Skip to content

Development: Update config for apple-site-association-file #10760

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 29, 2025

Conversation

anian03
Copy link
Member

@anian03 anian03 commented Apr 28, 2025

Checklist

General

Server

Motivation and Context

For supporting passkeys on the iOS app (and deep links from the web at some point), there needs to be an apple-app-site-association file on the server at /.well-known/apple-app-file-association which needs to be accessible without authentication.

Description

The app identifier has been updated to reflect the iOS app's actual identifier, and the security configuration has been updated to exclude this file from authentication.

Steps for Testing

Prerequisites:
A user which is NOT logged in

  1. Navigate to /.well-known/apple-app-site-association on the server
  2. Verify that the returned data includes the iOS app's identifier under the "webcredentials" section

You can also use a validator to confirm the file structure

Testserver States

You can manage test servers using Helios. Check environment statuses in the environment list. To deploy to a test server, go to the CI/CD page, find your PR or branch, and trigger the deployment.

Review Progress

Code Review

  • Code Review 1
  • Code Review 2

Manual Tests

  • Test 1
  • Test 2

Summary by CodeRabbit

  • New Features
    • Allowed unauthenticated access to the /.well-known/apple-app-site-association endpoint, making it publicly accessible.

@anian03 anian03 added the small label Apr 28, 2025
@anian03 anian03 requested a review from krusche as a code owner April 28, 2025 08:49
@github-project-automation github-project-automation bot moved this to Work In Progress in Artemis Development Apr 28, 2025
@github-actions github-actions bot added server Pull requests that update Java code. (Added Automatically!) config-change Pull requests that change the config in a way that they require a deployment via Ansible. core Pull requests that affect the corresponding module labels Apr 28, 2025
Copy link
Contributor

coderabbitai bot commented Apr 28, 2025

Walkthrough

The security configuration was modified to allow unauthenticated access to the /.well-known/apple-app-site-association endpoint. This change adds the endpoint to the list of publicly accessible well-known endpoints, joining existing entries such as /.well-known/jwks.json and /.well-known/assetlinks.json. No other aspects of the security configuration or application control flow were altered.

Changes

File Change Summary
src/main/java/de/tum/cit/aet/artemis/core/config/SecurityConfiguration.java Updated security filter chain to permit unauthenticated access to /.well-known/apple-app-site-association.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant SecurityFilterChain
    participant Application

    Client->>SecurityFilterChain: Request /.well-known/apple-app-site-association
    SecurityFilterChain-->>Application: Allow request (no authentication required)
    Application-->>Client: Response
Loading

📜 Recent review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b1b5cd7 and 2533199.

⛔ Files ignored due to path filters (1)
  • src/main/resources/config/application.yml is excluded by !**/*.yml
📒 Files selected for processing (1)
  • src/main/java/de/tum/cit/aet/artemis/core/config/SecurityConfiguration.java (1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
`src/main/java/**/*.java`: naming:CamelCase; principles:{single_responsibility,small_methods,no_duplication}; db:{perf_queries,datetime_not_timestamp}; rest:{stateless,singleton,de...

src/main/java/**/*.java: naming:CamelCase; principles:{single_responsibility,small_methods,no_duplication}; db:{perf_queries,datetime_not_timestamp}; rest:{stateless,singleton,delegate_logic,http_only,minimal_dtos}; dtos:{java_records,no_entities,min_data,single_resp}; di:constructor_injection; kiss:simple_code; file_handling:os_indep_paths; practices:{least_access,avoid_transactions,code_reuse,static_member_ref,prefer_primitives}; sql:{param_annotation,uppercase,avoid_subqueries};java:avoid_star_imports

  • src/main/java/de/tum/cit/aet/artemis/core/config/SecurityConfiguration.java
⏰ Context from checks skipped due to timeout of 90000ms (1)
  • GitHub Check: Codacy Static Code Analysis
🔇 Additional comments (2)
src/main/java/de/tum/cit/aet/artemis/core/config/SecurityConfiguration.java (2)

289-291: Approve unauthenticated access for the AASA endpoint
The new request matcher

.requestMatchers("/.well-known/apple-app-site-association").permitAll()

is correctly placed alongside the other well-known public endpoints and ensures the Apple App Site Association file is served without authentication.


290-290: Verify endpoint path naming against PR objectives and Apple spec
The PR summary mentions apple-app-file-association, but the code uses apple-app-site-association. Please confirm that the deployed file name and this path literal match each other and align with Apple’s official .well-known/apple-app-site-association convention.

✨ Finishing Touches
  • 📝 Generate Docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai or @coderabbitai title anywhere in the PR title to generate the title automatically.

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@anian03 anian03 changed the title Chore: Update config for apple-site-association-file General: Update config for apple-site-association-file Apr 28, 2025
Copy link

End-to-End (E2E) Test Results Summary

TestsPassed ☑️Skipped ⚠️Failed ❌️Time ⏱
End-to-End (E2E) Test Report201 ran196 passed3 skipped2 failed52m 1s 426ms
TestResultTime ⏱
End-to-End (E2E) Test Report
e2e/course/CourseMessages.spec.ts
ts.Course messages › Channel messages › Write/edit/delete message in channel › Student should be able to edit message in channel❌ failure2m 3s 466ms
e2e/exercise/programming/ProgrammingExerciseStaticCodeAnalysis.spec.ts
ts.Static code analysis tests › Configures SCA grading and makes a successful submission with SCA errors❌ failure1m 46s 293ms

@helios-aet helios-aet bot temporarily deployed to artemis-test5.artemis.cit.tum.de April 29, 2025 10:42 Inactive
Copy link
Contributor

@PaRangger PaRangger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested on TS4/TS5 using the provided validator. TS4 without the branch failed, TS5 succeded. Code changes LGTM. ✅

Copy link

@HawKhiem HawKhiem left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested on TS5. Works as described

Copy link
Contributor

@florian-glombik florian-glombik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code

@florian-glombik florian-glombik moved this from Work In Progress to Ready For Review in Artemis Development Apr 29, 2025
@florian-glombik florian-glombik moved this from Ready For Review to Developer Approved in Artemis Development Apr 29, 2025
Copy link
Contributor

@eylulnc eylulnc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested on TS5. Works as described

@krusche krusche changed the title General: Update config for apple-site-association-file Development: Update config for apple-site-association-file Apr 29, 2025
@krusche krusche added this to the 8.0.4 milestone Apr 29, 2025
@krusche krusche merged commit e722184 into develop Apr 29, 2025
45 of 51 checks passed
@krusche krusche deleted the chore/update-apple-site-association-file branch April 29, 2025 18:40
@github-project-automation github-project-automation bot moved this from Developer Approved to Merged in Artemis Development Apr 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
config-change Pull requests that change the config in a way that they require a deployment via Ansible. core Pull requests that affect the corresponding module ready to merge server Pull requests that update Java code. (Added Automatically!) small
Projects
Status: Merged
Development

Successfully merging this pull request may close these issues.

7 participants