Paul Lorenz 1ae9b5b121 Validate the API session token when creating circuits via CreateCircuitV3 ...

- requires an API session token on CreateCircuitV3 requests and validates it,
  covering signature, audience, token type, and revocation by token id,
  identity, and api session
- takes the dialing identity from the validated token claims rather than the
  router-supplied identity id, and rejects a request whose asserted identity
  does not match the token subject
- adds the api session id to the log context, matching the V1 and V2 paths
- adds tests for a missing token, an invalid token, and a token belonging to a
  different identity than the one asserted
- notes the advisory in the 2.0.3 release notes

2026-08-20 15:38:27 -04:00

..

cli_tests

add back the instance separator now that quickstart is HA-enabled by default

2026-05-04 15:37:30 -04:00

pki

updates test client/certs to expire in 7k days

2020-04-21 15:34:34 -04:00

shaper

Optimize imports

2026-01-28 15:01:35 -05:00

testdata

fixes #3806 expose OpenZiti endpoints in OIDC discovery document (#3808)

2026-04-22 10:54:53 -04:00

testutil

Fix flaky link state checker resurrecting faulted links

2026-06-30 10:17:35 -04:00

.gitignore

Fix failing tests

2025-03-18 16:00:40 -04:00

accept_manual_start_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

addressable_terminators_test.go

Handle UDP difference between proxy and tproxy implementations. Fixes #3540

2026-02-04 14:37:53 -05:00

api_client_client.go

adds regression test for api session certificate scoping

2026-08-19 17:46:03 -04:00

api_client_management.go

Move the sdk info wait onto ManagementHelperClient

2026-08-19 16:55:01 -04:00

api_error_test.go

Replace circuit fault logs with metrics

2025-11-12 17:13:34 -05:00

api_session_cert_connect_test.go

Update for deprecation of HA flag in Go SDK

2025-08-18 19:28:28 -04:00

api_session_certificates_test.go

adds regression test for api session certificate scoping

2026-08-19 17:46:03 -04:00

api_session_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

api_session_totp_token_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

auth_cert_test.go

Fix flaky auth test by making sure we always do syncronous authenticator writes for the test

2026-04-06 20:36:22 -04:00

auth_external_jwt_signer_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

auth_headers_legacy_test.go

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

auth_headers_oidc_test.go

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

auth_mid_oidc_mfa_enroll_test.go

fixes #3496 allow TOTP enroll mid OIDC (#3656)

2026-03-11 16:27:31 -04:00

auth_oidc_cert_totp_test.go

fixes #3734 enforce client certificate proof-of-possession for OIDC sessions (#3805)

2026-04-23 12:00:46 -04:00

auth_oidc_csr_forging_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

auth_oidc_csr_refresh_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

auth_oidc_csr_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

auth_oidc_pop_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

auth_oidc_refresh_test.go

fixes #3496 allow TOTP enroll mid OIDC (#3656)

2026-03-11 16:27:31 -04:00

auth_oidc_test.go

Move the sdk info wait onto ManagementHelperClient

2026-08-19 16:55:01 -04:00

auth_perf_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

auth_policy_test.go

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

auth_updb_test.go

fixes two issues

2026-02-25 09:34:59 -05:00

authenticate.go

Add test race condition fix

2026-04-14 16:58:17 -04:00

authenticator_test.go

fix test that is no longer impacted

2026-02-26 10:06:56 -05:00

ca_test.go

backport openziti/ziti#3952 to v2.0 reject invalid externalIdClaim and stop enrollment panic (#3955)

2026-06-12 13:53:47 -04:00

ca_traffic_test.go

Provide more error context to SDKs for terminator errors. Fixes #3524

2026-02-04 14:36:21 -05:00

cert_request_extend_legacy_auth_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

cert_request_extend_oidc_auth_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

circuit_failure_cause_test.go

Add specific circuit failure error codes. Fixes #3717, fixes #3543, fixes #3364, fixes #2888, fixes #2859, fixes #1580

2026-04-14 15:52:49 -04:00

config_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

config_type_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

configsets.go

fixes #3806 expose OpenZiti endpoints in OIDC discovery document (#3808)

2026-04-22 10:54:53 -04:00

context_json.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

context_manager_helpers.go

fixes openziti/ziti#3333 based on the work from Jan Starkl <jan.starkl@tttech-digital.com>

2026-02-25 09:13:07 -05:00

context.go

fixes #3734 enforce client certificate proof-of-possession for OIDC sessions (#3805)

2026-04-23 12:00:46 -04:00

control.go

fix.openziti.ziti.3597.OIDC.by.default (#3605)

2026-03-04 10:03:14 -05:00

controller_helper.go

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

create_circuit_v1_test.go

Set env on the v1 create-circuit request context. Fixes #4242

2026-08-07 15:30:40 -04:00

create_circuit_v3_test.go

Validate the API session token when creating circuits via CreateCircuitV3

2026-08-20 15:38:27 -04:00

current_identity_test.go

Replace circuit fault logs with metrics

2025-11-12 17:13:34 -05:00

custom_assertions.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

data_flow_close_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

data_flow_hs_rotating_test.go

Provide more error context to SDKs for terminator errors. Fixes #3524

2026-02-04 14:36:21 -05:00

data_flow_hs_test.go

Update deps and rebase on main

2026-02-04 15:48:42 -05:00

data_flow_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

dialer_identity_test.go

Add support for sending the dialing identity id and name to the hosting sdk. Fixes #3547

2026-02-09 09:18:25 -05:00

edge_router_helper.go

fixes openziti/ziti#3673 purge expired revocations, fix revocation bugs (#3679)

