Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LMSA-9652 - added event authorization event publisher and removed the… #30

Merged
merged 6 commits into from
Feb 10, 2025
Merged

LMSA-9652 - added event authorization event publisher and removed the… #30

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
38eb240
LMSA-9652 - added event authorization event publisher and removed the…
iudsobiera Feb 7, 2025
b8d0005
LMSA-9652 - removed uneeded filter
iudsobiera Feb 7, 2025
aca615b
LMSA-9652 - perhaps use this profile?
iudsobiera Feb 10, 2025
288d183
LMSA-9652 - add license
iudsobiera Feb 10, 2025
c3e34bc
LMSA-9652 - removed publisher (moved to common-configuration in embed…
iudsobiera Feb 10, 2025
9007458
LMSA-9652 - updated dep versions
iudsobiera Feb 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,8 @@
<java.version>21</java.version>
<jquery.version>3.7.1</jquery.version>
<lms-canvas-rivet.version>6.2.8.1_1</lms-canvas-rivet.version>
<lms-embedded-services.version>6.0.9</lms-embedded-services.version>
<lms-team-spring-boot-it12>6.5.0</lms-team-spring-boot-it12>
<lms-embedded-services.version>6.1.4-SNAPSHOT</lms-embedded-services.version>
<lms-team-spring-boot-it12>6.5.1-SNAPSHOT</lms-team-spring-boot-it12>
<opencsv.version>5.10</opencsv.version>
<spring-cloud-starter-parent.version>2023.0.5</spring-cloud-starter-parent.version>
<springdoc-openapi-ui.version>2.5.0</springdoc-openapi-ui.version>
Expand Down
29 changes: 29 additions & 0 deletions src/main/java/edu/iu/uits/lms/canvasnotifier/config/LmsAuthorizationEventPublisher.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
package edu.iu.uits.lms.canvasnotifier.config;

import lombok.extern.slf4j.Slf4j;
import org.springframework.context.ApplicationEventPublisher;
import org.springframework.context.annotation.Profile;
import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.authorization.AuthorizationEventPublisher;
import org.springframework.security.authorization.event.AuthorizationEvent;
import org.springframework.security.core.Authentication;
import org.springframework.stereotype.Component;

import java.util.function.Supplier;

@Profile("it12")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would we want to use this profile to turn authorization event publishing on? If so, we'd have to change the runtime profiles for our apps that use this (to help community runs by leaving this off). Otherwise, we'd remove this profile and always have authorization event publishing on

@Component
@Slf4j
public class LmsAuthorizationEventPublisher implements AuthorizationEventPublisher {
private ApplicationEventPublisher applicationEventPublisher;
Copy link
Contributor Author

@dsobiera dsobiera Feb 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we put this publisher in a common place (vs in the tool here) like the old stuff was? And by publisher I mean this whole class/file. The issue doing that is that anything using that common place will be publishing authorization events. And, perhaps, that's okay?


public LmsAuthorizationEventPublisher(ApplicationEventPublisher applicationEventPublisher) {
this.applicationEventPublisher = applicationEventPublisher;
}

@Override
public <T> void publishAuthorizationEvent(Supplier<Authentication> authentication,
T object, AuthorizationDecision decision) {
applicationEventPublisher.publishEvent(new AuthorizationEvent(authentication, object, decision));
}
}
13 changes: 3 additions & 10 deletions src/main/java/edu/iu/uits/lms/canvasnotifier/config/SecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,6 @@
*/

import edu.iu.uits.lms.canvasnotifier.repository.UserRepository;
import edu.iu.uits.lms.common.it12logging.LmsFilterSecurityInterceptorObjectPostProcessor;
import edu.iu.uits.lms.common.it12logging.RestSecurityLoggingConfig;
import edu.iu.uits.lms.common.oauth.CustomJwtAuthenticationConverter;
import edu.iu.uits.lms.lti.repository.DefaultInstructorRoleRepository;
import org.springframework.beans.factory.annotation.Autowired;
Expand Down Expand Up @@ -71,9 +69,7 @@ public SecurityFilterChain restFilterChain(HttpSecurity http) throws Exception {
)
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.oauth2ResourceServer(oauth -> oauth
.jwt(jwt -> jwt.jwtAuthenticationConverter(new CustomJwtAuthenticationConverter())))
.with(new RestSecurityLoggingConfig(), log -> {
});
.jwt(jwt -> jwt.jwtAuthenticationConverter(new CustomJwtAuthenticationConverter())));
return http.build();
}

