Merge branch 'main' into dependabot/nuget/Microsoft.AspNetCore.Authentication.OpenIdConnect-10.0.11

Author: SimonR-Education

.github/workflows/build.yml

@@ -1,4 +1,4 @@
-name: Build
+name: Web Build and Deploy
 
 on:
   workflow_dispatch:
@@ -15,6 +15,8 @@ env:
   WEB_SOLUTION_FILE: SchoolAccount.Web.slnx
   MAIN_BRANCH: refs/heads/main
   IMAGE_NAME: ghcr.io/dfe-digital/schoolaccount-web
+  CONTAINERAPP_RESOURCE_GROUP: s268d01rg-uks-sa-poc
+  CONTAINERAPP_NAME: schoolaccount-web-app
 
 jobs:
   build:
@@ -108,3 +110,17 @@ jobs:
 
       - name: Publish
         run: dotnet publish ${{ env.WEB_SOLUTION_FILE }} --configuration Release --no-restore --no-build
+
+      - name: Azure Login
+        if: github.event_name == 'push' && github.ref == env.MAIN_BRANCH
+        uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Update ACA Image
+        if: github.event_name == 'push' && github.ref == env.MAIN_BRANCH
+        run: |
+          az containerapp update \
+            --name ${{ env.CONTAINERAPP_NAME }} \
+            --resource-group ${{ env.CONTAINERAPP_RESOURCE_GROUP }} \
+            --image ${{ steps.image.outputs.image }}

Directory.Packages.props

@@ -32,7 +32,7 @@
     <PackageVersion Include="Shouldly" Version="4.3.0" />
     <PackageVersion Include="NetArchTest.Rules" Version="1.3.2" />
     <PackageVersion Include="xunit.v3.mtp-v2" Version="3.2.2" />
-    <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.9.0" />
+    <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.10.0" />
     <!-- Experimental (alpha): GitHub Actions job summaries and PR annotations for test runs -->
     <PackageVersion Include="Microsoft.Testing.Extensions.GitHubActionsReport" Version="1.0.0-alpha.26377.5" />
     <PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="2.3.3" />

README.md

@@ -164,7 +164,7 @@ The image is created on every push to the `main` branch and tagged with the curr
 
 To verify the image locally, you can run:
 ```
-docker run --platform linux/amd64 --name web -e OpenIDConnectSettings__ClientId=SA_TEST_CLIENT -e OpenIDConnectSettings__Authority=https://localhost:7041 -p 5100:8080 -d ghcr.io/dfe-digital/schoolaccount-web:latest
+docker run --platform linux/amd64 --name web -e OpenIDConnectSettings__ClientId=SA_TEST_CLIENT -e OpenIDConnectSettings__Authority=https://localhost:7041 -e ASPNETCORE_ENVIRONMENT=development -p 5100:8080 -d --pull=always ghcr.io/dfe-digital/schoolaccount-web:latest
 ```
 
 You can then test the Web project by visiting http://localhost:5100.

src/SchoolAccount.SharedKernel/IUserContext.cs

@@ -7,4 +7,5 @@ public interface IUserContext
     string? AuthenticationType { get; }
     string? EmailAddress { get; }
     string? Name { get; }
+    string? OrganisationName { get; }
 }

src/SchoolAccount.Web.Mvc/Authentication/ClaimConstants.cs

@@ -0,0 +1,10 @@
+namespace SchoolAccount.Web.Mvc.Authentication;
+
+public static class ClaimConstants
+{
+    public const string Id = "sid";
+    public const string GivenName = "given_name";
+    public const string FamilyName = "family_name";
+    public const string Email = "email";
+    public const string Organisation = "organisation";
+}

src/SchoolAccount.Web.Mvc/Authentication/Extensions/ClaimsPrincipalExtensions.cs

@@ -0,0 +1,19 @@
+using System.Security.Claims;
+using System.Text.Json;
+
+namespace SchoolAccount.Web.Mvc.Authentication.Extensions;
+
+public static class ClaimsPrincipalExtensions
+{
+    public static OrganisationClaim? GetOrganisation(
+        this ClaimsPrincipal principal,
+        JsonSerializerOptions? options = null
+    )
+    {
+        options ??= new JsonSerializerOptions { PropertyNameCaseInsensitive = true };
+        var organisationClaim = principal.FindFirst(ClaimConstants.Organisation)?.Value;
+        return !string.IsNullOrEmpty(organisationClaim)
+            ? JsonSerializer.Deserialize<OrganisationClaim>(organisationClaim, options)
+            : null;
+    }
+}

src/SchoolAccount.Web.Mvc/Authentication/Extensions/ServiceCollectionExtensions.cs

