8000 feat(config-api): initializing core documentStore manager timer for config-api by pujavs · Pull Request #9417 · JanssenProject/jans · GitHub

More Web Proxy on the site http://driver.im/

feat(config-api): initializing core documentStore manager timer for config-api #9417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

yuriyz merged 66 commits into main from jans-config-fix

Sep 9, 2024

Contributor

pujavs commented

Prepare

Read PR guidelines
Read license information

Description

initializing core documentStore timer for deploying config-api assets

Target issue

closes #9403

Implementation Details

Test and Document the changes

Static code analysis has been run locally and issues have been fixed
Relevant unit and integration tests have been added/updated
Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

I confirm that there is no impact on the docs due to the code changes in this PR.

pujavs added 30 commits

August 5, 2024 13:15


          fix(config-api): asset mgt endpoint fixes

a3f3a66

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

9e309c0

…ns-config-fix


          feat(config-api): asset upload mgt ehancement and fido

59fd269

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): asset upload mgt ehancement and fido

5a6396a

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): asset upload mgt ehancement and fido

521f7b1

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

73618dd

…ns-config-fix


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

583c881

…ns-config-fix


          fix(config-api): asset upload

95c57e4

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

ca50ec7

…ns-config-fix


          fix(config-api): lock review comments

bbcbc92

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): lock code review comments

2bb92e3

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): lock master renamed to lock server

c900d5f

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

eb62da4

…ns-config-fix


          feat(config-api): lock master renamed to lock server

6fad621

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

d17d2e6

…ns-config-fix


          feat(config-api): lock master renamed to lock server

7fefadb

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): lock master renamed to lock server

cf85c47

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

c0444b5

…ns-config-fix


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

ccf9ace

…ns-config-fix


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

2d4a379

…ns-config-fix


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

dd6555c

…ns-config-fix


          feat(config-api): fido2 delete functionality

4696f98

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

3b51e0d

…ns-config-fix


          fix(config-api): acr validation

5af8a00

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): doc(config-api): IDP schema attribute descriptions #…

88e3a20

…9187

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): sync with main

cadc584

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): sync with main

c4eb118

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): uploading assets via API generates 2 entries #9178

4de3cc0

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): asset mgt, fido and IDP changes

dfbc4f1

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): fido2 device endpoint

c3ba202

Signed-off-by: pujavs <pujas.works@gmail.com>

pujavs added 8 commits

September 4, 2024 21:03


          fix(config-api): sync with main

f1c1c29

Signed-off-by: pujavs <pujas.works@gmail.com>


          feat(config-api): lock endpoint fixes and SAML IDP NPE

77c5d46

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

e00453b

…ns-config-fix


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

89e16ee

…ns-config-fix


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

39a8321

…ns-config-fix


          feat(config-api): asset enhancement

43323bf

Signed-off-by: pujavs <pujas.works@gmail.com>


          Merge branch 'main' of https://github.com/JanssenProject/jans into ja…

7de3f99

…ns-config-fix


          feat(config-api): implement timer for asset mgt to fetch and deploy a…

e982673

…ssets forconfig-api #9403

Signed-off-by: pujavs <pujas.works@gmail.com>

pujavs requested a review from devrimyatar

September 9, 2024 09:46

pujavs requested review from yuriyz, yurem and yuriyzz as code owners

September 9, 2024 09:46

dryrunsecurity bot commented

•

DryRun Security Summary

The provided code changes cover several updates across different components of the Jans Config API application, focusing on improving functionality and security, but requiring closer attention to ensure proper handling and securing of sensitive information and proper validation and sanitization of custom assets.

Expand for full summary

Summary:

The provided code changes cover several updates across different components of the Jans Config API application. Overall, the changes do not appear to introduce any significant security vulnerabilities, but there are a few areas that warrant closer attention from an application security perspective.

The changes to the Document class in the jans-core/document-store module involve the removal of the document field from the toString() method. While this change itself does not raise any immediate security concerns, it is important to ensure that the sensitive information contained in the Document class, such as the fileName, filePath, description, and document fields, is properly handled and secured throughout the application.

The changes to the AppInitializer class in the jans-config-api module involve the replacement of the AssetService class with the DocumentStoreManager class. This refactoring effort does not introduce any obvious security vulnerabilities, but it is important to review the implementation of the loadCustomAsset() method to ensure that the custom assets being loaded are properly validated and sanitized.

The changes to the AssetResource class in the jans-config-api module demonstrate a focus on improving the functionality and security of the asset management features. The code includes input validation, asset name conflict checks, secure file handling, authorization and access control, and robust error handling, all of which are positive security practices.

