476 lines
18 KiB
C#
476 lines
18 KiB
C#
// L'erreur SA1200 (ordre des using directives) est desactivee pour Program.cs
|
||
#pragma warning disable SA1200
|
||
|
||
using System.IdentityModel.Tokens.Jwt;
|
||
using System.Security.Claims;
|
||
using System.Text.Json;
|
||
|
||
using Microsoft.AspNetCore.Authentication.Cookies;
|
||
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
|
||
using Microsoft.AspNetCore.HttpOverrides;
|
||
using Microsoft.EntityFrameworkCore;
|
||
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
|
||
using Microsoft.IdentityModel.Tokens;
|
||
|
||
using NLog;
|
||
using NLog.Web;
|
||
|
||
using Webzine.Business;
|
||
using Webzine.Business.Contracts;
|
||
using Webzine.Business.Seeders;
|
||
using Webzine.EntitiesContext;
|
||
using Webzine.Entity;
|
||
using Webzine.Entity.Fixtures;
|
||
using Webzine.Repository;
|
||
using Webzine.Repository.Contracts;
|
||
using Webzine.WebApplication.Configuration;
|
||
using Webzine.WebApplication.Extensions;
|
||
using Webzine.WebApplication.Filters;
|
||
using Webzine.WebApplication.Interceptors;
|
||
|
||
// Initiation du logger NLog pour la classe courante afin de pouvoir l'utiliser pour logger des messages d'information, d'erreur, etc avant la construction de l'application.
|
||
var logger = LogManager.Setup().LoadConfigurationFromAppSettings().GetCurrentClassLogger();
|
||
logger.Debug("init main");
|
||
|
||
static void AddRoleClaim(ClaimsIdentity identity, string? roleValue)
|
||
{
|
||
if (!string.IsNullOrWhiteSpace(roleValue) &&
|
||
!identity.HasClaim(claim => claim.Type == "role" && claim.Value == roleValue))
|
||
{
|
||
identity.AddClaim(new Claim("role", roleValue));
|
||
}
|
||
}
|
||
|
||
static void AddKeycloakRolesFromJson(ClaimsIdentity identity, string? json, string? clientId)
|
||
{
|
||
if (string.IsNullOrWhiteSpace(json))
|
||
{
|
||
return;
|
||
}
|
||
|
||
using var document = JsonDocument.Parse(json);
|
||
|
||
if (document.RootElement.TryGetProperty("realm_access", out var realmAccessElement) &&
|
||
realmAccessElement.TryGetProperty("roles", out var realmRolesElement))
|
||
{
|
||
foreach (var role in realmRolesElement.EnumerateArray())
|
||
{
|
||
AddRoleClaim(identity, role.GetString());
|
||
}
|
||
}
|
||
|
||
if (!string.IsNullOrWhiteSpace(clientId) &&
|
||
document.RootElement.TryGetProperty("resource_access", out var resourceAccessElement) &&
|
||
resourceAccessElement.TryGetProperty(clientId, out var clientAccessElement) &&
|
||
clientAccessElement.TryGetProperty("roles", out var clientRolesElement))
|
||
{
|
||
foreach (var role in clientRolesElement.EnumerateArray())
|
||
{
|
||
AddRoleClaim(identity, role.GetString());
|
||
}
|
||
}
|
||
}
|
||
|
||
static void AddKeycloakRolesFromClaims(ClaimsIdentity identity, ClaimsPrincipal principal, string? clientId)
|
||
{
|
||
var realmAccessClaim = principal.FindFirst("realm_access")?.Value;
|
||
if (!string.IsNullOrWhiteSpace(realmAccessClaim))
|
||
{
|
||
AddKeycloakRolesFromJson(identity, $$"""{ "realm_access": {{realmAccessClaim}} }""", clientId);
|
||
}
|
||
|
||
var resourceAccessClaim = principal.FindFirst("resource_access")?.Value;
|
||
if (!string.IsNullOrWhiteSpace(resourceAccessClaim))
|
||
{
|
||
AddKeycloakRolesFromJson(identity, $$"""{ "resource_access": {{resourceAccessClaim}} }""", clientId);
|
||
}
|
||
}
|
||
|
||
static void AddKeycloakRolesFromAccessToken(ClaimsIdentity identity, string? accessToken, string? clientId)
|
||
{
|
||
if (string.IsNullOrWhiteSpace(accessToken))
|
||
{
|
||
return;
|
||
}
|
||
|
||
var token = new JwtSecurityTokenHandler().ReadJwtToken(accessToken);
|
||
var payload = JsonSerializer.Serialize(token.Payload);
|
||
|
||
AddKeycloakRolesFromJson(identity, payload, clientId);
