Joseph Doherty
615b487a77
Adds missing <summary>/<param> XML docs across 99 server, worker, and test files so CommentChecker reports zero issues (TreatWarningsAsErrors needs the analyzer clean). Bundles in WIP dashboard work: NavSection extraction, MainLayout/site.css/js styling alignment, and DashboardOptions/Auth tweaks.
248 lines
10 KiB
C#
248 lines
10 KiB
C#
using System.Text.Encodings.Web;
|
|
using Microsoft.AspNetCore.Antiforgery;
|
|
using Microsoft.AspNetCore.Authentication;
|
|
using Microsoft.AspNetCore.Http.HttpResults;
|
|
using ZB.MOM.WW.MxGateway.Server.Configuration;
|
|
using ZB.MOM.WW.MxGateway.Server.Dashboard.Components;
|
|
using ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
|
|
|
|
namespace ZB.MOM.WW.MxGateway.Server.Dashboard;
|
|
|
|
/// <summary>Endpoint extensions for registering the gateway dashboard routes.</summary>
|
|
public static class DashboardEndpointRouteBuilderExtensions
|
|
{
|
|
/// <summary>Maps all gateway dashboard routes including login, logout, and Razor components.</summary>
|
|
/// <param name="endpoints">The endpoint route builder.</param>
|
|
/// <returns>The route builder for chaining.</returns>
|
|
public static IEndpointRouteBuilder MapGatewayDashboard(this IEndpointRouteBuilder endpoints)
|
|
{
|
|
IConfiguration configuration = endpoints.ServiceProvider.GetRequiredService<IConfiguration>();
|
|
IConfigurationSection dashboardSection = configuration
|
|
.GetSection($"{GatewayOptions.SectionName}:Dashboard");
|
|
|
|
if (bool.TryParse(dashboardSection["Enabled"], out bool enabled) && !enabled)
|
|
{
|
|
return endpoints;
|
|
}
|
|
|
|
endpoints.MapGet(
|
|
"/login",
|
|
(HttpContext httpContext, IAntiforgery antiforgery) => GetLoginAsync(httpContext, antiforgery))
|
|
.AllowAnonymous()
|
|
.WithName("DashboardLogin");
|
|
|
|
endpoints.MapPost(
|
|
"/login",
|
|
(HttpContext httpContext, IAntiforgery antiforgery, IDashboardAuthenticator authenticator) =>
|
|
PostLoginAsync(httpContext, antiforgery, authenticator))
|
|
.AllowAnonymous()
|
|
.WithName("DashboardLoginPost");
|
|
|
|
endpoints.MapPost(
|
|
"/logout",
|
|
(HttpContext httpContext, IAntiforgery antiforgery) => PostLogoutAsync(httpContext, antiforgery))
|
|
.AllowAnonymous()
|
|
.WithName("DashboardLogout");
|
|
|
|
// Browsers that navigate directly to /logout issue a GET. Sign out and
|
|
// redirect to /login so the URL works as users expect. Logout is
|
|
// self-destructive, so the GET path intentionally skips antiforgery.
|
|
endpoints.MapGet(
|
|
"/logout",
|
|
(Delegate)(static (HttpContext httpContext) => GetLogoutAsync(httpContext)))
|
|
.AllowAnonymous()
|
|
.WithName("DashboardLogoutGet");
|
|
|
|
endpoints.MapGet("/denied", () => Results.Content(
|
|
RenderPage("Access denied", "<p>The signed-in user is not authorized for dashboard access.</p>"),
|
|
"text/html"))
|
|
.AllowAnonymous()
|
|
.WithName("DashboardAccessDenied");
|
|
|
|
// SignalR hubs. Authorization is enforced on the hub class via
|
|
// [Authorize(Policy = HubClientsPolicy)] so the policy accepts either
|
|
// the dashboard cookie or a HubToken bearer.