Finally, the updates to the Jans Config API Swagger documentation introduce new schemas and endpoints related to various features, such as attributes, authentication filters, app configuration, cache configuration, assets, properties, SMTP, organization, and plugins. While these changes do not directly introduce security vulnerabilities, it is important to review the implementation and configuration of these features to ensure that they are properly secured and do not introduce any new attack vectors.

Files Changed:

jans-core/document-store/src/main/java/io/jans/service/document/store/model/Document.java: The changes involve removing the document field from the toString() method of the Document class. While this change does not have any significant security implications, it is important to ensure that the sensitive information contained in the Document class is properly handled and secured.
jans-config-api/server/src/main/java/io/jans/configapi/configuration/AppInitializer.java: The changes involve replacing the AssetService class with the DocumentStoreManager class. This refactoring effort does not introduce any obvious security vulnerabilities, but the implementation of the loadCustomAsset() method should be reviewed to ensure that the custom assets being loaded are properly validated and sanitized.
jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AssetResource.java: The changes demonstrate a focus on improving the functionality and security of the asset management features, including input validation, asset name conflict checks, secure file handling, authorization and access control, and robust error handling.
jans-config-api/docs/jans-config-api-swagger.yaml: The changes introduce new schemas and endpoints related to various features, such as attributes, authentication filters, app configuration, cache configuration, assets, properties, SMTP, organization, and plugins. While these changes do not directly introduce security vulnerabilities, it is important to review the implementation and configuration of these features to ensure that they are properly secured and do not introduce any new attack vectors.

Code Analysis

We ran 9 analyzers against 4 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

mo-auto added comp-jans-config-api comp-jans-core kind-feature labels

pujavs mentioned this pull request

feat(config-api): implement timer for asset mgt to fetch and deploy assets for config-api #9403

Closed

sonarqubecloud bot commented

Quality Gate passed for 'jans-core'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud bot commented

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

yuriyz approved these changes

View reviewed changes

yuriyz enabled auto-merge (squash)

September 9, 2024 11:27


          Merge branch 'main' into jans-config-fix

d42c07e

sonarqubecloud bot commented

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

devrimyatar approved these changes

View reviewed changes

yurem approved these changes

View reviewed changes


          Merge branch 'main' into jans-config-fix

a2e0adc

yuriyz merged commit 37bc45b into main

7 of 8 checks passed

yuriyz deleted the jans-config-fix branch

September 9, 2024 16:35

sonarqubecloud bot commented

A373

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

yuriyz pushed a commit that referenced this pull request


          feat(config-api): initializing core documentStore manager timer for c…

d502708

…onfig-api (#9417)

* fix(config-api): asset mgt endpoint fixes

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): asset upload mgt ehancement and fido

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): asset upload mgt ehancement and fido

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): asset upload mgt ehancement and fido

Signed-off-by: pujavs <pujas.works@gmail.com>

* fix(config-api): asset upload

Signed-off-by: pujavs <pujas.works@gmail.com>

* fix(config-api): lock review comments

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): lock code review comments

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): lock master renamed to lock server

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): lock master renamed to lock server

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): lock master renamed to lock server

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): lock master renamed to lock server

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): fido2 delete functionality

Signed-off-by: pujavs <pujas.works@gmail.com>

* fix(config-api): acr validation

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): doc(config-api): IDP schema attribute descriptions #9187

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): sync with main

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): uploading assets via API generates 2 entries #9178

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): asset mgt, fido and IDP changes

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): fido2 device endpoint

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): fido2 endpoint

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): fido2 endpoint

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): sync with main

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): sync with main

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): sync with main

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): resolved sonar review issues

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): sonar review comment fix

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): swagger spec

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): saml config attribute description

Signed-off-by: pujavs <pujas.works@gmail.com>

* doc(config-api): added SAML attribute description

Signed-off-by: pujavs <pujas.works@gmail.com>

* doc(config-api): added SAML attribute description

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): sync with main

Signed-off-by: pujavs <pujas.works@gmail.com>

* fix(jans-lock): code review comment fix isssue#9305

Signed-off-by: pujavs <pujas.works@gmail.com>

* fix(jans-lock): code review comment fix isssue#9305

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): lock review point

Signed-off-by: pujavs <pujas.works@gmail.com>

* fix(lock): code review comment

Signed-off-by: pujavs <pujas.works@gmail.com>

* fix(lock): code review comment

Signed-off-by: pujavs <pujas.works@gmail.com>

* fix(config-api): sync with main

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): lock endpoint fixes and SAML IDP NPE

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): asset enhancement

Signed-off-by: pujavs <pujas.works@gmail.com>

* feat(config-api): implement timer for asset mgt to fetch and deploy assets forconfig-api #9403

Signed-off-by: pujavs <pujas.works@gmail.com>

---------

Signed-off-by: pujavs <pujas.works@gmail.com>
Former-commit-id: 37bc45b

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp-jans-config-api comp-jans-core kind-feature

0