2026-03-11 20:33:38 -04:00

edge_router_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

edge_router_test.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

endpoint_test.go

Fix.3321.health.check.api.path (#3322)

2025-10-15 13:04:56 -04:00

endpoints

Endpoint management updates

2025-02-03 18:52:57 -05:00

enrollment_ca_auto_specific_test.go

backport openziti/ziti#3952 to v2.0 reject invalid externalIdClaim and stop enrollment panic (#3955)

2026-06-12 13:53:47 -04:00

enrollment_ca_auto_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

enrollment_identity_extend_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

enrollment_network_test.go

Replace circuit fault logs with metrics

2025-11-12 17:13:34 -05:00

enrollment_ott_specific_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

enrollment_ott_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

enrollment_refresh_test.go

Add permissions list to identity. Fixes #3430. Add read-only permission. Fixes #2109. Add CRUD permissions by entity type. Fixes #3435

2025-12-18 10:54:08 -05:00

enrollment_router_test.go

fixes #3239 router enrollment used identity expiration duration (#3240)

2025-08-26 09:28:54 -04:00

enrollment_token_to_cert_test.go

backport openziti/ziti#4063 to release-v2.0.x enroll with empty roles… (#4065)

2026-08-06 10:42:47 -04:00

enrollment_token_to_token_test.go

backport openziti/ziti#4063 to release-v2.0.x enroll with empty roles… (#4065)

2026-08-06 10:42:47 -04:00

enrollment_updb_specific_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

enrollment_updb_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

entities.go

add generic 'binding: spa', fix quickstart --home, lint cleanup

2026-05-03 11:08:40 -04:00

events_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

external_jwt_signer_jwks_endpoint_test.go

backport fixes GHSA-whjr-3j94-gw3c to v2.0 constrain external jwt signer JWKS fetching

2026-08-20 15:23:21 -04:00

external_jwt_signer_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

fabric_router_test.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

identity_api_session_activity_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

identity_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

link_test.go

Increase link payload/ack queue sizes and make them configurable. Fixes #3706

2026-04-14 11:32:32 -04:00

list_services_perf_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

main_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

mfa_ziti_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

model_sdk_performance_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

network_jwt_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

oidc_auto_enable_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

oidc_discovery_endpoint_test.go

fixes #3806 expose OpenZiti endpoints in OIDC discovery document (#3808)

2026-04-22 10:54:53 -04:00

oidc_error_codes_test.go

fixes #3788 return proper OIDC error codes and HTTP status codes (#3790)

2026-04-14 16:44:06 -04:00

permission_loss_test.go

Fixes for SDK terminator management. Add support for ziti sdk inspection. Fixes #3609

2026-03-11 13:10:28 -04:00

permissions_api_session_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_auth_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_authenticator_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_ca_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_config_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_config_type_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_edge_router_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_edge_router_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_enrollment_test.go

Prevent enrollment-based privilege escalation to admin identities. Fixes #4049

2026-06-26 13:18:33 -04:00

permissions_external_jwt_signer_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_identity_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_posture_check_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_service_edge_router_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_service_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_service_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_terminator_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_test_helper.go

Prevent enrollment-based privilege escalation to admin identities. Fixes #4049

2026-06-26 13:18:33 -04:00

permissions_transit_router_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_domain_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_mfa_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

posture_check_os_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

posture_check_process_multi_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_domain_legacy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_domain_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_mac_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_os_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_process_multi_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_process_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_revalidation_oidc_test.go

Revalidate dial circuits and bind terminators on posture changes. Fixes #3928

2026-06-13 01:56:44 -04:00

request_body_limit_test.go

backport fixes GHSA-q8g9-jc4c-jp6q to v2.0 limit pre-auth request body buffering

2026-08-19 17:46:02 -04:00

rest_auth_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

revocation_enforcement_oidc_test.go

Anchor the post-cutoff revocation test to a later iat second

2026-08-19 10:59:34 -04:00

revocation_test.go

fixes #3734 enforce client certificate proof-of-possession for OIDC sessions (#3805)

2026-04-23 12:00:46 -04:00

root_endpoint_test.go

fixes #2026 root version handlers 404

2024-05-08 10:33:50 -04:00

router_data_model_test.go

Fix event name, IdentityFullStateState -> IdentityFullState

2026-03-25 12:05:23 -04:00

router_identities_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

router_reenroll_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

sdk_api_session_token_update_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

sdk_auth_test.go

Add permissions list to identity. Fixes #3430. Add read-only permission. Fixes #2109. Add CRUD permissions by entity type. Fixes #3435

2025-12-18 10:54:08 -05:00

sdk_event_test.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

sdk_oidc_totp_enroll_test.go

fixes #3496 allow TOTP enroll mid OIDC (#3656)

2026-03-11 16:27:31 -04:00

service_edge_router_policy_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

service_list_refresh_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

service_policy_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

service_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

session_legacy_token_id_test.go

Sign legacy session JWT with the durable session id. Fixes #4125

2026-07-21 21:20:09 -04:00

specs_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

standard_error_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

standard.go

Optimize imports

2026-01-28 15:01:35 -05:00

sticky_terminator_test.go

Add test race condition fix

2026-04-14 16:58:17 -04:00

terminator_ownership_test.go

Scope terminator operations to the requesting router. Fixes #4236

2026-08-07 14:50:29 -04:00

terminator_test.go

Replace circuit fault logs with metrics

2025-11-12 17:13:34 -05:00

terminator_update_test.go

Update deps and rebase on main

2026-02-04 15:48:42 -05:00

transit_router_test.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

tunneler_data_flow_test.go

Handle UDP difference between proxy and tproxy implementations. Fixes #3540

2026-02-04 14:37:53 -05:00