maddy/matrix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed PEM Keys issue

Browse Source
This commit is contained in:
Narayanan Madaswamy
2026-08-01 09:51:36 +05:30
parent f264f90f3b
commit dcb6850306
15 changed files with 217 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
.DS_Store vendored
View File

Binary file not shown.

4
.vscode/launch.json vendored
View File

@@ -64,9 +64,9 @@
"CYGNUS_TOKEN_URL": "http://localhost:8090/oauth2/token",
"CYGNUS_CLIENT_ID": "matrix",
"CYGNUS_INSTALLATION_ID": "matrix-delhi-cygnus-01",
"CYGNUS_CLIENT_ASSERTION": "file:${workspaceFolder}/matrix-installation/config/machine-assertion.jwt",
"CYGNUS_CLIENT_ASSERTION": "file:${workspaceFolder}/config/clients/matrix/matrix-matrix-delhi-cygnus-01-assertion.jwt",
"CYGNUS_LOGIN_KEY_ID": "cygnus-login-2026-01",
"CYGNUS_LOGIN_PUBLIC_KEY": "file:${workspaceFolder}/matrix-installation/config/keys/login-public.pem",
"CYGNUS_LOGIN_PUBLIC_KEY": "file:${workspaceFolder}/config/keys/login-public.pem",
"CYGNUS_CLOUD_REQUEST_TIMEOUT": "PT10S",
"CYGNUS_TOKEN_REFRESH_SKEW": "PT30S"
},

1
.~lock.Cygnus_OnPrem_to_Cloud_Authentication_Workflow.docx#
View File

@@ -1 +0,0 @@
,maddy,Narayanans-MacBook-Pro.local,27.07.2026 21:29,file:///Users/maddy/Library/Application%20Support/LibreOffice/4;

18
cygnus-installer/src/main/java/com/cygnus/installer/DeploymentWriter.java
View File

@@ -30,6 +30,7 @@ public class DeploymentWriter {
try {
Path normalizedOutput = output.toAbsolutePath().normalize();
Path config = normalizedOutput.resolve("config");
protectCloudConfiguration(config, profile);
Path keyDirectory = config.resolve("keys");
Files.createDirectories(keyDirectory);
@@ -82,6 +83,23 @@ public class DeploymentWriter {
}
}
private void protectCloudConfiguration(Path deploymentConfig, ProductProfile profile) {
if (isInside(deploymentConfig, profile.assertionEncryptionPublicKey())
|| isInside(deploymentConfig, profile.loginEncryptionPublicKey())) {
throw new IllegalArgumentException(
"Refusing to write deployment files over the cloud-service "
+ "configuration directory");
}
}
private boolean isInside(Path directory, Path file) {
if (file == null) {
return false;
}
return file.toAbsolutePath().normalize().startsWith(
directory.toAbsolutePath().normalize());
}
private String installationConfiguration(
UUID installationUuid,
String installationCode,

22
cygnus-installer/src/main/java/com/cygnus/installer/InstallationService.java
View File

@@ -156,6 +156,7 @@ public class InstallationService {
if (request.outputDirectory() == null) {
throw new IllegalArgumentException("Output directory is required");
}
validateOutputIsolation(request.outputDirectory());
RuntimeConfiguration runtime = request.runtimeConfiguration();
if (runtime == null) {
throw new IllegalArgumentException("Runtime configuration is required");
@@ -204,6 +205,27 @@ public class InstallationService {
}
}
private void validateOutputIsolation(Path outputDirectory) {
Path deploymentConfig = outputDirectory
.toAbsolutePath()
.normalize()
.resolve("config");
if (isInside(deploymentConfig, profile.assertionEncryptionPublicKey())
|| isInside(deploymentConfig, profile.loginEncryptionPublicKey())) {
throw new IllegalArgumentException(
"Output directory would overwrite the cloud-service config folder. "
+ "Select a dedicated deployment directory, such as "
+ "'matrix-installation'.");
}
}
private boolean isInside(Path directory, Path file) {
if (file == null) {
return false;
}
return file.toAbsolutePath().normalize().startsWith(directory);
}
private String normalizedCloudServiceUrl(String value) {
String normalized = value.trim();
return normalized.endsWith("/")