|
||
}
|
||
|
||
static async Task LogKeycloakMetadataAsync(IConfiguration configuration, Logger logger)
|
||
{
|
||
var metadataAddress = configuration["Keycloak:MetadataAddress"];
|
||
if (string.IsNullOrWhiteSpace(metadataAddress))
|
||
{
|
||
var authority = configuration["Keycloak:Authority"]?.TrimEnd('/');
|
||
metadataAddress = string.IsNullOrWhiteSpace(authority)
|
||
? null
|
||
: authority + "/.well-known/openid-configuration";
|
||
}
|
||
|
||
if (string.IsNullOrWhiteSpace(metadataAddress))
|
||
{
|
||
logger.Warn("Diagnostic Keycloak ignore : aucune adresse de metadata configuree.");
|
||
return;
|
||
}
|
||
|
||
try
|
||
{
|
||
using var handler = new HttpClientHandler
|
||
{
|
||
ServerCertificateCustomValidationCallback =
|
||
HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
|
||
};
|
||
using var httpClient = new HttpClient(handler);
|
||
using var response = await httpClient.GetAsync(metadataAddress);
|
||
var content = await response.Content.ReadAsStringAsync();
|
||
var preview = content.Length > 500 ? content[..500] : content;
|
||
|
||
logger.Info(
|
||
"Diagnostic Keycloak metadata | Url: {MetadataAddress} | Status: {StatusCode} | ContentType: {ContentType} | Body: {BodyPreview}",
|
||
metadataAddress,
|
||
(int)response.StatusCode,
|
||
response.Content.Headers.ContentType?.ToString(),
|
||
preview.Replace(Environment.NewLine, " "));
|
||
Console.WriteLine(
|
||
"Diagnostic Keycloak metadata | Url: " + metadataAddress +
|
||
" | Status: " + (int)response.StatusCode +
|
||
" | ContentType: " + response.Content.Headers.ContentType +
|
||
" | Body: " + preview.Replace(Environment.NewLine, " "));
|
||
}
|
||
catch (Exception exception)
|
||
{
|
||
logger.Error(exception, "Diagnostic Keycloak metadata impossible | Url: {MetadataAddress} | Message: {Message}", metadataAddress, exception.Message);
|
||
Console.WriteLine("Diagnostic Keycloak metadata impossible | Url: " + metadataAddress + " | Message: " + exception.Message);
|
||
}
|
||
}
|
||
|
||
try
|
||
{
|
||
var builder = WebApplication.CreateBuilder(args);
|
||
|
||
builder.Services.AddControllersWithViews(options =>
|
||
{
|
||
options.Filters.Add<ValidationActionFilter>();
|
||
options.Filters.Add<GlobalExceptionFilter>();
|
||
})
|
||
.AddRazorRuntimeCompilation();
|
||
|
||
JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
|
||
|
||
// Important derrière Nginx pour que ASP.NET Core comprenne bien :
|
||
// - le host public
|
||
// - le scheme https
|
||
builder.Services.Configure<ForwardedHeadersOptions>(options =>
|
||
{
|
||
options.ForwardedHeaders =
|
||
ForwardedHeaders.XForwardedFor |
|
||
ForwardedHeaders.XForwardedProto |
|
||
ForwardedHeaders.XForwardedHost;
|
||
|
||
options.KnownNetworks.Clear();
|
||
options.KnownProxies.Clear();
|
||
});
|
||
|
||
builder.Services
|
||
.AddAuthentication(options =>
|
||
{
|
||
options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
|
||
options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
|
||
})
|
||
.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
|
||
{
|
||
options.LoginPath = "/account/login";
|
||
options.LogoutPath = "/account/logout";
|
||
options.AccessDeniedPath = "/account/access-denied";
|
||
})
|
||
.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
|
||
{
|
||
var publicOrigin = builder.Configuration["Keycloak:PublicOrigin"]?.TrimEnd('/');
|
||
var callbackPath = builder.Configuration["Keycloak:CallbackPath"] ?? "/signin-oidc";
|
||
var signedOutCallbackPath = builder.Configuration["Keycloak:SignedOutCallbackPath"] ?? "/signout-callback-oidc";
|
||
var metadataAddress = builder.Configuration["Keycloak:MetadataAddress"];
|
||
|
||
options.Authority = builder.Configuration["Keycloak:Authority"];
|
||
