From 83dcab1c15424e7a35f0f79fa737f08cc02d13a3 Mon Sep 17 00:00:00 2001 From: Ruidy Nemausat Date: Wed, 19 Feb 2020 22:47:41 +0100 Subject: [PATCH] Set API authentication using Auth0. API endpoints require Authorized JWT --- Controllers/AppUsersController.cs | 4 +-- Controllers/AssignmentsController.cs | 4 +-- Controllers/FilesController.cs | 4 +-- Controllers/HistoriesController.cs | 4 +-- Controllers/NotesController.cs | 4 +-- Controllers/ProjectsController.cs | 3 ++ Controllers/TicketsController.cs | 5 ++-- README.md | 4 +-- Scripts/cleanDevDb.sh | 5 ---- Scripts/scaffoldControllers.sh | 6 ---- Startup.cs | 41 ++++++++++++++-------------- TicketManager.csproj | 3 ++ appsettings.json | 4 +++ client/src/react-app-env.d.ts | 1 - 14 files changed, 44 insertions(+), 48 deletions(-) delete mode 100755 Scripts/cleanDevDb.sh delete mode 100755 Scripts/scaffoldControllers.sh delete mode 100644 client/src/react-app-env.d.ts diff --git a/Controllers/AppUsersController.cs b/Controllers/AppUsersController.cs index 42c9104..34a1f72 100644 --- a/Controllers/AppUsersController.cs +++ b/Controllers/AppUsersController.cs @@ -1,15 +1,15 @@ using System; using System.Collections.Generic; -using System.Linq; using System.Threading.Tasks; -using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.EntityFrameworkCore; using TicketManager.Data; using TicketManager.Models; +using Microsoft.AspNetCore.Authorization; namespace TicketManager.Controllers { + [Authorize] [Route("api/v1/[controller]")] [ApiController] public class UsersController : ControllerBase diff --git a/Controllers/AssignmentsController.cs b/Controllers/AssignmentsController.cs index 400f0a7..67f39e1 100644 --- a/Controllers/AssignmentsController.cs +++ b/Controllers/AssignmentsController.cs @@ -1,8 +1,7 @@ -using System; using System.Collections.Generic; using System.Linq; using System.Threading.Tasks; -using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.EntityFrameworkCore; using TicketManager.Data; @@ -10,6 +9,7 @@ using TicketManager.Models; namespace TicketManager.Controllers { + [Authorize] [Route("api/[controller]")] [ApiController] public class AssignmentsController : ControllerBase diff --git a/Controllers/FilesController.cs b/Controllers/FilesController.cs index 6481b76..3b422d8 100644 --- a/Controllers/FilesController.cs +++ b/Controllers/FilesController.cs @@ -1,8 +1,7 @@ -using System; using System.Collections.Generic; using System.Linq; using System.Threading.Tasks; -using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.EntityFrameworkCore; using TicketManager.Data; @@ -10,6 +9,7 @@ using TicketManager.Models; namespace TicketManager.Controllers { + [Authorize] [Route("api/v1/[controller]")] [ApiController] public class FilesController : ControllerBase diff --git a/Controllers/HistoriesController.cs b/Controllers/HistoriesController.cs index 0934909..67eee4a 100644 --- a/Controllers/HistoriesController.cs +++ b/Controllers/HistoriesController.cs @@ -1,8 +1,7 @@ -using System; using System.Collections.Generic; using System.Linq; using System.Threading.Tasks; -using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.EntityFrameworkCore; using TicketManager.Data; @@ -10,6 +9,7 @@ using TicketManager.Models; namespace TicketManager.Controllers { + [Authorize] [Route("api/v1/[controller]")] [ApiController] public class HistoriesController : ControllerBase diff --git a/Controllers/NotesController.cs b/Controllers/NotesController.cs index f2a537b..20fe5dc 100644 --- a/Controllers/NotesController.cs +++ b/Controllers/NotesController.cs @@ -1,8 +1,7 @@ -using System; using System.Collections.Generic; using System.Linq; using System.Threading.Tasks; -using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.EntityFrameworkCore; using TicketManager.Data; @@ -10,6 +9,7 @@ using TicketManager.Models; namespace TicketManager.Controllers { + [Authorize] [Route("api/v1/[controller]")] [ApiController] public class NotesController : ControllerBase diff --git a/Controllers/ProjectsController.cs b/Controllers/ProjectsController.cs index 18c6de9..1167f67 100644 --- a/Controllers/ProjectsController.cs +++ b/Controllers/ProjectsController.cs @@ -1,5 +1,6 @@ using System.Collections.Generic; using System.Threading.Tasks; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.EntityFrameworkCore; @@ -8,6 +9,8 @@ using TicketManager.Models; namespace TicketManager.Controllers { + // [Authorize(Roles = "Admin")] + [Authorize] [Produces("application/json")] [Route("api/v1/[controller]")] [ApiController] diff --git a/Controllers/TicketsController.cs b/Controllers/TicketsController.cs index 5c9cd37..90844f0 100644 --- a/Controllers/TicketsController.cs +++ b/Controllers/TicketsController.cs @@ -1,8 +1,6 @@ -using System; using System.Collections.Generic; -using System.Linq; using System.Threading.Tasks; -using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; using Microsoft.EntityFrameworkCore; using TicketManager.Data; @@ -10,6 +8,7 @@ using TicketManager.Models; namespace TicketManager.Controllers { + [Authorize] [Route("api/v1/[controller]")] [ApiController] public class TicketsController : ControllerBase diff --git a/README.md b/README.md index d37ede2..e28c7ca 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,5 @@ - Ensure Tickets Edits belong to Project Edits - Ensure Tickets Files belong to Project Files - Async model methods ? -- setMembers & removeMembers from project api not working -- Write a query class to refactor code and optimize perf on get queries (AsNoTracking) -- repository + strategy to decouple controllers from DbContext. Easier testing - update assignments automatically from context +- use PATCH instead of PUT diff --git a/Scripts/cleanDevDb.sh b/Scripts/cleanDevDb.sh deleted file mode 100755 index f470323..0000000 --- a/Scripts/cleanDevDb.sh +++ /dev/null @@ -1,5 +0,0 @@ -rm -r Migrations -rm app.db -dotnet ef migrations add Migration1 -dotnet ef database update -dotnet run \ No newline at end of file diff --git a/Scripts/scaffoldControllers.sh b/Scripts/scaffoldControllers.sh deleted file mode 100755 index e68e6a7..0000000 --- a/Scripts/scaffoldControllers.sh +++ /dev/null @@ -1,6 +0,0 @@ -rm Controllers/AppUsersController.cs -rm Controllers/TicketsController.cs -rm Controllers/ProjectsController.cs -dotnet aspnet-codegenerator controller -name AppUsersController -async -api -m AppUser -dc AppDbContext -outDir Controllers -dotnet aspnet-codegenerator controller -name TicketsController -async -api -m Ticket -dc AppDbContext -outDir Controllers -dotnet aspnet-codegenerator controller -name ProjectsController -async -api -m Project -dc AppDbContext -outDir Controllers \ No newline at end of file diff --git a/Startup.cs b/Startup.cs index 3da6027..f86c247 100644 --- a/Startup.cs +++ b/Startup.cs @@ -19,6 +19,7 @@ using TicketManager.Data; using TicketManager.Models; using Microsoft.AspNetCore.Mvc.NewtonsoftJson; using Newtonsoft.Json; +using Microsoft.AspNetCore.Authentication.JwtBearer; [assembly: ApiController] namespace TicketManager @@ -32,7 +33,6 @@ namespace TicketManager public IConfiguration Configuration { get; } - // This method gets called by the runtime. Use this method to add services to the container. public void ConfigureServices(IServiceCollection services) { services.AddDbContext(options => @@ -40,12 +40,26 @@ namespace TicketManager services.AddScoped(); services.AddScoped(); services.AddScoped(); - services.AddControllers() - .AddNewtonsoftJson(options => + + services.AddAuthentication(options => { - options.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore; // avoid cycle ref errors + options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme; + options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme; + }).AddJwtBearer(options => + { + options.Authority = "https://dev-fyjrvohx.auth0.com/"; + options.Audience = "https://localhost:5001/api/V1/"; + //options.Authority = $"https://{Configuration["Auth0:Domain"]}/"; + //options.Audience = Configuration["Auth0:Audience"]; }); + services.AddControllers() + .AddNewtonsoftJson(options => + { + options.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore; // avoid cycle ref errors + } + ); + services.AddSpaStaticFiles(configuration => { configuration.RootPath = "client/build"; @@ -72,17 +86,12 @@ namespace TicketManager services.AddSwaggerGenNewtonsoftSupport(); // explicit opt-in - needs to be placed after AddSwaggerGen() } - - - // This method gets called by the runtime. Use this method to configure the HTTP request pipeline. public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IServiceProvider serviceProvider) { if (env.IsDevelopment()) { app.UseDeveloperExceptionPage(); - var repository = serviceProvider.GetRequiredService(); - - // InitializeDatabaseAsync(repository).Wait() + // var repository = serviceProvider.GetRequiredService(); } else { @@ -92,7 +101,6 @@ namespace TicketManager app.UseHttpsRedirection(); app.UseDefaultFiles(); - app.UseSwagger(); app.UseSwaggerUI(c => @@ -100,11 +108,9 @@ namespace TicketManager c.SwaggerEndpoint("/swagger/v1/swagger.json", "Ticket Manager API v1"); }); - - app.UseSpaStaticFiles(); app.UseRouting(); - + app.UseAuthentication(); app.UseAuthorization(); app.UseEndpoints(endpoints => @@ -123,9 +129,4 @@ namespace TicketManager }); } } -} - - - - - +} \ No newline at end of file diff --git a/TicketManager.csproj b/TicketManager.csproj index 397adb0..1f38ad6 100644 --- a/TicketManager.csproj +++ b/TicketManager.csproj @@ -16,6 +16,9 @@ + + + diff --git a/appsettings.json b/appsettings.json index 390f10c..070e52f 100644 --- a/appsettings.json +++ b/appsettings.json @@ -10,5 +10,9 @@ "AllowedHosts": "*", "ConnectionStrings": { "Sqlite": "Data Source=app.db" + }, + "Auth0": { + "Domain": "https://dev-fyjrvohx.auth0.com/", + "Audience": "https://localhost:5001/api/V1/" } } \ No newline at end of file diff --git a/client/src/react-app-env.d.ts b/client/src/react-app-env.d.ts deleted file mode 100644 index 6431bc5..0000000 --- a/client/src/react-app-env.d.ts +++ /dev/null @@ -1 +0,0 @@ -///