81
cygnus-installer/src/test/java/com/cygnus/installer/DeploymentWriterTest.java
View File

@@ -1,6 +1,7 @@
package com.cygnus.installer;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatThrownBy;
import java.net.URI;
import java.nio.file.Files;
@@ -121,4 +122,84 @@ class DeploymentWriterTest {
assertThat(output.resolve("config/keys/client-signing-private.pem"))
.isRegularFile();
}
@Test
void refusesToOverwriteCloudServiceConfiguration() throws Exception {
Path cloudConfig = temporaryDirectory.resolve("config");
Path cloudKeys = cloudConfig.resolve("keys");
Files.createDirectories(cloudKeys);
Path assertionPublic = cloudKeys.resolve("assertion-decryption-public.pem");
Path loginPublic = cloudKeys.resolve("login-public.pem");
Files.writeString(assertionPublic, "assertion-public-key");
Files.writeString(loginPublic, "login-public-key");
var profile = new ProductProfile(
"matrix",
"Matrix",
"matrix-onprem",
"MATRIX_IMAGE",
"matrix",
"installation.yml",
"MATRIX_INSTALLATION_CONFIG",
"/srv/matrix/config/installation.yml",
"8080:8080",
"/matrix/",
"/oauth2/token",
assertionPublic,
loginPublic,
"cygnus-login-2026-01",
List.of());
assertThatThrownBy(() -> new DeploymentWriter().write(
temporaryDirectory,
UUID.randomUUID(),
"primary",
"matrix-client",
new ActivationDtos.ValidationResponse(
"activation-token",
OffsetDateTime.now().plusMinutes(5),
UUID.randomUUID(),
"matrix-client",
"FULL",
2),
new ActivationDtos.RegistrationResponse(
UUID.randomUUID(),
UUID.randomUUID(),
UUID.randomUUID(),
null,
"primary",
1,
"ACTIVE"),
new InstallationKeyService().generate(),
"assertion",
new InstallerSettings(
"matrix",
URI.create("https://cloud.example.com"),
URI.create("https://cloud.example.com"),
"/api/v1/installations",
"production",
temporaryDirectory,
temporaryDirectory,
"1",
new IniDocument(Map.of())),
profile,
"registry.example.com/matrix:1.0.0",
Map.of(),
new RuntimeConfiguration(
"https://cloud.example.com",
"jdbc:postgresql://db/matrix",
"postgres",
"secret",
"redis",
"7901",
"secret",
false,
"PT10S",
"PT30S")))
.isInstanceOf(IllegalArgumentException.class)
.hasMessageContaining("cloud-service configuration");
assertThat(assertionPublic).hasContent("assertion-public-key");
assertThat(loginPublic).hasContent("login-public-key");
}
}

20
cygnus-onprem-app/src/main/java/matrix/nimble/controller/SessionController.java
View File

@@ -1,7 +1,5 @@
package matrix.nimble.controller;
import java.util.Map;
import matrix.nimble.cloud.identity.CloudAuthenticationException;
import matrix.nimble.cloud.identity.CloudAuthenticationGateway;
import matrix.nimble.model.Login;
@@ -27,18 +25,12 @@ public class SessionController {
public SessionController(CloudAuthenticationGateway cloudAuthenticationGateway) {
this.cloudAuthenticationGateway = cloudAuthenticationGateway;
}
// @RequestMapping(value="login",method=RequestMethod.POST )
// public String LoginPage(ModelMap model,@RequestHeader Map<String, String> headers)
// {
// model.addAttribute("login", new Login());
// String host = headers.get("host").toString();
// if(!host.contains("192.168.10.205:8585") &&
// !host.contains("192.168.10.250:8585") &&
// !host.startsWith("localhost:") && !host.startsWith("127.0.0.1:")) {
// return "error";
// }
// return "login";
// }
@RequestMapping(value="login", method={RequestMethod.GET, RequestMethod.POST})
public String LoginPage(ModelMap model)
{
model.addAttribute("login", new Login());
return "login";
}
@RequestMapping(value="logout",method=RequestMethod.POST )
public String LogoutPage(HttpServletRequest request, ModelMap model,@ModelAttribute(value="Sessvals") Session Sessvals)
{

