From 7e90146011edf89c91993c4316664eddf20a64c7 Mon Sep 17 00:00:00 2001 From: Kevin Hahn Date: Wed, 27 Sep 2023 08:28:59 +0700 Subject: [PATCH 1/7] update csproj files to use dotnet 8 --- backend/FixFwData/FixFwData.csproj | 2 +- backend/LexBoxApi/LexBoxApi.csproj | 21 ++++++++++--------- backend/LexCore/LexCore.csproj | 2 +- backend/LexData/LexData.csproj | 19 +++++++++-------- .../SyncReverseProxy/Auth/BasicAuthHandler.cs | 3 +-- .../SyncReverseProxy/SyncReverseProxy.csproj | 4 ++-- backend/Testing/Testing.csproj | 12 +++++------ 7 files changed, 32 insertions(+), 31 deletions(-) diff --git a/backend/FixFwData/FixFwData.csproj b/backend/FixFwData/FixFwData.csproj index 0d98c4104..f8bc8031c 100644 --- a/backend/FixFwData/FixFwData.csproj +++ b/backend/FixFwData/FixFwData.csproj @@ -8,7 +8,7 @@ SIL International LexBoxApi Testing Copyright © 2023 SIL International - net7.0 + net8.0 enable enable diff --git a/backend/LexBoxApi/LexBoxApi.csproj b/backend/LexBoxApi/LexBoxApi.csproj index 9e51fe404..1ef6625ba 100644 --- a/backend/LexBoxApi/LexBoxApi.csproj +++ b/backend/LexBoxApi/LexBoxApi.csproj @@ -1,7 +1,7 @@ - net7.0 + net8.0 enable enable Linux @@ -11,24 +11,25 @@ - + + runtime; build; native; contentfiles; analyzers; buildtransitive all - - - - + + + + - - - + + + all runtime; build; native; contentfiles; analyzers; buildtransitive - + diff --git a/backend/LexCore/LexCore.csproj b/backend/LexCore/LexCore.csproj index 83321cc3d..9b2d802e1 100644 --- a/backend/LexCore/LexCore.csproj +++ b/backend/LexCore/LexCore.csproj @@ -1,7 +1,7 @@ - net7.0 + net8.0 enable enable dev diff --git a/backend/LexData/LexData.csproj b/backend/LexData/LexData.csproj index 836de9f92..6f3e4da91 100644 --- a/backend/LexData/LexData.csproj +++ b/backend/LexData/LexData.csproj @@ -1,26 +1,27 @@ - net7.0 + net8.0 enable enable dev - + - + all runtime; build; native; contentfiles; analyzers; buildtransitive - - - - - - + + + + + + + diff --git a/backend/SyncReverseProxy/Auth/BasicAuthHandler.cs b/backend/SyncReverseProxy/Auth/BasicAuthHandler.cs index 0e77adf4f..5b9039a6f 100644 --- a/backend/SyncReverseProxy/Auth/BasicAuthHandler.cs +++ b/backend/SyncReverseProxy/Auth/BasicAuthHandler.cs @@ -20,9 +20,8 @@ public class BasicAuthHandler : AuthenticationHandler options, ILoggerFactory logger, UrlEncoder encoder, - ISystemClock clock, ILexProxyService lexProxyService, - IMemoryCache memoryCache) : base(options, logger, encoder, clock) + IMemoryCache memoryCache) : base(options, logger, encoder) { _lexProxyService = lexProxyService; _memoryCache = memoryCache; diff --git a/backend/SyncReverseProxy/SyncReverseProxy.csproj b/backend/SyncReverseProxy/SyncReverseProxy.csproj index 9cd1d3788..57159e456 100644 --- a/backend/SyncReverseProxy/SyncReverseProxy.csproj +++ b/backend/SyncReverseProxy/SyncReverseProxy.csproj @@ -1,7 +1,7 @@ - net7.0 + net8.0 enable enable Linux @@ -12,7 +12,7 @@ - + diff --git a/backend/Testing/Testing.csproj b/backend/Testing/Testing.csproj index 5c57fc2aa..1826c3c5d 100644 --- a/backend/Testing/Testing.csproj +++ b/backend/Testing/Testing.csproj @@ -1,7 +1,7 @@ - net7.0 + net8.0 enable enable @@ -10,10 +10,10 @@ - - - - + + + + @@ -22,7 +22,7 @@ - + runtime; build; native; contentfiles; analyzers; buildtransitive From 47f7828a13ee045c5be7dad73753e315cb05f7ba Mon Sep 17 00:00:00 2001 From: Kevin Hahn Date: Wed, 27 Sep 2023 10:02:56 +0700 Subject: [PATCH 2/7] update dockerfiles, use recommended build props for running in containers --- backend/Directory.Build.props | 13 +++++++++---- backend/Dockerfile | 4 ++-- backend/LexBoxApi/dev.Dockerfile | 3 +-- backend/LexData/LexData.csproj | 1 - 4 files changed, 12 insertions(+), 9 deletions(-) diff --git a/backend/Directory.Build.props b/backend/Directory.Build.props index 6c5a1264e..0c608b486 100644 --- a/backend/Directory.Build.props +++ b/backend/Directory.Build.props @@ -1,12 +1,17 @@ - - /app/obj/ - /app/bin/ + + $(DefaultItemExcludes);$(MSBuildProjectDirectory)/obj/**/* + $(DefaultItemExcludes);$(MSBuildProjectDirectory)/bin/**/* + + + + $(MSBuildProjectDirectory)/obj/container/ + $(MSBuildProjectDirectory)/bin/container/ false - + diff --git a/backend/Dockerfile b/backend/Dockerfile index 3bff244cb..5db510894 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -1,10 +1,10 @@ # syntax=docker/dockerfile:1 -FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base +FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base WORKDIR /app EXPOSE 80 EXPOSE 443 -FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build +FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build COPY . . # WORKDIR /src diff --git a/backend/LexBoxApi/dev.Dockerfile b/backend/LexBoxApi/dev.Dockerfile index 38591a28f..20e768811 100644 --- a/backend/LexBoxApi/dev.Dockerfile +++ b/backend/LexBoxApi/dev.Dockerfile @@ -1,5 +1,5 @@ # syntax=docker/dockerfile:1 -FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build +FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build EXPOSE 80 EXPOSE 443 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ @@ -14,5 +14,4 @@ RUN for file in $(ls *.csproj); do dir=${file%.*} mkdir -p ${file%.*}/ && mv $fi COPY . . WORKDIR /src/backend/LexBoxApi RUN mkdir /src/frontend -ENV DockerDev=true CMD dotnet watch run -lp docker --property:InformationalVersion=dockerDev diff --git a/backend/LexData/LexData.csproj b/backend/LexData/LexData.csproj index 6f3e4da91..6a8b91e45 100644 --- a/backend/LexData/LexData.csproj +++ b/backend/LexData/LexData.csproj @@ -21,7 +21,6 @@ - From 0464a9a399818a846d3808ee587215433a8a1b80 Mon Sep 17 00:00:00 2001 From: Kevin Hahn Date: Wed, 27 Sep 2023 12:27:27 +0700 Subject: [PATCH 3/7] install dotnet8 in runner --- .github/workflows/lexbox-api.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/lexbox-api.yaml b/.github/workflows/lexbox-api.yaml index 32cef0f0c..09b4e0630 100644 --- a/.github/workflows/lexbox-api.yaml +++ b/.github/workflows/lexbox-api.yaml @@ -45,7 +45,9 @@ jobs: steps: - uses: actions/checkout@v3 - + - uses: actions/setup-dotnet@v3 + with: + dotnet-version: '8.x' - name: Dotnet build run: dotnet build - name: Unit tests From 2623905b3d97bed79cd3603337361fbb1f63f1f8 Mon Sep 17 00:00:00 2001 From: Kevin Hahn Date: Mon, 30 Oct 2023 15:27:53 +0700 Subject: [PATCH 4/7] update libChorus to new dotnet 8 friendly version with Binary Formatter --- backend/Testing/Testing.csproj | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/Testing/Testing.csproj b/backend/Testing/Testing.csproj index 1826c3c5d..99a90fc68 100644 --- a/backend/Testing/Testing.csproj +++ b/backend/Testing/Testing.csproj @@ -18,10 +18,10 @@ - + - + From 5ff056130110772843be1bc4966974432fc47188 Mon Sep 17 00:00:00 2001 From: Kevin Hahn Date: Tue, 21 Nov 2023 11:34:49 +0700 Subject: [PATCH 5/7] update nuget package versions to latest --- backend/Directory.Build.props | 2 +- backend/LexBoxApi/LexBoxApi.csproj | 42 +++++++++---------- backend/LexCore/LexCore.csproj | 2 +- backend/LexData/LexData.csproj | 14 +++---- .../SyncReverseProxy/SyncReverseProxy.csproj | 22 +++++----- backend/Testing/Testing.csproj | 28 ++++++------- 6 files changed, 55 insertions(+), 55 deletions(-) diff --git a/backend/Directory.Build.props b/backend/Directory.Build.props index 0c608b486..ed66f2da0 100644 --- a/backend/Directory.Build.props +++ b/backend/Directory.Build.props @@ -12,6 +12,6 @@ false - + diff --git a/backend/LexBoxApi/LexBoxApi.csproj b/backend/LexBoxApi/LexBoxApi.csproj index 1ef6625ba..7a6e5ea4d 100644 --- a/backend/LexBoxApi/LexBoxApi.csproj +++ b/backend/LexBoxApi/LexBoxApi.csproj @@ -10,36 +10,36 @@ - - - + + + runtime; build; native; contentfiles; analyzers; buildtransitive all - - - - + + + + - - - - + + + + all runtime; build; native; contentfiles; analyzers; buildtransitive - - - - - - - + + + + + + + - - - + + + diff --git a/backend/LexCore/LexCore.csproj b/backend/LexCore/LexCore.csproj index 9b2d802e1..276363f1a 100644 --- a/backend/LexCore/LexCore.csproj +++ b/backend/LexCore/LexCore.csproj @@ -8,7 +8,7 @@ - + diff --git a/backend/LexData/LexData.csproj b/backend/LexData/LexData.csproj index 6a8b91e45..8e7835b61 100644 --- a/backend/LexData/LexData.csproj +++ b/backend/LexData/LexData.csproj @@ -10,16 +10,16 @@ - + all runtime; build; native; contentfiles; analyzers; buildtransitive - - - - - - + + + + + + diff --git a/backend/SyncReverseProxy/SyncReverseProxy.csproj b/backend/SyncReverseProxy/SyncReverseProxy.csproj index 57159e456..d275d5110 100644 --- a/backend/SyncReverseProxy/SyncReverseProxy.csproj +++ b/backend/SyncReverseProxy/SyncReverseProxy.csproj @@ -10,17 +10,17 @@ - - - - - - - - - - - + + + + + + + + + + + diff --git a/backend/Testing/Testing.csproj b/backend/Testing/Testing.csproj index 99a90fc68..0cbc8fcd1 100644 --- a/backend/Testing/Testing.csproj +++ b/backend/Testing/Testing.csproj @@ -10,29 +10,29 @@ - - - - - - - - + + + + + + + + - + - - - + + + runtime; build; native; contentfiles; analyzers; buildtransitive all - + runtime; build; native; contentfiles; analyzers; buildtransitive all - + From 1773b996b7caf09fd3448cce96cee69b7b28468d Mon Sep 17 00:00:00 2001 From: Kevin Hahn Date: Tue, 21 Nov 2023 14:58:58 +0700 Subject: [PATCH 6/7] fix hotchocolate error about dbError code, reduce deployment timeout to 60 seconds. --- backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs | 1 + deployment/base/lexbox-deployment.yaml | 1 + frontend/schema.graphql | 2 ++ 3 files changed, 4 insertions(+) diff --git a/backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs b/backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs index baa248e66..ef06324f7 100644 --- a/backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs +++ b/backend/LexBoxApi/GraphQL/GraphQlSetupKernel.cs @@ -63,6 +63,7 @@ public static void AddLexGraphQL(this IServiceCollection services, IHostEnvironm { options.IncludeExceptionDetails = true; }) + .AddType() .AddType(new DateTimeType("DateTime")) .AddType(new UuidType("UUID")) .AddType(new DateTimeType("timestamptz")) diff --git a/deployment/base/lexbox-deployment.yaml b/deployment/base/lexbox-deployment.yaml index f7dde5ada..ba01ad748 100644 --- a/deployment/base/lexbox-deployment.yaml +++ b/deployment/base/lexbox-deployment.yaml @@ -36,6 +36,7 @@ spec: selector: matchLabels: app: lexbox + progressDeadlineSeconds: 60 strategy: rollingUpdate: maxSurge: 2 diff --git a/frontend/schema.graphql b/frontend/schema.graphql index 1c03d128e..24215c35d 100644 --- a/frontend/schema.graphql +++ b/frontend/schema.graphql @@ -557,6 +557,8 @@ directive @authorize("The name of the authorization policy that determines acces "The `@specifiedBy` directive is used within the type system definition language to provide a URL for specifying the behavior of custom scalar definitions." directive @specifiedBy("The specifiedBy URL points to a human-readable specification. This field will only read a result for scalar types." url: String!) on SCALAR +directive @tag(name: String!) repeatable on SCHEMA | SCALAR | OBJECT | FIELD_DEFINITION | ARGUMENT_DEFINITION | INTERFACE | UNION | ENUM | ENUM_VALUE | INPUT_OBJECT | INPUT_FIELD_DEFINITION + scalar DateTime @specifiedBy(url: "https:\/\/www.graphql-scalars.com\/date-time") scalar UUID From 64704ca242745ea06df4262d7e633fe924dce2d9 Mon Sep 17 00:00:00 2001 From: Kevin Hahn Date: Tue, 21 Nov 2023 21:00:39 +0700 Subject: [PATCH 7/7] add test verifying that we can login users with a jwt from query params, fix bug where forgot password would not authenticate because of duplicate jti claims --- backend/LexBoxApi/Auth/JwtTicketDataFormat.cs | 2 +- backend/Testing/LexCore/LexAuthUserTests.cs | 38 ++++++++++++++++--- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/backend/LexBoxApi/Auth/JwtTicketDataFormat.cs b/backend/LexBoxApi/Auth/JwtTicketDataFormat.cs index 8c5242cea..27e786e06 100644 --- a/backend/LexBoxApi/Auth/JwtTicketDataFormat.cs +++ b/backend/LexBoxApi/Auth/JwtTicketDataFormat.cs @@ -50,7 +50,7 @@ public static string ConvertAuthTicketToJwt(AuthenticationTicket data, { var jwtDate = DateTime.UtcNow; _jwtSecurityTokenHandler.MapInboundClaims = jwtBearerOptions.MapInboundClaims; - var claimsIdentity = new ClaimsIdentity(data.Principal.Claims, data.Principal.Identity?.AuthenticationType); + var claimsIdentity = new ClaimsIdentity(data.Principal.Claims.Where(c => c.Type != JwtRegisteredClaimNames.Jti), data.Principal.Identity?.AuthenticationType); var keyId = Guid.NewGuid().ToString().GetHashCode().ToString("x", CultureInfo.InvariantCulture); claimsIdentity.AddClaim(new Claim(JwtRegisteredClaimNames.Jti, keyId)); //there may already be an audience claim, we want to reuse that if it exists, if not fallback to the default audience diff --git a/backend/Testing/LexCore/LexAuthUserTests.cs b/backend/Testing/LexCore/LexAuthUserTests.cs index 30d9d0b3d..f1b3ef322 100644 --- a/backend/Testing/LexCore/LexAuthUserTests.cs +++ b/backend/Testing/LexCore/LexAuthUserTests.cs @@ -8,6 +8,7 @@ using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Authentication.JwtBearer; using Microsoft.Extensions.Options; +using Microsoft.IdentityModel.Logging; using Microsoft.IdentityModel.Tokens; using Shouldly; @@ -15,6 +16,10 @@ namespace Testing.LexCore; public class LexAuthUserTests { + static LexAuthUserTests() + { + IdentityModelEventSource.ShowPII = true; + } private readonly LexAuthService _lexAuthService = new LexAuthService( new OptionsWrapper(JwtOptions.TestingOptions), null, @@ -30,6 +35,12 @@ public class LexAuthUserTests Projects = new[] { new AuthUserProject("test-flex", ProjectRole.Manager, Guid.NewGuid()) } }; + private static readonly JwtBearerOptions JwtBearerOptions = new() + { + TokenValidationParameters = LexAuthService.TokenValidationParameters(JwtOptions.TestingOptions), + MapInboundClaims = false + }; + [Fact] public void CanGetClaimsFromUser() { @@ -73,11 +84,7 @@ public void CanRoundTripClaimsWhenUsingSecurityTokenDescriptor() var jwt = JwtTicketDataFormat.ConvertAuthTicketToJwt( new AuthenticationTicket(_user.GetPrincipal("test"), "test"), "testing", - new JwtBearerOptions - { - TokenValidationParameters = LexAuthService.TokenValidationParameters(jwtUserOptions), - MapInboundClaims = false - }, + JwtBearerOptions, jwtUserOptions ); var tokenHandler = new JwtSecurityTokenHandler(); @@ -97,4 +104,25 @@ public void CanRoundTripJwtFromUserThroughLexAuthService() var newUser = LexAuthUser.FromClaimsPrincipal(principal); _user.ShouldBeEquivalentTo(newUser); } + + [Fact] + public void CanRoundTripThroughRefresh() + { + var (forgotJwt, _) = _lexAuthService.GenerateJwt(_user, audience:LexboxAudience.ForgotPassword); + //simulate parsing the token into a claims principal + var tokenHandler = new JwtSecurityTokenHandler(); + var forgotPrincipal = new ClaimsPrincipal(new ClaimsIdentity(tokenHandler.ReadJwtToken(forgotJwt).Claims, "Testing")); + + //simulate redirect refreshing the token + var redirectJwt = JwtTicketDataFormat.ConvertAuthTicketToJwt( + new AuthenticationTicket(forgotPrincipal, "test"), + "testing", + JwtBearerOptions, + JwtOptions.TestingOptions + ); + + var loggedInPrincipal = new ClaimsPrincipal(new ClaimsIdentity(tokenHandler.ReadJwtToken(redirectJwt).Claims, "Testing")); + var newUser = LexAuthUser.FromClaimsPrincipal(loggedInPrincipal); + (_user with { Audience = LexboxAudience.ForgotPassword }).ShouldBeEquivalentTo(newUser); + } }