|
|
endpoints.MapHub<DashboardSnapshotHub>("/hubs/snapshot");
|
|
endpoints.MapHub<AlarmsHub>("/hubs/alarms");
|
|
endpoints.MapHub<EventsHub>("/hubs/events");
|
|
|
|
// Bearer-token mint endpoint. The cookie-authenticated browser hits
|
|
// this from JS before opening a hub connection; the hub then accepts
|
|
// the returned token via the HubToken scheme. Restricting access to
|
|
// the cookie scheme keeps the bearer issuance path from being
|
|
// self-bootstrapped from a previous bearer.
|
|
endpoints.MapGet(
|
|
"/hubs/token",
|
|
(HttpContext httpContext, HubTokenService tokens) =>
|
|
{
|
|
string token = tokens.Issue(httpContext.User);
|
|
return Results.Json(new { token });
|
|
})
|
|
.RequireAuthorization(DashboardAuthenticationDefaults.ViewerPolicy)
|
|
.WithName("DashboardHubToken");
|
|
|
|
// Every dashboard Razor component requires a viewer-or-admin role. The
|
|
// login/logout/denied endpoints above opt out via AllowAnonymous(); an
|
|
// unauthenticated request to a component route is challenged by the
|
|
// cookie scheme and redirected to /login.
|
|
endpoints.MapRazorComponents<App>()
|
|
.AddInteractiveServerRenderMode()
|
|
.RequireAuthorization(DashboardAuthenticationDefaults.ViewerPolicy);
|
|
|
|
return endpoints;
|
|
}
|
|
|
|
private static Task<ContentHttpResult> GetLoginAsync(
|
|
HttpContext httpContext,
|
|
IAntiforgery antiforgery)
|
|
{
|
|
string returnUrl = SanitizeReturnUrl(httpContext.Request.Query["returnUrl"].ToString());
|
|
|
|
return Task.FromResult(TypedResults.Content(
|
|
RenderLoginPage(httpContext, antiforgery, returnUrl, failureMessage: null),
|
|
"text/html"));
|
|
}
|
|
|
|
private static async Task<IResult> PostLoginAsync(
|
|
HttpContext httpContext,
|
|
IAntiforgery antiforgery,
|
|
IDashboardAuthenticator authenticator)
|
|
{
|
|
await antiforgery.ValidateRequestAsync(httpContext).ConfigureAwait(false);
|
|
|
|
IFormCollection form = await httpContext.Request
|
|
.ReadFormAsync(httpContext.RequestAborted)
|
|
.ConfigureAwait(false);
|
|
string returnUrl = SanitizeReturnUrl(form["returnUrl"].ToString());
|
|
|
|
DashboardAuthenticationResult result = await authenticator
|
|
.AuthenticateAsync(
|
|
form["username"].ToString(),
|
|
form["password"].ToString(),
|
|
httpContext.RequestAborted)
|
|
.ConfigureAwait(false);
|
|
|
|
if (!result.Succeeded || result.Principal is null)
|
|
{
|
|
return TypedResults.Content(
|
|
RenderLoginPage(httpContext, antiforgery, returnUrl, result.FailureMessage),
|
|
"text/html",
|
|
statusCode: StatusCodes.Status401Unauthorized);
|
|
}
|
|
|
|
await httpContext
|
|
.SignInAsync(DashboardAuthenticationDefaults.AuthenticationScheme, result.Principal)
|
|
.ConfigureAwait(false);
|
|
|
|
return Results.LocalRedirect(returnUrl);
|
|
}
|
|
|
|
private static async Task<IResult> PostLogoutAsync(
|
|
HttpContext httpContext,
|
|
IAntiforgery antiforgery)
|
|
{
|
|
await antiforgery.ValidateRequestAsync(httpContext).ConfigureAwait(false);
|
|
await httpContext
|
|
.SignOutAsync(DashboardAuthenticationDefaults.AuthenticationScheme)
|
|
.ConfigureAwait(false);
|
|
|
|
return Results.LocalRedirect("/login");
|
|