if (!string.IsNullOrWhiteSpace(metadataAddress))
|
||
{
|
||
options.MetadataAddress = metadataAddress;
|
||
}
|
||
|
||
options.ClientId = builder.Configuration["Keycloak:ClientId"];
|
||
options.ClientSecret = builder.Configuration["Keycloak:ClientSecret"];
|
||
options.ResponseType = OpenIdConnectResponseType.Code;
|
||
|
||
options.CallbackPath = callbackPath;
|
||
options.SignedOutCallbackPath = signedOutCallbackPath;
|
||
|
||
// Reverse proxy + certificat autosigné
|
||
options.RequireHttpsMetadata = false;
|
||
|
||
// Désactive PAR pour éviter l’erreur "Invalid parameter: redirect_uri"
|
||
options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable;
|
||
|
||
options.SaveTokens = false;
|
||
options.GetClaimsFromUserInfoEndpoint = false;
|
||
|
||
options.Scope.Clear();
|
||
options.Scope.Add("openid");
|
||
options.Scope.Add("profile");
|
||
options.Scope.Add("email");
|
||
|
||
options.TokenValidationParameters = new TokenValidationParameters
|
||
{
|
||
NameClaimType = "preferred_username",
|
||
RoleClaimType = "role",
|
||
};
|
||
|
||
// Temporaire pour environnement de test avec certificat autosigné
|
||
options.BackchannelHttpHandler = new HttpClientHandler
|
||
{
|
||
ServerCertificateCustomValidationCallback =
|
||
HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
|
||
};
|
||
|
||
options.Events = new OpenIdConnectEvents
|
||
{
|
||
OnAuthenticationFailed = context =>
|
||
{
|
||
logger.Error(context.Exception, "Erreur d'authentification OIDC : {Message}", context.Exception.Message);
|
||
context.HandleResponse();
|
||
context.Response.Redirect("/account/auth-error?message=" + Uri.EscapeDataString(context.Exception.Message));
|
||
return Task.CompletedTask;
|
||
},
|
||
|
||
OnRedirectToIdentityProvider = context =>
|
||
{
|
||
if (!string.IsNullOrWhiteSpace(publicOrigin))
|
||
{
|
||
context.ProtocolMessage.RedirectUri = publicOrigin + context.Options.CallbackPath;
|
||
}
|
||
|
||
logger.Info("RedirectUri Keycloak envoyee : {RedirectUri}", context.ProtocolMessage.RedirectUri);
|
||
logger.Info("MetadataAddress Keycloak utilisee : {MetadataAddress}", context.Options.MetadataAddress);
|
||
Console.WriteLine("RedirectUri envoyé à Keycloak : " + context.ProtocolMessage.RedirectUri);
|
||
Console.WriteLine("Authority utilisée : " + context.Options.Authority);
|
||
|
||
return Task.CompletedTask;
|
||
},
|
||
|
||
OnRedirectToIdentityProviderForSignOut = context =>
|
||
{
|
||
var idToken = context.HttpContext.User.FindFirst("id_token")?.Value;
|
||
if (!string.IsNullOrWhiteSpace(idToken))
|
||
{
|
||
context.ProtocolMessage.IdTokenHint = idToken;
|
||
}
|
||
|
||
if (!string.IsNullOrWhiteSpace(publicOrigin))
|
||
{
|
||
context.ProtocolMessage.PostLogoutRedirectUri = publicOrigin + context.Options.SignedOutCallbackPath;
|
||
}
|
||
|
||
return Task.CompletedTask;
|
||
},
|
||
|
||
OnTokenValidated = context =>
|
||
{
|
||
var identity = (ClaimsIdentity)context.Principal!.Identity!;
|
||
var clientId = context.Options.ClientId;
|
||
|
||
if (context.SecurityToken is JwtSecurityToken idToken &&
|
||
!string.IsNullOrWhiteSpace(idToken.RawData))
|
||
{
|
||
identity.AddClaim(new Claim("id_token", idToken.RawData));
|
||
}
|
||
|
||
AddKeycloakRolesFromClaims(identity, context.Principal, clientId);
|
||
AddKeycloakRolesFromAccessToken(identity, context.TokenEndpointResponse?.AccessToken, clientId);
|
||
|
||
logger.Info(
|
||
"Roles Keycloak ajoutes a l'utilisateur {User}: {Roles}",
|
||
identity.Name,
|
||
string.Join(", ", identity.FindAll("role").Select(claim => claim.Value)));
|
||
|
||
return Task.CompletedTask;
|
||
},
|
||
|
||
OnRemoteFailure = context =>
|
||
{
|
||
var remoteError = context.Request.Query["error"].ToString();
|
||
