feat: replace deprecated github.com/RobotsAndPencils/go-saml (#2558)

The `github.com/RobotsAndPencils/go-saml` has been officially deprecated
and archived on 7 June 2023.

Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>

controllers/account.go

@@ -238,7 +238,7 @@ func (c *ApiController) Signup() {
 // @Param   post_logout_redirect_uri    query    string  false     "post_logout_redirect_uri"
 // @Param   state     query    string  false     "state"
 // @Success 200 {object} controllers.Response The Response object
-// @router /logout [get,post]
+// @router /logout [post]
 func (c *ApiController) Logout() {
 	// https://openid.net/specs/openid-connect-rpinitiated-1_0-final.html
 	accessToken := c.Input().Get("id_token_hint")
@@ -454,6 +454,7 @@ func (c *ApiController) GetUserinfo2() {
 // @Tag Login API
 // @Title GetCaptcha
 // @router /api/get-captcha [get]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) GetCaptcha() {
 	applicationId := c.Input().Get("applicationId")
 	isCurrentProvider := c.Input().Get("isCurrentProvider")

controllers/auth.go

@@ -887,6 +887,7 @@ func (c *ApiController) HandleSamlLogin() {
 // @Tag HandleOfficialAccountEvent API
 // @Title HandleOfficialAccountEvent
 // @router /api/webhook [POST]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) HandleOfficialAccountEvent() {
 	respBytes, err := ioutil.ReadAll(c.Ctx.Request.Body)
 	if err != nil {
@@ -917,6 +918,7 @@ func (c *ApiController) HandleOfficialAccountEvent() {
 // @Tag GetWebhookEventType API
 // @Title GetWebhookEventType
 // @router /api/get-webhook-event [GET]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) GetWebhookEventType() {
 	lock.Lock()
 	defer lock.Unlock()
@@ -964,6 +966,7 @@ func (c *ApiController) GetCaptchaStatus() {
 // @Tag Callback API
 // @Description Get Login Error Counts
 // @router /api/Callback [post]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) Callback() {
 	code := c.GetString("code")
 	state := c.GetString("state")

controllers/enforcer.go

@@ -71,7 +71,7 @@ func (c *ApiController) GetEnforcers() {
 // @Tag Enforcer API
 // @Description get enforcer
 // @Param   id     query    string  true        "The id ( owner/name )  of enforcer"
-// @Success 200 {object} object
+// @Success 200 {object} object.Enforcer
 // @router /get-enforcer [get]
 func (c *ApiController) GetEnforcer() {
 	id := c.Input().Get("id")
@@ -99,7 +99,7 @@ func (c *ApiController) GetEnforcer() {
 // @Description update enforcer
 // @Param   id     query    string  true        "The id ( owner/name )  of enforcer"
 // @Param   enforcer     body    object  true        "The enforcer object"
-// @Success 200 {object} object
+// @Success 200 {object} object.Enforcer
 // @router /update-enforcer [post]
 func (c *ApiController) UpdateEnforcer() {
 	id := c.Input().Get("id")
@@ -120,7 +120,7 @@ func (c *ApiController) UpdateEnforcer() {
 // @Tag Enforcer API
 // @Description add enforcer
 // @Param   enforcer     body    object  true        "The enforcer object"
-// @Success 200 {object} object
+// @Success 200 {object} object.Enforcer
 // @router /add-enforcer [post]
 func (c *ApiController) AddEnforcer() {
 	enforcer := object.Enforcer{}
@@ -139,7 +139,7 @@ func (c *ApiController) AddEnforcer() {
 // @Tag Enforcer API
 // @Description delete enforcer
 // @Param   body    body    object.Enforce  true      "The enforcer object"
-// @Success 200 {object} object
+// @Success 200 {object} object.Enforcer
 // @router /delete-enforcer [post]
 func (c *ApiController) DeleteEnforcer() {
 	var enforcer object.Enforcer

controllers/link.go

@@ -26,8 +26,10 @@ type LinkForm struct {
 }
 
 // Unlink ...
-// @router /unlink [post]
 // @Tag Login API
+// @Title Unlink
+// @router /unlink [post]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) Unlink() {
 	user, ok := c.RequireSignedInUser()
 	if !ok {