17
matrix-installation/.env
View File

@@ -1,17 +0,0 @@
MATRIX_IMAGE="hub.technobeesolutions.in/matrix-onprem:1.0.0"
MATRIX_DB_URL="jdbc:postgresql://103.125.129.116:5333/matrix"
MATRIX_DB_USERNAME="postgres"
MATRIX_DB_PASSWORD="M@triXR3d1s@6202"
REDIS_HOST="103.125.129.116"
REDIS_PORT="7901"
REDIS_PASSWORD="M@triXR3d1s@6202"
REDIS_SSL="false"
CYGNUS_CLOUD_BASE_URL="http://host.docker.internal:8090"
CYGNUS_TOKEN_URL="http://host.docker.internal:8090/oauth2/token"
CYGNUS_CLIENT_ID="matrix"
CYGNUS_INSTALLATION_ID="matrix-delhi-cygnus-01"
CYGNUS_CLIENT_ASSERTION="file:/opt/matrix/config/machine-assertion.jwt"
CYGNUS_LOGIN_KEY_ID="cygnus-login-2026-01"
CYGNUS_LOGIN_PUBLIC_KEY="file:/opt/matrix/config/keys/login-public.pem"
CYGNUS_CLOUD_REQUEST_TIMEOUT="PT10S"
CYGNUS_TOKEN_REFRESH_SKEW="PT30S"

12
matrix-installation/compose.yml
View File

@@ -1,12 +0,0 @@
services:
matrix-onprem:
image: ${MATRIX_IMAGE:?Set MATRIX_IMAGE}
restart: unless-stopped
ports:
- "8080:8080"
volumes:
- ./config:/opt/matrix/config:ro
env_file:
- ./.env
environment:
MATRIX_INSTALLATION_CONFIG: /opt/matrix/config/installation.yml

13
matrix-installation/config/installation.yml
View File

@@ -1,13 +0,0 @@
matrix:
product: "matrix"
cloud-url: "http://host.docker.internal:8090"
token-url: "http://host.docker.internal:8090/oauth2/token"
tenant-id: "00000000-0000-4000-8000-000000000001"
client-id: "matrix"
installation-id: "5aecfd98-dcd0-4ac4-b973-2b65b7ceda08"
installation-uuid: "579a040e-6803-4648-a9ef-74733cc94a21"
installation-code: "matrix-delhi-cygnus-01"
environment: "production"
machine-assertion: "file:./config/machine-assertion.jwt"
signing-private-key: "file:./config/keys/client-signing-private.pem"
signing-public-key: "file:./config/keys/client-signing-public.pem"