var remoteDescription = context.Request.Query["error_description"].ToString();
|
||
var failureMessage = context.Failure?.Message;
|
||
var message = string.Join(
|
||
Environment.NewLine,
|
||
new[] { remoteError, remoteDescription, failureMessage }.Where(value => !string.IsNullOrWhiteSpace(value)));
|
||
|
||
logger.Error(context.Failure, "Erreur OIDC distante : {Message}", message);
|
||
Console.WriteLine("Erreur OIDC distante : " + message);
|
||
context.HandleResponse();
|
||
context.Response.Redirect("/account/auth-error?message=" + Uri.EscapeDataString(message));
|
||
return Task.CompletedTask;
|
||
},
|
||
};
|
||
});
|
||
|
||
builder.Services.AddAuthorization(options =>
|
||
{
|
||
options.AddPolicy("RequireUser", policy => policy.RequireRole("USER", "ADMIN"));
|
||
options.AddPolicy("RequireAdmin", policy => policy.RequireRole("ADMIN"));
|
||
});
|
||
|
||
// NLog: Setup NLog for Dependency injection
|
||
builder.Logging.ClearProviders();
|
||
builder.Host.UseNLog();
|
||
|
||
builder.Services.Configure<SpotifySeederOptions>(builder.Configuration.GetSection("SpotifySeeder"));
|
||
builder.Services.AddHttpClient<SeedDataSpotify>();
|
||
|
||
builder.Services.Configure<EfPerformanceOptions>(options =>
|
||
{
|
||
options.SeuilMs = builder.Configuration.GetValue<int>("EfPerformance:SeuilMs");
|
||
});
|
||
|
||
builder.Services.AddSingleton<EfSlowQueryInterceptor>();
|
||
|
||
// En fonction de la configuration, utilise soit les repositories basés sur une base de données, soit les repositories basés sur des listes locales.
|
||
var repositoryType = builder.Configuration.GetValue<RepositoryType>("Repository");
|
||
var seederType = builder.Configuration.GetValue<SeederType>("Seeder");
|
||
var shouldSeed = args.Contains("--seed");
|
||
|
||
if (repositoryType == RepositoryType.Db)
|
||
{
|
||
if (builder.Environment.IsProduction())
|
||
{
|
||
builder.Services.AddDbContext<WebzineDbContext>((serviceProvider, options) =>
|
||
{
|
||
options
|
||
.UseNpgsql(builder.Configuration.GetConnectionString("PostGreSQLConnection"))
|
||
.AddInterceptors(serviceProvider.GetRequiredService<EfSlowQueryInterceptor>());
|
||
});
|
||
}
|
||
else
|
||
{
|
||
builder.Services.AddDbContext<WebzineDbContext>((serviceProvider, options) =>
|
||
{
|
||
options
|
||
.UseSqlite(builder.Configuration.GetConnectionString("SqliteConnection"))
|
||
.AddInterceptors(serviceProvider.GetRequiredService<EfSlowQueryInterceptor>());
|
||
});
|
||
}
|
||
|
||
builder.Services.AddScoped<DbEntityRepository>();
|
||
builder.Services.AddScoped<ITitreRepository, DbTitreRepository>();
|
||
builder.Services.AddScoped<IStyleRepository, DbStyleRepository>();
|
||
builder.Services.AddScoped<IArtisteRepository, DbArtisteRepository>();
|
||
builder.Services.AddScoped<ICommentaireRepository, DbCommentaireRepository>();
|
||
}
|
||
else
|
||
{
|
||
builder.Services.AddScoped<ITitreRepository, LocalTitreRepository>();
|
||
builder.Services.AddScoped<IStyleRepository, LocalStyleRepository>();
|
||
builder.Services.AddScoped<IArtisteRepository, LocalArtisteRepository>();
|
||
builder.Services.AddScoped<ICommentaireRepository, LocalCommentaireRepository>();
|
||
builder.Services.AddSingleton<InMemoryDataStore>();
|
||
}
|
||
|
||
builder.Services.AddScoped<IDashboardService, DashboardService>();
|
||
builder.Services.AddScoped<ITitreAdminService, TitreAdminService>();
|
||
|
||
builder.Services.AddScoped<ValidationActionFilter>();
|
||
builder.Services.AddScoped<GlobalExceptionFilter>();
|
||
|
||
builder.Services.AddResponseCompression();
|
||
|
||
var app = builder.Build();
|
||
await LogKeycloakMetadataAsync(builder.Configuration, logger);
|
||
|
||
// Très important avant tout middleware qui lit le scheme/host de la requête.
