on Jul 23, 2024

Commits on Jul 24, 2024

Commits on Jul 25, 2024

Commits on Jul 26, 2024

Commits on Jul 29, 2024

Commits on Jul 30, 2024

Commits on Aug 1, 2024

Commits on Aug 2, 2024

Commits on Aug 5, 2024

Commits on Aug 6, 2024