40
matrix-installation/config/keys/client-signing-private.pem
View File

@@ -1,40 +0,0 @@
-----BEGIN PRIVATE KEY-----
MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDoPaKADkY3b17L
Qx1lHpmR/VRl+ypyYnefVvHTqEiJ9fC5epsn+GUFLA4F4IyhDECpwMNOlW0GkFzP
ZpIlFCLXaHaMrCNVQNL2oZXDoFcK6IEod9F5dK0gjdFvDCKROhNfVQJ6wtLmgF9o
AO946i0vUfpdMGr+p2LF4Jqyo5y7BlKF+Vq1wFipCG2qaEqMiyOHd7QJ7+aPbKaZ
XdYlh410I7gOefOd7C8VMNl8bHQmpKh4i987NlNaN3tLR2tfLw2N1xWAijXpYXe8
lzNaCtA1cVnEOIsLwmFoQ61jfSIH11h8ZqxIXFt/0gfSUNoM3cn+ujm6x4gwqbcN
z3uzglhewHJvCVuzmlZRr1iAjz9jOo1Q9tJMEon2Jr41Wopby18mgwk6xoceZMrN
ApRiONA9IkT1F5N6F6jwQjZFkEEgKq5X30ayIfTT9Ya57b+4BBEW6gYPEnwcaMPa
S/5L1IxkZ1zAVM9Fs4vw7OLzwO+oIm1HfpDiBidTf6McLDFWhPECAwEAAQKCAYAK
o3Un0M+UX0KMRN4qOUs/YeeNduKYRAy3BL5168fr4vNkqbpFC9bD1INtbz5965/k
Ls97kHKCuhb4TLpt3qTkcXV5xvJk57/qOpdv007dce5ltkxnGApMuxZglAGa3bpQ
tAYVrcpHsxJ7www1QaPxfpu9jFfgY7ZNencXrxFBS345AyXNvNqK3rcYVufwVXja
jigWCvJouElO7fqe9D1NeEvohNtdLPowqjDSR20QLpuFjyG6Fohdsfwww/wmC3OJ
BdO9KyBeq7RA5cTYsCOstfp1vPc8iuTUCmsLqp7DUfuHe4CdxphmTPxZ5uBzpnw4
9xECl6nGC/U94Utm+uz3EqF+ZcRX+TWyTNVnay86OXNIgYFHfxz/uf3/9dBy1yud
R7c8cw4bzdxPTXtXUHSgRZK/A9xNshOKiMVpw9AufkMZy/ddT44GDAmkPcJfExIN
ybr0Hn10DHPpTyghYOSOEfd/+Onh5ZwgO+kIPRtJud9MRjDVYAjBG0GZr3JE28EC
gcEA7FWbIW9z4VVxbmMV9yiAmeFlXRLUSFED7GBY9kemBf0lT34Sjz/8dxCD9EQg
qusKf/4djmDI7WnTWrO9WEt2Xi98PnPiOlwb6P4PkLwcswLcRhnlzYEGl873Swrd
bUFS1CbS3yPOjILmlsqir8bKE1LO76P+ZPPa33TpcUB9hdeW9Lx27mkxrw+i0IGX
3WSu5l68IlNERG5CgDd93FNN/TS9VNddvzuTAWcvmYB1YuRGjlQQ5p4dG1AtH1Vg
N9URAoHBAPuQ034lCmyT1AdGoVQXI3slQ4HP5kf03fa+yywvUZxAAd6M/NRDS0U5
ZVlo15Ehf8S4ICrv2yk4uSbPW4tP9S2XxGYMkc8mqDJvX3LcQgX0eXrt/yiMP3kT
oqK9jrXt3+YT/Bo6T1rlBrOQ8jclveryfvpjjkxwXtmB/3kagUmjzglvDZs+yyE5
3jelxO4k9pvLEB9h7xz7pjMNHr3j2KTIxZA6jG8zUKmuPxooTOtnnPlFWgpnhySa
i8pf+Lwx4QKBwEHKQvk30YZ1BrK4GrFHMSWlPVZ/m2DWTMVMvPcyUuFv6ycJ7Zi7
M0jh7BnfrUhnTfD7iLbN8qFEyHWDe75Mo5LsnSW1lNCyO4LM1wBvnX2n2jIZm4Nt
26v/DZByYdm8SZaNiD5d9W3gMtjfaBKOwEpIzxqfCH6J8/Ao16OTVF4h+f//Rwxv
dElLjQOGUARtttKipLTZgTObjh+rUvo2potKVzp7Cbnml7HYS8ProsH40jtk45+P
fILR+v2yAqsIQQKBwG8q69sFwVqD5SGl+6ruYraLnA5kcg4AToo4fA41hun2exz+
zsd6SWv41imxo/k1hYHIICb5Qa8wqtlUrs6ccetI8vhpu5GAMrm+774RSXfaNki1
nZksiOwXWjpya/tHeDbzQ+fPNrwjE1gMyIzIN+n4aVZ64iozSibyRJQeu11wbp9K
nQeqsxcmvGV48tKOMRBdpu1HWORE7IgI1znw0w7Wzj9TMDX/xjiFkMsdXgh1DDA3
jnekklsBlJ7E1GVN4QKBwQCWZTs5UcE+0At58AyN3fK+g3f0Bon9TNhqmmQ+ZB/N
StWe1Kc95DlS75jeEMX6xEhdXX7VMNbLEvNroh8xA307x/zWs4znkbsY1ONg16W/
beqEfnr7szk/3KcLh6UE0FswHDxMZwprNhYDT/Eo5GLC4uzIE6wy2Nznmhh6IJ2R
Ujv6Wh5+nvLX0M+RzZaNj2WI5j1kkA6EwQFVS7srBQlqChRGa2n7pOV1UxRKjfsf
SO8FID8TwwH38mtCqMgIDLU=
-----END PRIVATE KEY-----