controllers/user.go

@@ -510,6 +510,7 @@ func (c *ApiController) SetPassword() {
 // @Title CheckUserPassword
 // @router /check-user-password [post]
 // @Tag User API
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) CheckUserPassword() {
 	var user object.User
 	err := json.Unmarshal(c.Ctx.Input.RequestBody, &user)
@@ -580,6 +581,7 @@ func (c *ApiController) GetUserCount() {
 // @Title AddUserKeys
 // @router /add-user-keys [post]
 // @Tag User API
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) AddUserKeys() {
 	var user object.User
 	err := json.Unmarshal(c.Ctx.Input.RequestBody, &user)

controllers/verification.go

@@ -39,6 +39,7 @@ const (
 // @Title SendVerificationCode
 // @Tag Verification API
 // @router /send-verification-code [post]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) SendVerificationCode() {
 	var vform form.VerificationForm
 	err := c.ParseForm(&vform)
@@ -229,6 +230,7 @@ func (c *ApiController) SendVerificationCode() {
 // @Title VerifyCaptcha
 // @Tag Verification API
 // @router /verify-captcha [post]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) VerifyCaptcha() {
 	var vform form.VerificationForm
 	err := c.ParseForm(&vform)
@@ -271,6 +273,7 @@ func (c *ApiController) VerifyCaptcha() {
 // @Tag Account API
 // @Title ResetEmailOrPhone
 // @router /api/reset-email-or-phone [post]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) ResetEmailOrPhone() {
 	user, ok := c.RequireSignedInUser()
 	if !ok {
@@ -365,6 +368,7 @@ func (c *ApiController) ResetEmailOrPhone() {
 // @Tag Verification API
 // @Title VerifyCode
 // @router /api/verify-code [post]
+// @Success 200 {object} object.Userinfo The Response object
 func (c *ApiController) VerifyCode() {
 	var authForm form.AuthForm
 	err := json.Unmarshal(c.Ctx.Input.RequestBody, &authForm)

controllers/webauthn.go

@@ -146,7 +146,7 @@ func (c *ApiController) WebAuthnSigninBegin() {
 }
 
 // WebAuthnSigninFinish
-// @Title WebAuthnSigninBegin
+// @Title WebAuthnSigninFinish
 // @Tag Login API
 // @Description WebAuthn Login Flow 2nd stage
 // @Param   body    body   protocol.CredentialAssertionResponse  true        "authenticator assertion Response"

go.mod

@@ -4,7 +4,6 @@ go 1.16
 
 require (
 	github.com/Masterminds/squirrel v1.5.3
-	github.com/RobotsAndPencils/go-saml v0.0.0-20170520135329-fb13cb52a46b
 	github.com/alexedwards/argon2id v0.0.0-20211130144151-3585854a6387
 	github.com/aws/aws-sdk-go v1.45.5
 	github.com/beego/beego v1.12.12
@@ -33,13 +32,11 @@ require (
 	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/google/uuid v1.4.0
 	github.com/json-iterator/go v1.1.12
-	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect
 	github.com/lestrrat-go/jwx v1.2.21
 	github.com/lib/pq v1.10.9
 	github.com/lor00x/goldap v0.0.0-20180618054307-a546dffdd1a3
 	github.com/markbates/goth v1.75.2
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d // indirect
 	github.com/nyaruka/phonenumbers v1.1.5
 	github.com/pquerna/otp v1.4.0
 	github.com/prometheus/client_golang v1.11.1

