[NAE-2241] Anonymous access refactor #316
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,11 +20,21 @@ | |
| "sessionTimeoutEnabled": false, | ||
| "sessionTimeout": 900, | ||
| "jwtBearer": "X-Jwt-Token", | ||
| "apiToken": { | ||
| "enabled": true, | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🤖 get_repo_knowledge executed:
Length of output: 844 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- nae.json ---'
cat -n nae.json | sed -n '1,80p'
printf '%s\n' '--- relevant files ---'
rg -n --glob '!node_modules' --glob '!dist' 'loginWithApiToken|removeFromUrl|auth\.address|endpoints\.login|api.?token' .Repository: netgrif/components Length of output: 50375 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- nae.json ---'
cat -n nae.json | sed -n '1,60p'
printf '%s\n' '--- source matches ---'
rg -n --glob 'projects/**' --glob '!**/*.html' --glob '!**/docs/**' \
'loginWithApiToken|removeFromUrl|auth\.address|endpoints\.login|api.?token' \
projects | head -n 240Repository: netgrif/components Length of output: 9097 🏁 Script executed: #!/bin/bash
set -eu
cat -n nae.json | sed -n '1,60p'
printf '%s\n' '--- matching source files ---'
rg -l --glob 'projects/**' --glob '!**/*.html' --glob '!**/docs/**' \
'loginWithApiToken|removeFromUrl|auth\.address|endpoints\.login|api.?token' projectsRepository: netgrif/components Length of output: 4674 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- authentication guard ---'
cat -n projects/netgrif-components-core/src/lib/authentication/services/guard/authentication-guard.service.ts | sed -n '1,110p'
printf '%s\n' '--- proxy authentication ---'
cat -n projects/netgrif-components-core/src/lib/authentication/proxyAuthentication.service.ts | sed -n '1,90p'
printf '%s\n' '--- configuration URL handling ---'
cat -n projects/netgrif-components-core/src/lib/configuration/configuration.service.ts | sed -n '145,185p;250,280p'Repository: netgrif/components Length of output: 13095 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- references to nae.json and configuration loading ---'
rg -n --glob '!**/*.html' --glob '!**/docs/**' --glob '!dist/**' \
'nae\.json|nae-default|APPLICATION_CONFIG|configuration.*json' \
package.json angular.json workspace.json nx.json projects README.md docs 2>/dev/null | head -n 240
printf '%s\n' '--- root files ---'
git ls-files | rg '(^|/)(nae\.json|package\.json|angular\.json|workspace\.json|nx\.json|README\.md)$' | head -n 120Repository: netgrif/components Length of output: 10352 Sensitive Data Exposure Reachability: External Use HTTPS before enabling API-token login.
🤖 Prompt for AI Agents |
||
| "queryParameter": "token", | ||
| "realmQueryParameter": "realmId", | ||
| "removeFromUrl": true, | ||
| "allowedPaths": [ | ||
| "/tabbed-views", | ||
| "/tabbed-views/**" | ||
| ] | ||
| }, | ||
| "sso": { | ||
| "enable": false, | ||
| "clientId": "dev-cluster-worker", | ||
| "redirectUrl": "http://localhost:8081/realms/netgrif-cloud-testing/protocol/openid-connect/auth", | ||
| "refreshUrl": "http://localhost:8080/api/auth/login", | ||
| "scopes": ["openid","email","profile","roles"] | ||
| } | ||
| }, | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| { | ||
| "name": "@netgrif/components-project", | ||
| "version": "7.0.2", | ||
| "description": "Netgrif Application Engine Frontend project. Project includes angular libraries as base for NAE applications.", | ||
| "homepage": "https://components.netgrif.com", | ||
| "license": "SEE LICENSE IN LICENSE", | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,7 +28,7 @@ export class AppComponent { | |
| translate.setTranslation('en', en, true); | ||
| translate.setTranslation('sk', sk, true); | ||
|
|
||
| this.userService.user$.pipe(filter(u => !!u && u.id !== '' && !u.isAnonymous()), take(1)).subscribe(() => { | ||
| const allNets = allowedNetsFactory.createWithAllNets(); | ||
| allNets.allowedNetsIdentifiers$.pipe(take(1)).subscribe(nets => { | ||
| if (this.baseAllowedNets.allowedNets.length !== 0) { | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| { | ||
| "name": "@netgrif/components-core", | ||
| "version": "7.0.2", | ||
|
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🤖 get_repo_knowledge executed:
Length of output: 1394 🏁 Script executed: #!/bin/bash
printf '%s\n' '--- package manifests ---'
cat -n projects/netgrif-components-core/package.json
cat -n projects/netgrif-components/package.json
printf '%s\n' '--- workspace manifests ---'