11
matrix-installation/config/keys/client-signing-public.pem
View File

@@ -1,11 +0,0 @@
-----BEGIN PUBLIC KEY-----
MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA6D2igA5GN29ey0MdZR6Z
kf1UZfsqcmJ3n1bx06hIifXwuXqbJ/hlBSwOBeCMoQxAqcDDTpVtBpBcz2aSJRQi
12h2jKwjVUDS9qGVw6BXCuiBKHfReXStII3RbwwikToTX1UCesLS5oBfaADveOot
L1H6XTBq/qdixeCasqOcuwZShflatcBYqQhtqmhKjIsjh3e0Ce/mj2ymmV3WJYeN
dCO4DnnznewvFTDZfGx0JqSoeIvfOzZTWjd7S0drXy8NjdcVgIo16WF3vJczWgrQ
NXFZxDiLC8JhaEOtY30iB9dYfGasSFxbf9IH0lDaDN3J/ro5useIMKm3Dc97s4JY
XsBybwlbs5pWUa9YgI8/YzqNUPbSTBKJ9ia+NVqKW8tfJoMJOsaHHmTKzQKUYjjQ
PSJE9ReTeheo8EI2RZBBICquV99GsiH00/WGue2/uAQRFuoGDxJ8HGjD2kv+S9SM
ZGdcwFTPRbOL8Ozi88DvqCJtR36Q4gYnU3+jHCwxVoTxAgMBAAE=
-----END PUBLIC KEY-----

11
matrix-installation/config/keys/login-public.pem
View File

@@ -1,11 +0,0 @@
-----BEGIN PUBLIC KEY-----
MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvbjaZHePDwZQj1R1s23I
CSR6SzUi707WsGHoJZLLcFruXGTreNWIonU8Ye+iHwCUIJVhhoz0d7eGdfUc70ZO
Kn7dKfTfdsiWJi5RiM6loUk8iSAjrgh07chUgyL6luak7ZNevmWTCkSIuvVV9UZe
ZiH5Xh99zXr6Y0cLs7TcB0Tfc3y72dtU9VLjqhcc7KYibzHDWWfwVcpG7mkmmkEM
2tDHGmiZGoKk9uJoSMesh4w7XPE+UHxMEsK2wXpZLrwlN9ikxk56Cd/Z016MkkXZ
mMAofaTQ8NtfV/UuJjALUER0REJ8jb3qXBq5Pgh2ZkpmSaysZQPpNdll5SSHjhVV
t/UQ2QNgZiBh5bHZGpZJIvZ4E3RQ1Dtj2Q/QtSKgbffY3owNLu+2Lb/qQ90JV580
dMg8D+89uy+MOL8JpQxHvTjKk5tqFlBhmVo+Y9i2KfPgv3rM1R3q+A4j9hN37x+a
f2tulHI5quy0KLbANp/32qlVVgd6TgnMikWCkwNpo7YZAgMBAAE=
-----END PUBLIC KEY-----