}
|
|
|
|
private static async Task<IResult> GetLogoutAsync(HttpContext httpContext)
|
|
{
|
|
await httpContext
|
|
.SignOutAsync(DashboardAuthenticationDefaults.AuthenticationScheme)
|
|
.ConfigureAwait(false);
|
|
|
|
return Results.LocalRedirect("/login");
|
|
}
|
|
|
|
private static string RenderLoginPage(
|
|
HttpContext httpContext,
|
|
IAntiforgery antiforgery,
|
|
string returnUrl,
|
|
string? failureMessage)
|
|
{
|
|
AntiforgeryTokenSet tokens = antiforgery.GetAndStoreTokens(httpContext);
|
|
string requestToken = tokens.RequestToken ?? string.Empty;
|
|
string alert = string.IsNullOrWhiteSpace(failureMessage)
|
|
? string.Empty
|
|
: $"<p class=\"alert alert-danger\" role=\"alert\">{HtmlEncoder.Default.Encode(failureMessage)}</p>";
|
|
|
|
string body = $"""
|
|
<section class="dashboard-login">
|
|
{alert}
|
|
<form method="post" action="/login" class="card login-card">
|
|
<div class="card-body">
|
|
<input name="{tokens.FormFieldName}" type="hidden" value="{HtmlEncoder.Default.Encode(requestToken)}" />
|
|
<input name="returnUrl" type="hidden" value="{HtmlEncoder.Default.Encode(returnUrl)}" />
|
|
<div class="mb-3">
|
|
<label for="username" class="form-label">Username</label>
|
|
<input id="username" name="username" type="text" autocomplete="username" class="form-control" />
|
|
</div>
|
|
<div class="mb-3">
|
|
<label for="password" class="form-label">Password</label>
|
|
<input id="password" name="password" type="password" autocomplete="current-password" class="form-control" />
|
|
</div>
|
|
<button type="submit" class="btn btn-primary">Sign in</button>
|
|
</div>
|
|
</form>
|
|
</section>
|
|
""";
|
|
|
|
return RenderPage("Dashboard Sign In", heading: null, body);
|
|
}
|
|
|
|
private static string RenderPage(string title, string body)
|
|
=> RenderPage(title, heading: title, body);
|
|
|
|
private static string RenderPage(string title, string? heading, string body)
|
|
{
|
|
string headingHtml = string.IsNullOrEmpty(heading)
|
|
? string.Empty
|
|
: $"""
|
|
<div class="dashboard-page-header">
|
|
<h1>{HtmlEncoder.Default.Encode(heading)}</h1>
|
|
</div>
|
|
""";
|
|
|
|
return $"""
|
|
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<title>{HtmlEncoder.Default.Encode(title)}</title>
|
|
<link rel="stylesheet" href="/lib/bootstrap/css/bootstrap.min.css" />
|
|
<link rel="stylesheet" href="/css/theme.css" />
|
|
<link rel="stylesheet" href="/css/site.css" />
|
|
</head>
|
|
<body class="dashboard-body">
|
|
<header class="app-bar">
|
|
<span class="brand"><span class="mark">▮</span> MXAccess Gateway</span>
|
|
</header>
|
|
<main class="page">
|
|
{headingHtml}
|
|
{body}
|
|
</main>
|
|
<script src="/lib/bootstrap/js/bootstrap.bundle.min.js"></script>
|
|
</body>
|
|
</html>
|
|
""";
|
|
}
|
|
|
|
private static string SanitizeReturnUrl(string? returnUrl)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(returnUrl)
|
|
|| !returnUrl.StartsWith("/", StringComparison.Ordinal)
|
|
|| returnUrl.StartsWith("//", StringComparison.Ordinal)
|
|
|| Uri.TryCreate(returnUrl, UriKind.Absolute, out _))
|
|
{
|
|
return "/";
|
|
}
|
|
|
|
return returnUrl;
|
|
}
|
|
}
|