go.sum

@@ -962,8 +962,6 @@ github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/ProtonMail/go-crypto v0.0.0-20221026131551-cf6655e29de4 h1:ra2OtmuW0AE5csawV4YXMNGNQQXvLRps3z2Z59OPO+I=
 github.com/ProtonMail/go-crypto v0.0.0-20221026131551-cf6655e29de4/go.mod h1:UBYPn8k0D56RtnR8RFQMjmh4KrZzWJ5o7Z9SYjossQ8=
-github.com/RobotsAndPencils/go-saml v0.0.0-20170520135329-fb13cb52a46b h1:EgJ6N2S0h1WfFIjU5/VVHWbMSVYXAluop97Qxpr/lfQ=
-github.com/RobotsAndPencils/go-saml v0.0.0-20170520135329-fb13cb52a46b/go.mod h1:3SAoF0F5EbcOuBD5WT9nYkbIJieBS84cUQXADbXeBsU=
 github.com/RocketChat/Rocket.Chat.Go.SDK v0.0.0-20221121042443-a3fd332d56d9 h1:vuu1KBsr6l7XU3CHsWESP/4B1SNd+VZkrgeFZsUXrsY=
 github.com/RocketChat/Rocket.Chat.Go.SDK v0.0.0-20221121042443-a3fd332d56d9/go.mod h1:rjP7sIipbZcagro/6TCk6X0ZeFT2eyudH5+fve/cbBA=
 github.com/SherClockHolmes/webpush-go v1.2.0 h1:sGv0/ZWCvb1HUH+izLqrb2i68HuqD/0Y+AmGQfyqKJA=
@@ -1588,8 +1586,6 @@ github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7V
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/jung-kurt/gofpdf v1.0.0/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
 github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
-github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 h1:iQTw/8FWTuc7uiaSepXwyf3o52HaUYcV+Tu66S3F5GA=
-github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kevinburke/go-types v0.0.0-20210723172823-2deba1f80ba7/go.mod h1:/Pk5i/SqYdYv1cie5wGwoZ4P6TpgMi+Yf58mtJSHdOw=
@@ -1734,8 +1730,6 @@ github.com/nats-io/nkeys v0.3.0/go.mod h1:gvUNGjVcM2IPr5rCsRsC6Wb3Hr2CQAm08dsxtV
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
 github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d h1:VhgPp6v9qf9Agr/56bj7Y/xa04UccTW04VP0Qed4vnQ=
-github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d/go.mod h1:YUTz3bUH2ZwIWBy3CJBeOBEugqcmXREj14T+iG/4k4U=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=

object/saml_idp.go

@@ -28,10 +28,10 @@ import (
 	"io"
 	"time"
 
-	"github.com/RobotsAndPencils/go-saml"
 	"github.com/beevik/etree"
 	"github.com/golang-jwt/jwt/v4"
 	"github.com/google/uuid"
+	saml "github.com/russellhaering/gosaml2"
 	dsig "github.com/russellhaering/goxmldsig"
 )
 
@@ -283,15 +283,15 @@ func GetSamlResponse(application *Application, user *User, samlRequest string, h
 		}
 	}
 
-	var authnRequest saml.AuthnRequest
+	var authnRequest saml.AuthNRequest
 	err = xml.Unmarshal(buffer.Bytes(), &authnRequest)
 	if err != nil {
 		return "", "", method, fmt.Errorf("err: Failed to unmarshal AuthnRequest, please check the SAML request. %s", err.Error())
 	}
 
 	// verify samlRequest
-	if isValid := application.IsRedirectUriValid(authnRequest.Issuer.Url); !isValid {
-		return "", "", method, fmt.Errorf("err: Issuer URI: %s doesn't exist in the allowed Redirect URI list", authnRequest.Issuer.Url)
+	if isValid := application.IsRedirectUriValid(authnRequest.Issuer); !isValid {
+		return "", "", method, fmt.Errorf("err: Issuer URI: %s doesn't exist in the allowed Redirect URI list", authnRequest.Issuer)
 	}
 
 	// get certificate string
@@ -317,7 +317,7 @@ func GetSamlResponse(application *Application, user *User, samlRequest string, h
 
 	_, originBackend := getOriginFromHost(host)
 	// build signedResponse
-	samlResponse, _ := NewSamlResponse(application, user, originBackend, certificate, authnRequest.AssertionConsumerServiceURL, authnRequest.Issuer.Url, authnRequest.ID, application.RedirectUris)
+	samlResponse, _ := NewSamlResponse(application, user, originBackend, certificate, authnRequest.AssertionConsumerServiceURL, authnRequest.Issuer, authnRequest.ID, application.RedirectUris)
 	randomKeyStore := &X509Key{
 		PrivateKey:      cert.PrivateKey,
 		X509Certificate: certificate,