@@ -1,10 +1,9 @@
-using System.Diagnostics.CodeAnalysis;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
-using Microsoft.AspNetCore.Authorization;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using SchoolAccount.SharedKernel;
 using SchoolAccount.Web.Mvc.Authentication.Models;
+using static SchoolAccount.Web.Mvc.Authentication.ClaimConstants;
 
 namespace SchoolAccount.Web.Mvc.Authentication.Extensions;
 
@@ -40,8 +39,8 @@ IConfigurationManager configuration
                 options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                 options.ResponseType = OpenIdConnectResponseType.IdToken;
 
-                options.Scope.Add("organisation");
-                options.Scope.Add("email");
+                options.Scope.Add(Organisation);
+                options.Scope.Add(Email);
                 options.SaveTokens = true;
                 options.GetClaimsFromUserInfoEndpoint = true;
 
@@ -54,6 +53,17 @@ IConfigurationManager configuration
                         context.HttpContext.Session.Clear();
                         await Task.CompletedTask;
                     },
+                    // within ACA a container runs on http, though available as https publicly
+                    // this causes the OIDC redirect_url to have the http protocol, rather than https
+                    // DSI does not allow http redirect URLS. The following corrects the URL
+                    OnRedirectToIdentityProvider = async n =>
+                    {
+                        n.ProtocolMessage.RedirectUri = n.ProtocolMessage.RedirectUri.Replace(
+                            "http://",
+                            "https://"
+                        );
+                        await Task.CompletedTask;
+                    },
                 };
             });
 

src/SchoolAccount.Web.Mvc/Authentication/OrganisationClaim.cs

@@ -0,0 +1,6 @@
+namespace SchoolAccount.Web.Mvc.Authentication;
+
+public record OrganisationClaim
+{
+    public string Name { get; init; } = null!;
+}

src/SchoolAccount.Web.Mvc/Authentication/UserContext.cs

@@ -1,5 +1,6 @@
 using System.Security.Principal;
 using SchoolAccount.SharedKernel;
+using SchoolAccount.Web.Mvc.Authentication.Extensions;
 
 namespace SchoolAccount.Web.Mvc.Authentication;
 
@@ -9,19 +10,21 @@ public UserContext(IHttpContextAccessor contextAccessor)
     {
         var user = contextAccessor.HttpContext?.User;
         IsAuthenticated = user?.Identity?.IsAuthenticated ?? false;
-        Id = user?.FindFirst("sid")?.Value;
+        Id = user?.FindFirst(ClaimConstants.Id)?.Value;
         AuthenticationType = user?.Identity?.AuthenticationType;
-        GivenName = user?.FindFirst("given_name")?.Value;
-        Surname = user?.FindFirst("family_name")?.Value;
-        EmailAddress = user?.FindFirst("email")?.Value;
+        GivenName = user?.FindFirst(ClaimConstants.GivenName)?.Value;
+        Surname = user?.FindFirst(ClaimConstants.FamilyName)?.Value;
+        EmailAddress = user?.FindFirst(ClaimConstants.Email)?.Value;
+        OrganisationName = user?.GetOrganisation()?.Name;
     }
 
     public string? GivenName { get; }
     public string? Surname { get; }
-
     public bool IsAuthenticated { get; }
     public string? Id { get; }
     public string? AuthenticationType { get; }
     public string? Name => $"{GivenName} {Surname}".Trim();
     public string? EmailAddress { get; }
+
+    public string? OrganisationName { get; }
 }

src/SchoolAccount.Web.Mvc/Features/Home/HomeController.cs

@@ -1,4 +1,3 @@
-using System.Diagnostics.CodeAnalysis;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
@@ -7,14 +6,10 @@ namespace SchoolAccount.Web.Mvc.Features.Home;
 [Route("/")]
 public class HomeController : Controller
 {
-    [HttpGet(""), AllowAnonymous]
+    [HttpGet("")]
+    [AllowAnonymous]
     public async Task<IActionResult> Home()
     {
-        if (User.Identity?.IsAuthenticated ?? false)
-        {
-            return RedirectToAction("Dashboard", "Dashboard");
-        }
-
         return View(new HomeViewModel());
     }
 }