1
matrix-installation/config/machine-assertion.jwt
View File

@@ -1 +0,0 @@
eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.D21KmNzi4shZx538-fArwUt0frd6nViAjl3E4ptHYfVlxWb5700VrK5HuLBl5fi2mG2e7ymeEGun83Qg7NMCl0-H9Df5vmjDwoQWzzVPS2TEcn0PhsyrHXWi7d3H2pHZUT9o8vHcVRSg9ROIofrwO-yUzGSixDxoEeIRQm3k3MSuuGOBp6MwTGthskPpAhYTJbFs9LNvMgJGJb3Sg4F0Ycz2bSFP_eqfIwKvkCcDOh-sjXK-1F0bDuZpeG0-Wh3L6uX7tdQmAm6NIm1sxVKB9dKwff_oryMGu-PgsIzeiGwCD50UelQVe1LLGayew_ysNt8PoGnVAJQrXMsF9tZG11dcQiqS8Xze78U6Z2seiEhGAchE5A3UB60FHkY_iJ7JA_k9u-AhH994KF0eUGI8zcIFCj53vc2oNd6ortVq1CPyUn9GD3QD8xEIfrRreYWI94Fhf5od_i2YduMtVzY-MhGFTjElNKdnfaajCVQIRb-sMDOmxSDgeT_uVYiAcAU_.PQaHgpGtExOh36HB.9k2OZPRwFc5etToeQtTJ9cjT5n3RwMTnffLIw56Co0eEEZ-szIBJXiwdqJoOpp5MG7uz8kNXSwhfnz1v5JTD6FEqpJ0886wr30eJTpQE9Mi0XIwrzFS0IddAa4lgdOcgY_mgs4HQv9TAy-0a9eg7tZwpLjGutTCZHMW5oS_mzr-DIw2qkEanpK8M2ZH6uO8P15h2E2D-WPPCZ4lJes7qA5tOaU8c5UlauWtkTR0HL-pQw348UincBIYwap5dT5j1ToUrkhXUzo_rxfFdZ9H8_jEOnFbaltOH90aVhIMKGDfqKWQIgjdEXA8VgwfdcfwJxKuF-Jhz7FpRyEEoXDM4ios4D9a576dqM_1AtnsgmmHuCGvsgZ3aEuZlWDjOJT7-qkvWEDg4_tuiLYZV69ZIUNzUwxS9uqPizO_W79yV-e0DblGH0lSZwToFq3UHhorxXxAGn4hCqgW5l5xqjrF_sfooZwLYi9v2BKONRj_2TrVbbM7g7EJ4eoaEVftBzdTSARMogpR8NzNUTNcl08p59kiYsbx2yOFtBP6G6_jicjeyv-8fPopmPcLzpo0XCX6dF_toSL3bQsmcTSwmtv70lxKJk383cATJjVjI9ulDeOJbB5_ebudIkIFmQ_gMJuXp5A1rVC9aV_-Ppfq7lmtVv-o3SIft_qh_ihdOe8UxA99yt3IWq9-pfwQry0cH5gGqG4g43-CTNyt4xl_xAYEgFyBG9on2r6hIEFdQ7OJw32V308m3xPI-gHp5_z2yn82cBNskImS56a6ffj05kDuI-1e_1s1EhAZW8X-Z-weWCCv00Co2P1haS_9MjzGfcRW06tbAxsyrJ8xy8yIp97_8S9sgCHeYr3ig7CCDTnOCCIW5jwcFJDF8jWYP8H_3oKpAqgUH867Ar-eAktF4z6Kv6NGji4h4dCPWLGNdD_CglfM6ST0BKizE45leiyxEEDIkIuwBD7lxcy_ItJdVs9ejew.2oEBIqW9A6rXQbyMWu85ew