swagger/swagger.yml

@@ -102,7 +102,7 @@ paths:
         "200":
           description: ""
           schema:
-            $ref: '#/definitions/object'
+            $ref: '#/definitions/object.Enforcer'
   /api/add-group:
     post:
       tags:
@@ -283,24 +283,6 @@ paths:
           description: The Response object
           schema:
             $ref: '#/definitions/controllers.Response'
-  /api/add-record:
-    post:
-      tags:
-      - Record API
-      description: add a record
-      operationId: ApiController.AddRecord
-      parameters:
-      - in: body
-        name: body
-        description: The details of the record
-        required: true
-        schema:
-          $ref: '#/definitions/object.Record'
-      responses:
-        "200":
-          description: The Response object
-          schema:
-            $ref: '#/definitions/controllers.Response'
   /api/add-resource:
     post:
       tags:
@@ -436,7 +418,12 @@ paths:
     post:
       tags:
       - User API
-      operationId: ApiController.AddUserkeys
+      operationId: ApiController.AddUserKeys
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/add-webhook:
     post:
       tags:
@@ -455,11 +442,27 @@ paths:
           description: The Response object
           schema:
             $ref: '#/definitions/controllers.Response'
+  /api/api/Callback:
+    post:
+      tags:
+      - Callback API
+      description: Get Login Error Counts
+      operationId: ApiController.Callback
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/api/get-captcha:
     get:
       tags:
       - Login API
       operationId: ApiController.GetCaptcha
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/api/get-captcha-status:
     get:
       tags:
@@ -482,11 +485,21 @@ paths:
       tags:
       - GetWebhookEventType API
       operationId: ApiController.GetWebhookEventType
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/api/reset-email-or-phone:
     post:
       tags:
       - Account API
       operationId: ApiController.ResetEmailOrPhone
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/api/send-email:
     post:
       tags:
@@ -515,6 +528,24 @@ paths:
           description: object
           schema:
             $ref: '#/definitions/Response'
+  /api/api/send-notification:
+    post:
+      tags:
+      - Service API
+      description: This API is not for Casdoor frontend to call, it is for Casdoor SDKs.
+      operationId: ApiController.SendNotification
+      parameters:
+      - in: body
+        name: from
+        description: Details of the notification request
+        required: true
+        schema:
+          $ref: '#/definitions/controllers.NotificationForm'
+      responses:
+        "200":
+          description: object
+          schema:
+            $ref: '#/definitions/Response'
   /api/api/send-sms:
     post:
       tags:
@@ -548,11 +579,21 @@ paths:
       tags:
       - Verification API
       operationId: ApiController.VerifyCode
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/api/webhook:
     post:
       tags:
       - HandleOfficialAccountEvent API
       operationId: ApiController.HandleOfficialAccountEvent
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/batch-enforce:
     post:
       tags:
@@ -606,6 +647,11 @@ paths:
       tags:
       - User API
       operationId: ApiController.CheckUserPassword
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/delete-adapter:
     post:
       tags:
@@ -677,7 +723,7 @@ paths:
         "200":
           description: ""
           schema:
-            $ref: '#/definitions/object'
+            $ref: '#/definitions/object.Enforcer'
   /api/delete-group:
     post:
       tags:
@@ -1265,7 +1311,7 @@ paths:
         "200":
           description: ""
           schema:
-            $ref: '#/definitions/object'
+            $ref: '#/definitions/object.Enforcer'
   /api/get-enforcers:
     get:
       tags:
@@ -1285,6 +1331,19 @@ paths:
             type: array
             items:
               $ref: '#/definitions/object.Enforcer'
+  /api/get-global-certs:
+    get:
+      tags:
+      - Cert API
+      description: get globle certs
+      operationId: ApiController.GetGlobalCerts
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            type: array
+            items:
+              $ref: '#/definitions/object.Cert'
   /api/get-global-providers:
     get:
       tags:
@@ -1311,19 +1370,6 @@ paths:
             type: array
             items:
               $ref: '#/definitions/object.User'
-  /api/get-global-certs:
-    get:
-      tags:
-      - Cert API
-      description: get globle certs
-      operationId: ApiController.GetGlobalCerts
-      responses:
-        "200":
-          description: The Response object
-          schema:
-            type: array
-            items:
-              $ref: '#/definitions/object.Cert'
   /api/get-group:
     get:
       tags:
@@ -1779,47 +1825,6 @@ paths:
             type: array
             items:
               $ref: '#/definitions/object.Provider'
-  /api/get-records:
-    get:
-      tags:
-      - Record API
-      description: get all records
-      operationId: ApiController.GetRecords
-      parameters:
-      - in: query
-        name: pageSize
-        description: The size of each page
-        required: true
-        type: string
-      - in: query
-        name: p
-        description: The number of the page
-        required: true
-        type: string
-      responses:
-        "200":
-          description: The Response object
-          schema:
-            $ref: '#/definitions/object.Record'
-  /api/get-records-filter:
-    post:
-      tags:
-      - Record API
-      description: get records by filter
-      operationId: ApiController.GetRecordsByFilter
-      parameters:
-      - in: body
-        name: filter
-        description: filter Record message
-        required: true
-        schema:
-          type: string
-        type: string
-      responses:
-        "200":
-          description: The Response object
-          schema:
-            $ref: '#/definitions/object.Record'
   /api/get-resource:
     get:
       tags:
@@ -2387,46 +2392,6 @@ paths:
           description: The Response object
           schema:
             $ref: '#/definitions/controllers.Response'
-  /api/login/oauth/access_token:
-    post:
-      tags:
-      - Token API
-      description: get OAuth access token
-      operationId: ApiController.GetOAuthToken
-      parameters:
-      - in: query
-        name: grant_type
-        description: OAuth grant type
-        required: true
-        type: string
-      - in: query
-        name: client_id
-        description: OAuth client id
-        required: true
-        type: string
-      - in: query
-        name: client_secret
-        description: OAuth client secret
-        required: true
-        type: string
-      - in: query
-        name: code
-        description: OAuth code
-        required: true
-        type: string
-      responses:
-        "200":
-          description: The Response object
-          schema:
-            $ref: '#/definitions/object.TokenWrapper'
-        "400":
-          description: The Response object
-          schema:
-            $ref: '#/definitions/object.TokenError'
-        "401":
-          description: The Response object
-          schema:
-            $ref: '#/definitions/object.TokenError'
   /api/login/oauth/introspect:
     post:
       description: The introspection endpoint is an OAuth 2.0 endpoint that takes a
@@ -2500,29 +2465,6 @@ paths:
           schema:
             $ref: '#/definitions/object.TokenError'
   /api/logout:
-    get:
-      tags:
-      - Login API
-      description: logout the current user
-      operationId: ApiController.Logout
-      parameters:
-      - in: query
-        name: id_token_hint
-        description: id_token_hint
-        type: string
-      - in: query
-        name: post_logout_redirect_uri
-        description: post_logout_redirect_uri
-        type: string
-      - in: query
-        name: state
-        description: state
-        type: string
-      responses:
-        "200":
-          description: The Response object
-          schema:
-            $ref: '#/definitions/controllers.Response'
     post:
       tags:
       - Login API
@@ -2620,6 +2562,11 @@ paths:
       tags:
       - Verification API
       operationId: ApiController.SendVerificationCode
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/set-password:
     post:
       tags:
@@ -2706,6 +2653,12 @@ paths:
     post:
       tags:
       - Login API
+      operationId: ApiController.Unlink
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/update-adapter:
     post:
       tags:
@@ -2797,7 +2750,7 @@ paths:
         "200":
           description: ""
           schema:
-            $ref: '#/definitions/object'
+            $ref: '#/definitions/object.Enforcer'
   /api/update-group:
     post:
       tags:
@@ -3283,6 +3236,11 @@ paths:
       tags:
       - Verification API
       operationId: ApiController.VerifyCaptcha
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.Userinfo'
   /api/webauthn/signin/begin:
     get:
       tags:
@@ -3310,7 +3268,7 @@ paths:
       tags:
       - Login API
       description: WebAuthn Login Flow 2nd stage
-      operationId: ApiController.WebAuthnSigninBegin
+      operationId: ApiController.WebAuthnSigninFinish
       parameters:
       - in: body
         name: body
@@ -3352,13 +3310,47 @@ paths:
           description: '"The Response object"'
           schema:
             $ref: '#/definitions/controllers.Response'
+  /apiapi/login/oauth/access_token:
+    post:
+      tags:
+      - Token API
+      description: get OAuth access token