|
||
app.UseForwardedHeaders();
|
||
|
||
app.UseMiddleware<Webzine.WebApplication.Middlewares.LogTempsExecutionMiddleware>();
|
||
|
||
if (repositoryType == RepositoryType.Db)
|
||
{
|
||
using (var scope = app.Services.CreateScope())
|
||
{
|
||
var db = scope.ServiceProvider.GetRequiredService<WebzineDbContext>();
|
||
db.Database.EnsureCreated();
|
||
|
||
if (shouldSeed)
|
||
{
|
||
db.Database.EnsureDeleted();
|
||
db.Database.EnsureCreated();
|
||
var repo = scope.ServiceProvider.GetRequiredService<DbEntityRepository>();
|
||
|
||
if (seederType == SeederType.Local)
|
||
{
|
||
repo.SeedBaseDeDonnees(nbArtistes: 1000, nbTitres: 50000, maxStyles: 50);
|
||
}
|
||
else if (seederType == SeederType.Spotify)
|
||
{
|
||
var spotifySeeder = scope.ServiceProvider.GetRequiredService<SeedDataSpotify>();
|
||
var jeuDeDonnees = await spotifySeeder.GenererJeuDeDonneesAsync();
|
||
repo.SeedBaseDeDonnees(jeuDeDonnees);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
else
|
||
{
|
||
using (var scope = app.Services.CreateScope())
|
||
{
|
||
var store = scope.ServiceProvider.GetRequiredService<InMemoryDataStore>();
|
||
|
||
var artistes = SeedDataLocal.GenererListeArtiste(100);
|
||
var styles = SeedDataLocal.GenererListeStyle(15, 20);
|
||
var albums = SeedDataLocal.GenererListeAlbums(50);
|
||
var commentaires = new List<Commentaire>();
|
||
var titres = SeedDataLocal.GenererListeTitre(500, artistes, styles, albums);
|
||
|
||
int commentaireIdStart = 1;
|
||
foreach (var titre in titres)
|
||
{
|
||
var commentairesForTitre = SeedDataLocal.GenererListeCommentaire(titre, 0, 5, commentaireIdStart);
|
||
titre.Commentaires.AddRange(commentairesForTitre);
|
||
commentaires.AddRange(commentairesForTitre);
|
||
commentaireIdStart += commentairesForTitre.Count;
|
||
}
|
||
|
||
store.Artistes.AddRange(artistes);
|
||
store.Styles = styles;
|
||
store.Titres = titres;
|
||
store.Commentaires.AddRange(commentaires);
|
||
}
|
||
}
|
||
|
||
app.UseResponseCompression();
|
||
|
||
app.UseStaticFiles(new StaticFileOptions
|
||
{
|
||
OnPrepareResponse = ctx =>
|
||
{
|
||
ctx.Context.Response.Headers.Append("Cache-Control", "public, max-age=31536000");
|
||
},
|
||
});
|
||
|
||
app.UseRouting();
|
||
|
||
app.UseAuthentication();
|
||
app.UseAuthorization();
|
||
|
||
app.MapCustomRoutes();
|
||
app.MapControllers();
|
||
|
||
app.Run();
|
||
}
|
||
catch (Exception exception)
|
||
{
|
||
logger.Error(exception, "Stopped program because of exception");
|
||
throw;
|
||
}
|
||
finally
|
||
{
|
||
LogManager.Shutdown();
|
||
} |