for f in package.json angular.json; do
if [ -f "$f" ]; then cat -n "$f"; fi
done
printf '%s\n' '--- Angular version declarations ---'
rg -n '"`@angular/`|angularVersion|ngVersion|peerDependencies|dependencies|devDependencies' \
package.json projects/netgrif-components-core/package.json projects/netgrif-components/package.json \
angular.json 2>/dev/nullRepository: netgrif/components Length of output: 29330 🏁 Script executed: #!/bin/bash
cat -n projects/netgrif-components-core/package.json
cat -n projects/netgrif-components/package.json
cat -n package.jsonRepository: netgrif/components Length of output: 13848 🤖 get_repo_knowledge executed:
Length of output: 1394 🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- core manifest ---'
cat -n projects/netgrif-components-core/package.json
printf '%s\n' '--- components manifest ---'
cat -n projects/netgrif-components/package.json
printf '%s\n' '--- root manifest ---'
cat -n package.jsonRepository: netgrif/components Length of output: 13920 🌐 Web query:
💡 Result: The Citations:
🏁 Script executed: printf '%s\n' '--- files ---'
git ls-files '*package.json' | sort
printf '%s\n' '--- core ---'
sed -n '1,120p' projects/netgrif-components-core/package.json
printf '%s\n' '--- package ---'
sed -n '1,120p' projects/netgrif-components/package.json
printf '%s\n' '--- root ---'
sed -n '1,160p' package.jsonRepository: netgrif/components Length of output: 12086 Synchronize the Angular peer ranges before publishing 7.0.2. The workspace uses Angular 17.3.x, but both library manifests declare 📍 Affects 2 files
🤖 Prompt for AI Agents |
||
| "description": "Netgrif Application engine frontend core Angular library", | ||
| "homepage": "https://components.netgrif.com", | ||
| "license": "SEE LICENSE IN LICENSE", | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -47,11 +47,20 @@ export interface Auth { | |
| sessionBearer?: string; | ||
| jwtEnabled?: boolean; | ||
| jwtBearer?: string; | ||
| apiToken?: ApiTokenAuthentication; | ||
| endpoints?: string | { [k: string]: string }; | ||
|
|
||
| [k: string]: any; | ||
| } | ||
|
|
||
| export interface ApiTokenAuthentication { | ||
| enabled?: boolean; | ||
| queryParameter?: string; | ||
| realmQueryParameter?: string; | ||
| removeFromUrl?: boolean; | ||
| allowedPaths?: Array<string>; | ||
| } | ||
|
|
||
| export interface Resource { | ||
| name: string; | ||
| address: string; | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -45,12 +45,21 @@ export interface Auth { | |
| address: string; | ||
| authentication: string; | ||
| sessionBearer?: string; | ||
| apiToken?: ApiTokenAuthentication; | ||
| endpoints?: string | { [k: string]: string }; | ||
| sso?: Sso; | ||
|
|
||
| [k: string]: any; | ||
| } | ||
|
|
||
| export interface ApiTokenAuthentication { | ||
| enabled?: boolean; | ||
| queryParameter?: string; | ||
| realmQueryParameter?: string; | ||
| removeFromUrl?: boolean; | ||
| allowedPaths?: Array<string>; | ||
| } | ||
|
|
||
| export interface Sso { | ||
| enable: boolean; | ||
| redirectUrl: string; | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,7 +6,7 @@ import {ProxyAuthenticationService} from './proxyAuthentication.service'; | |
| import {AuthenticationMethodService} from './services/authentication-method.service'; | ||
| import {OverlayModule} from '@angular/cdk/overlay'; | ||
| import {MatProgressSpinnerModule} from '@angular/material/progress-spinner'; | ||
| // import {AnonymousAuthenticationInterceptor} from './services/anonymous-authentication-interceptor'; | ||
|
|
||
|
|
||
| @NgModule({ | ||
|
|
@@ -22,7 +22,7 @@ import {AnonymousAuthenticationInterceptor} from './services/anonymous-authentic | |
| ], | ||
| providers: [ | ||
| { provide: HTTP_INTERCEPTORS, useClass: AuthenticationInterceptor, multi: true }, | ||
| // { provide: HTTP_INTERCEPTORS, useClass: AnonymousAuthenticationInterceptor, multi: true }, | ||
| { provide: AuthenticationMethodService, useClass: ProxyAuthenticationService}, | ||
| // AuthenticationEffects | ||
| ] | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -17,7 +17,8 @@ describe('ProxyAuthenticationService', () => { | |
| auth: { | ||
| authentication: 'basic', | ||
| address: 'http://localhost:8080', | ||
| endpoints: {login: '/api/auth/login'}, | ||
| apiToken: {} | ||
| } | ||
| } | ||
| } as any, | ||
|
|
@@ -59,4 +60,19 @@ describe('ProxyAuthenticationService', () => { | |
|
|
||
| expect(response).toBeTruthy(); | ||
| })); | ||
|
|
||