+      operationId: ApiController.GetOAuthToken
+      parameters:
+      - in: query
+        name: grant_type
+        description: OAuth grant type
+        required: true
+        type: string
+      - in: query
+        name: client_id
+        description: OAuth client id
+        required: true
+        type: string
+      - in: query
+        name: client_secret
+        description: OAuth client secret
+        required: true
+        type: string
+      - in: query
+        name: code
+        description: OAuth code
+        required: true
+        type: string
+      responses:
+        "200":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.TokenWrapper'
+        "400":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.TokenError'
+        "401":
+          description: The Response object
+          schema:
+            $ref: '#/definitions/object.TokenError'
 definitions:
-  1183.0xc000639290.false:
-    title: "false"
-    type: object
-  1217.0xc0006392c0.false:
-    title: "false"
-    type: object
   LaravelResponse:
     title: LaravelResponse
     type: object
@@ -3393,14 +3385,24 @@ definitions:
         type: string
       title:
         type: string
+  controllers.NotificationForm:
+    title: NotificationForm
+    type: object
+    properties:
+      content:
+        type: string
   controllers.Response:
     title: Response
     type: object
     properties:
       data:
-        $ref: '#/definitions/1183.0xc000639290.false'
+        additionalProperties:
+          description: support string, struct or []struct
+          type: string
       data2:
-        $ref: '#/definitions/1217.0xc0006392c0.false'
+        additionalProperties:
+          description: support string, struct or []struct
+          type: string
       msg:
         type: string
       name:
@@ -3430,9 +3432,6 @@ definitions:
   object:
     title: object
     type: object
-  object.&{197049 0xc000a2cd50 false}:
-    title: '&{197049 0xc000a2cd50 false}'
-    type: object
   object.AccountItem:
     title: AccountItem
     type: object
@@ -3468,10 +3467,10 @@ definitions:
         format: int64
       table:
         type: string
-      tableNamePrefix:
-        type: string
       type:
         type: string
+      useSameDb:
+        type: boolean
       user:
         type: string
   object.Application:
@@ -3482,6 +3481,8 @@ definitions:
         type: string
       cert:
         type: string
+      certPublicKey:
+        type: string
       clientId:
         type: string
       clientSecret:
@@ -3500,6 +3501,8 @@ definitions:
         type: boolean
       enablePassword:
         type: boolean
+      enableSamlC14n10:
+        type: boolean
       enableSamlCompress:
         type: boolean
       enableSignUp:
@@ -3530,6 +3533,10 @@ definitions:
           type: string
       homepageUrl:
         type: string
+      invitationCodes:
+        type: array
+        items:
+          type: string
       logo:
         type: string
       name:
@@ -3553,6 +3560,10 @@ definitions:
       refreshExpireInHours:
         type: integer
         format: int64
+      samlAttributes:
+        type: array
+        items:
+          $ref: '#/definitions/object.SamlItem'
       samlReplyUrl:
         type: string
       signinHtml:
@@ -3581,15 +3592,11 @@ definitions:
     title: CasbinRequest
     type: array
     items:
-      $ref: '#/definitions/object.&{197049 0xc000a2cd50 false}'
+      $ref: '#/definitions/object.CasbinRequest'
   object.Cert:
     title: Cert
     type: object
     properties:
-      authorityPublicKey:
-        type: string
-      authorityRootPublicKey:
-        type: string
       bitSize:
         type: integer
         format: int64
@@ -3905,6 +3912,8 @@ definitions:
         type: string
       defaultAvatar:
         type: string
+      defaultPassword:
+        type: string
       displayName:
         type: string
       enableSoftDeletion:
@@ -3922,6 +3931,8 @@ definitions:
           type: string
       masterPassword:
         type: string
+      masterVerificationCode:
+        type: string
       mfaItems:
         type: array
         items:
@@ -4011,6 +4022,8 @@ definitions:
         type: string
       state:
         $ref: '#/definitions/pp.PaymentState'
+      successUrl:
+        type: string
       tag:
         type: string
       type:
@@ -4043,6 +4056,10 @@ definitions:
           type: string
       effect:
         type: string
+      groups:
+        type: array
+        items:
+          type: string
       isEnabled:
         type: boolean
       model:
@@ -4091,12 +4108,17 @@ definitions:
           type: string
       owner:
         type: string
-      pricePerMonth:
-        type: number
-        format: double
-      pricePerYear:
+      paymentProviders:
+        type: array
+        items:
+          type: string
+      period:
+        type: string