118
scripts/setup-local-communication.sh
View File

@@ -228,41 +228,31 @@ register_client_in_database() {
-d "${DB_NAME_VALUE}" \
-X -v ON_ERROR_STOP=1 \
-c "
WITH account AS (
WITH registration AS (
SELECT registration_id
FROM identity.client_registration_details
WHERE lower(client_code) = lower(
convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'))
AND status = 'ACTIVE'
ORDER BY created_at
LIMIT 1
), account AS (
INSERT INTO identity.client_account
(tenant_id, client_slug, client_name, status)
VALUES (
(tenant_id, registration_id, client_slug, client_name, status)
SELECT
gen_random_uuid(),
registration_id,
convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'),
convert_from(decode('${client_name_b64}', 'base64'), 'UTF8'),
'ACTIVE')
'ACTIVE'
FROM registration
ON CONFLICT (client_slug) DO UPDATE SET
registration_id = EXCLUDED.registration_id,
client_name = EXCLUDED.client_name,
status = 'ACTIVE',
updated_at = now()
RETURNING tenant_id
), installation AS (
INSERT INTO identity.client_installation
(installation_id, tenant_id, client_id, installation_code,
assertion_public_key, allowed_scopes, enabled)
SELECT
gen_random_uuid(),
tenant_id,
convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'),
convert_from(decode('${installation_b64}', 'base64'), 'UTF8'),
convert_from(decode('${public_key_b64}', 'base64'), 'UTF8'),
ARRAY['identity.login']::text[],
true
FROM account
ON CONFLICT (client_id, installation_code) DO UPDATE SET
tenant_id = EXCLUDED.tenant_id,
assertion_public_key = EXCLUDED.assertion_public_key,
allowed_scopes = EXCLUDED.allowed_scopes,
enabled = true,
security_version = identity.client_installation.security_version + 1,
updated_at = now()
RETURNING tenant_id
)
), new_license AS (
INSERT INTO identity.client_license
(license_id, tenant_id, license_type, package_code,
valid_from, valid_until, status)
@@ -274,14 +264,84 @@ register_client_in_database() {
now(),
now() + make_interval(months => ${LICENSE_MONTHS}),
'ACTIVE'
FROM installation
FROM account
WHERE NOT EXISTS (
SELECT 1
FROM identity.client_license existing
WHERE existing.tenant_id = installation.tenant_id
WHERE existing.tenant_id = account.tenant_id
AND existing.status = 'ACTIVE'
AND existing.valid_until > now()
);"
)
RETURNING license_id, tenant_id
), selected_license AS (
SELECT existing.license_id, existing.tenant_id
FROM identity.client_license existing
JOIN account ON account.tenant_id = existing.tenant_id
WHERE existing.status = 'ACTIVE'
AND existing.valid_until > now()
UNION ALL
SELECT license_id, tenant_id
FROM new_license
ORDER BY license_id
LIMIT 1
), installation AS (
INSERT INTO identity.client_installation
(installation_id, tenant_id, client_id, installation_code,
assertion_public_key, allowed_scopes, enabled, license_id,
installation_uuid, installation_name, status,
software_version, environment)
SELECT
gen_random_uuid(),
account.tenant_id,
convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'),
convert_from(decode('${installation_b64}', 'base64'), 'UTF8'),
convert_from(decode('${public_key_b64}', 'base64'), 'UTF8'),
ARRAY['identity.login']::text[],
true,
selected_license.license_id,
gen_random_uuid(),
convert_from(decode('${client_name_b64}', 'base64'), 'UTF8')
|| ' ' ||
convert_from(decode('${installation_b64}', 'base64'), 'UTF8'),
'ACTIVE',
'development',
'development'
FROM account
JOIN selected_license
ON selected_license.tenant_id = account.tenant_id
ON CONFLICT (client_id, installation_code) DO UPDATE SET
tenant_id = EXCLUDED.tenant_id,
assertion_public_key = EXCLUDED.assertion_public_key,
allowed_scopes = EXCLUDED.allowed_scopes,
enabled = true,
license_id = EXCLUDED.license_id,
status = 'ACTIVE',
security_version = identity.client_installation.security_version + 1,
updated_at = now()
RETURNING tenant_id
)
SELECT count(*) AS provisioned_installations
FROM installation;"
local installation_count
installation_count="$(
PGPASSWORD="${DB_PASSWORD_VALUE}" "${PSQL_BIN}" \
-h "${DB_HOST_VALUE}" \
-p "${DB_PORT_VALUE}" \
-U "${DB_USER_VALUE}" \
-d "${DB_NAME_VALUE}" \
-X -A -t \
-c "
SELECT count(*)
FROM identity.client_installation
WHERE client_id =
convert_from(decode('${client_id_b64}', 'base64'), 'UTF8')
AND installation_code =
convert_from(decode('${installation_b64}', 'base64'), 'UTF8')
AND enabled = true;"
)"
[[ "${installation_count//[[:space:]]/}" == "1" ]] || fail \
"No active registration/account was found for '${CLIENT_ID}'. Create or activate client_registration_details first."
}
generate_machine_assertion() {