| it('authenticates an API token with bearer and realm headers', fakeAsync(() => { | ||
| let response: any; | ||
|
|
||
| service.loginWithApiToken('user-id.secret', 'Admin').subscribe(res => response = res); | ||
|
|
||
| const req = httpMock.expectOne('http://localhost:8080/api/auth/login'); | ||
| expect(req.request.method).toBe('GET'); | ||
| expect(req.request.headers.get('Authorization')).toBe('Bearer user-id.secret'); | ||
| expect(req.request.headers.get('X-Realm-ID')).toBe('Admin'); | ||
| req.flush({id: '1', name: 'User'}); | ||
|
|
||
| tick(); | ||
| expect(response).toBeTruthy(); | ||
| })); | ||
| }); | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,12 @@ | ||
| import {ConfigurationService} from '../configuration/configuration.service'; | ||
| import {NullAuthenticationService} from './services/methods/null-authentication/null-authentication.service'; | ||
| import {BasicAuthenticationService} from './services/methods/basic-authentication/basic-authentication.service'; | ||
| import {HttpClient, HttpHeaders} from '@angular/common/http'; | ||
| import {BasicWithRealmAuthenticationService} from "./services/methods/basic-authentication/basic-with-realm-authentication.service"; | ||
| import {filter, take} from "rxjs/operators"; | ||
| import {UserResource} from "../resources/interface/user-resource"; | ||
| import {Credentials} from "./models/credentials"; | ||
| import {Observable, throwError} from 'rxjs'; | ||
| import {Injectable} from "@angular/core"; | ||
| import {AuthenticationMethodService} from "./services/authentication-method.service"; | ||
|
|
||
|
|
@@ -46,6 +46,24 @@ | |
| return this._proxyAuthMethod.login(credentials); | ||
| } | ||
|
|
||
| loginWithApiToken(token: string, realmId?: string): Observable<UserResource> { | ||
| const auth = this._config.get().providers.auth; | ||
| const loginEndpoint = typeof auth.endpoints === 'object' ? auth.endpoints['login'] : undefined; | ||
| const url = auth.address + (loginEndpoint ?? ''); | ||
| if (!loginEndpoint) { | ||
| return throwError(new Error('Login URL is not defined in the config [nae.providers.auth.endpoints.login]')); | ||
|
Check warning on line 54 in projects/netgrif-components-core/src/lib/authentication/proxyAuthentication.service.ts
|
||
| } | ||
| if (!token?.trim()) { | ||
| return throwError(new Error('API token is empty')); | ||
|
Check warning on line 57 in projects/netgrif-components-core/src/lib/authentication/proxyAuthentication.service.ts
|
||
| } | ||
|
|
||
| let headers = new HttpHeaders().set('Authorization', `Bearer ${token.trim()}`); | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect repository configuration for insecure authentication endpoints.
rg -n -C 3 '"address"\s*:\s*"http:|sessionBearer|apiToken' nae.json projectsRepository: netgrif/components Length of output: 16802 Sensitive Data Exposure Reachability: External Reject non-HTTPS authentication endpoints.
🤖 Prompt for AI Agents |
||
| if (realmId?.trim()) { | ||
| headers = headers.set('X-Realm-ID', realmId.trim()); | ||
| } | ||
| return this._http.get<UserResource>(url, {headers}); | ||
| } | ||
|
|
||
| logout(): Observable<object> { | ||
| return this._proxyAuthMethod.logout(); | ||
| } | ||
|
|
||
| Original file line number | Diff line number | Diff line change | ||
|---|---|---|---|---|
|
|
@@ -8,9 +8,7 @@ export * from './sign-up/public-api'; | |||
| /* MODULES */ | ||||
| export * from './authentication.module'; | ||||
|
|
||||
| // export * from './services/anonymous-authentication-interceptor' | ||||
|
There was a problem hiding this comment. 🧹 Nitpick | 🔵 Trivial Remove the commented export from the public API surface. Keeping commented exports in a public API file creates dead code and ambiguity. If this export is intentionally retired, delete it outright. 🧹 Suggested cleanup-// export * from './services/anonymous-authentication-interceptor'📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||
| export * from './services/authentication-interceptor' | ||||
| export * from './proxyAuthentication.service' | ||||
|
|
||||
|
|
||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Remove duplicate changelog entries.
The following entries appear twice in the 7.0.0 "Changed" section:
[NAE-1949]Allowed Types for Filefield — lines 48 and 56[NAE-2013]Autocomplete options are set to the first dropdown — lines 58 and 59[NAE-2085]Refactor User — lines 79 and 82Also applies to: 56-56, 58-59, 79-79, 82-82
🤖 Prompt for AI Agents