Expand All @@ -83,9 +79,7 @@ public SecurityFilterChain appFilterChain(HttpSecurity http) throws Exception {
http.securityMatcher(WELL_KNOWN_ALL, "/error", "/app/**")
.authorizeHttpRequests(authz -> authz
.requestMatchers(WELL_KNOWN_ALL, "/error").permitAll()
.requestMatchers("/**").hasAuthority(BASE_USER_AUTHORITY)
.withObjectPostProcessor(new LmsFilterSecurityInterceptorObjectPostProcessor())
)
.requestMatchers("/**").hasAuthority(BASE_USER_AUTHORITY))
.headers(headers -> headers
.contentSecurityPolicy(csp -> csp.policyDirectives("style-src 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors 'self' https://*.instructure.com"))
.referrerPolicy(referrer -> referrer
Expand Down Expand Up @@ -116,8 +110,7 @@ public SecurityFilterChain catchallFilterChain(HttpSecurity http) throws Excepti
.grantedAuthoritiesMapper(new CustomRoleMapper(defaultInstructorRoleRepository, userRepository)));

http.securityMatcher("/**")
.authorizeHttpRequests((authz) -> authz.anyRequest().authenticated()
.withObjectPostProcessor(new LmsFilterSecurityInterceptorObjectPostProcessor()))
.authorizeHttpRequests((authz) -> authz.anyRequest().authenticated())
.headers(headers -> headers
.contentSecurityPolicy(csp ->
csp.policyDirectives("style-src 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors 'self' https://*.instructure.com"))
Expand Down
10 changes: 5 additions & 5 deletions src/main/resources/templates/main.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,14 +66,14 @@
<h1 id="cnTitle" class="rvt-ts-32 rvt-m-bottom-xs">Canvas Notifier</h1>

<form id="createNotifyForm" th:object="${canvasNotifierFormModel}" th:action="@{|/app/preview|}" method="post" enctype="multipart/form-data">
<p aria-hidden="true" class="req-instruction">All fields marked with <span th:replace="fragments :: reqAsterisk" /> are required</p>
<p aria-hidden="true" class="req-instruction">All fields marked with <span th:replace="~{fragments :: reqAsterisk}" /> are required</p>
<div class="rvt-grid">
<div class="rvt-grid__item" th:with="senderError=${canvasNotifierFormModel.fieldErrorsMap != null && canvasNotifierFormModel.fieldErrorsMap.containsKey('sender')},
subjectError=${canvasNotifierFormModel.fieldErrorsMap != null && canvasNotifierFormModel.fieldErrorsMap.containsKey('subject')},
bodyError=${canvasNotifierFormModel.fieldErrorsMap != null && canvasNotifierFormModel.fieldErrorsMap.containsKey('body')},
attachError=${canvasNotifierFormModel.fieldErrorsMap != null && canvasNotifierFormModel.fieldErrorsMap.containsKey('attachment')}">

<label class="cnLabel" for="senderUserId">Sender's Username <span th:replace="fragments :: reqAsterisk"></span></label>
<label class="cnLabel" for="senderUserId">Sender's Username <span th:replace="~{fragments :: reqAsterisk}"></span></label>
<div>
<select id="senderUserId" th:field="*{selectedSenderCanvasId}" class="rvt-select"
th:classappend="${senderError} ? rvt-validation-danger"
Expand All @@ -86,7 +86,7 @@ <h1 id="cnTitle" class="rvt-ts-32 rvt-m-bottom-xs">Canvas Notifier</h1>
<div th:replace="fragments :: field-error('state-message', 'You must choose a sender.')" />
</div>

<label for="msgSubject" class="cnLabel rvt-m-top-md rvt-label">Message Subject <span th:replace="fragments :: reqAsterisk"></span></label>
<label for="msgSubject" class="cnLabel rvt-m-top-md rvt-label">Message Subject <span th:replace="~{fragments :: reqAsterisk}"></span></label>
<input id="msgSubject" th:field="*{subject}" type="text" class="rvt-text-input"
th:classappend="${subjectError} ? rvt-validation-danger"
th:attr="aria-required='true', aria-describedby=${subjectError} ? 'messageSubject', aria-invalid=${subjectError} ? 'true'" />
Expand All @@ -95,7 +95,7 @@ <h1 id="cnTitle" class="rvt-ts-32 rvt-m-bottom-xs">Canvas Notifier</h1>
<div th:replace="fragments :: field-error('messageSubject', 'You must enter a subject.')" />
</div>

<label for="msgBody" class="cnLabel rvt-m-top-md rvt-label">Message Body <span th:replace="fragments :: reqAsterisk"></span></label>
<label for="msgBody" class="cnLabel rvt-m-top-md rvt-label">Message Body <span th:replace="~{fragments :: reqAsterisk}"></span></label>
<textarea type="text" id="msgBody" th:field="*{body}" class="rvt-textarea"
th:classappend="${bodyError} ? rvt-validation-danger"
th:attr="aria-required='true', aria-describedby=${bodyError} ? 'description-message', aria-invalid=${bodyError} ? 'true'"></textarea>
Expand All @@ -104,7 +104,7 @@ <h1 id="cnTitle" class="rvt-ts-32 rvt-m-bottom-xs">Canvas Notifier</h1>
<div th:replace="fragments :: field-error('description-message', 'You must enter a message.')" />
</div>

<p class="recipients">Recipients <span th:replace="fragments :: reqAsterisk"></span></p>
<p class="recipients">Recipients <span th:replace="~{fragments :: reqAsterisk}"></span></p>
<div class="rvt-file" data-rvt-file-input="cnAttachment">
<input type="file" data-rvt-file-input-button="cnAttachment" id="cnAttachment" name="cnAttachment" aria-required="true"
aria-describedby="cnAttachmentDescription" th:attrappend="aria-describedby=${attachError} ? ' ' + csvMessage"
Expand Down
Loading