+      price:
         type: number
         format: double
+      product:
+        type: string
       role:
         type: string
   object.Pricing:
@@ -4105,10 +4127,6 @@ definitions:
     properties:
       application:
         type: string
-      approveTime:
-        type: string
-      approver:
-        type: string
       createdTime:
         type: string
       description:
@@ -4125,10 +4143,6 @@ definitions:
         type: array
         items:
           type: string
-      state:
-        type: string
-      submitter:
-        type: string
       trialDuration:
         type: integer
         format: int64
@@ -4278,8 +4292,6 @@ definitions:
     title: ProviderItem
     type: object
     properties:
-      alertType:
-        type: string
       canSignIn:
         type: boolean
       canSignUp:
@@ -4296,36 +4308,7 @@ definitions:
         $ref: '#/definitions/object.Provider'
       rule:
         type: string
-  object.Record:
-    title: Record
-    type: object
-    properties:
-      action:
-        type: string
-      clientIp:
-        type: string
-      createdTime:
-        type: string
-      extendedUser:
-        $ref: '#/definitions/object.User'
-      id:
-        type: integer
-        format: int64
-      isTriggered:
-        type: boolean
-      method:
-        type: string
-      name:
-        type: string
-      object:
-        type: string
-      organization:
-        type: string
-      owner:
-        type: string
-      requestUri:
-        type: string
-      user:
+      signupGroup:
         type: string
   object.Resource:
     title: Resource
@@ -4374,6 +4357,10 @@ definitions:
         type: array
         items:
           type: string
+      groups:
+        type: array
+        items:
+          type: string
       isEnabled:
         type: boolean
       name:
@@ -4388,12 +4375,26 @@ definitions:
         type: array
         items:
           type: string
+  object.SamlItem:
+    title: SamlItem
+    type: object
+    properties:
+      name:
+        type: string
+      nameformat:
+        type: string
+      value:
+        type: string
   object.SignupItem:
     title: SignupItem
     type: object
     properties:
+      label:
+        type: string
       name:
         type: string
+      placeholder:
+        type: string
       prompted:
         type: boolean
       required:
@@ -4406,39 +4407,45 @@ definitions:
     title: Subscription
     type: object
     properties:
-      approveTime:
-        type: string
-      approver:
-        type: string
       createdTime:
         type: string
       description:
         type: string
       displayName:
         type: string
-      duration:
-        type: integer
-        format: int64
-      endDate:
+      endTime:
         type: string
         format: datetime
-      isEnabled:
-        type: boolean
       name:
         type: string
       owner:
         type: string
+      payment:
+        type: string
+      period:
+        type: string
       plan:
         type: string
-      startDate:
+      pricing:
+        type: string
+      startTime:
         type: string
         format: datetime
       state:
-        type: string
-      submitter:
-        type: string
+        $ref: '#/definitions/object.SubscriptionState'
       user:
         type: string
+  object.SubscriptionState:
+    title: SubscriptionState
+    type: string
+    enum:
+    - SubStatePending = "Pending"
+    - SubStateError = "Error"
+    - SubStateSuspended = "Suspended"
+    - SubStateActive = "Active"
+    - SubStateUpcoming = "Upcoming"
+    - SubStateExpired = "Expired"
+    example: Pending
   object.Syncer:
     title: Syncer
     type: object
@@ -4472,6 +4479,8 @@ definitions:
       port:
         type: integer
         format: int64
+      sslMode:
+        type: string
       syncInterval:
         type: integer
         format: int64
@@ -4524,6 +4533,8 @@ definitions:
     properties:
       accessToken:
         type: string
+      accessTokenHash:
+        type: string
       application:
         type: string
       code:
@@ -4548,6 +4559,8 @@ definitions:
         type: string
       refreshToken:
         type: string
+      refreshTokenHash:
+        type: string
       scope:
         type: string
       tokenType:
@@ -4609,6 +4622,8 @@ definitions:
         type: string
       azuread:
         type: string
+      azureadb2c:
+        type: string
       baidu:
         type: string
       battlenet:
@@ -4659,6 +4674,8 @@ definitions:
         type: boolean
       eveonline:
         type: string
+      externalId:
+        type: string
       facebook:
         type: string
       firstName:
@@ -4894,6 +4911,8 @@ definitions:
         type: string
       email:
         type: string
+      email_verified:
+        type: boolean
       groups:
         type: array
         items: