| | | 1 | | using System.Security.Cryptography; |
| | | 2 | | using System.Text; |
| | | 3 | | using System.Text.Json; |
| | | 4 | | using Elsa.ExternalAuthentication.Contracts; |
| | | 5 | | using Elsa.ExternalAuthentication.Models; |
| | | 6 | | |
| | | 7 | | namespace Elsa.ExternalAuthentication.Services; |
| | | 8 | | |
| | | 9 | | /// <summary> |
| | | 10 | | /// Produces deterministic, non-secret fingerprints for connection material and source snapshots. |
| | | 11 | | /// </summary> |
| | | 12 | | public sealed class ConnectionRevisionCalculator |
| | | 13 | | { |
| | | 14 | | public string CalculateMaterialRevision(IdentityProviderConnection connection) |
| | | 15 | | { |
| | 110 | 16 | | return CalculateHash(writer => WriteMaterial(writer, connection), "m-"); |
| | | 17 | | } |
| | | 18 | | |
| | | 19 | | public string CalculateSourceVersion(ConnectionScope scope, IEnumerable<IdentityProviderConnection> connections) |
| | | 20 | | { |
| | 3 | 21 | | return CalculateHash(writer => |
| | 3 | 22 | | { |
| | 3 | 23 | | writer.WriteStartObject(); |
| | 3 | 24 | | WriteScope(writer, scope); |
| | 3 | 25 | | writer.WritePropertyName("connections"); |
| | 3 | 26 | | writer.WriteStartArray(); |
| | 18 | 27 | | foreach (var connection in connections.OrderBy(x => NormalizeKey(x.Key), StringComparer.Ordinal).ThenBy(x => |
| | 3 | 28 | | { |
| | 3 | 29 | | writer.WriteStartObject(); |
| | 3 | 30 | | writer.WriteString("id", connection.Id); |
| | 3 | 31 | | writer.WriteString("key", NormalizeKey(connection.Key)); |
| | 3 | 32 | | writer.WriteString("displayName", connection.DisplayName); |
| | 3 | 33 | | writer.WriteString("iconId", connection.IconId); |
| | 3 | 34 | | writer.WriteNumber("displayOrder", connection.DisplayOrder); |
| | 3 | 35 | | writer.WriteBoolean("isPreferred", connection.IsPreferred); |
| | 3 | 36 | | writer.WriteString("materialRevision", CalculateMaterialRevision(connection)); |
| | 3 | 37 | | writer.WriteEndObject(); |
| | 3 | 38 | | } |
| | 3 | 39 | | |
| | 3 | 40 | | writer.WriteEndArray(); |
| | 3 | 41 | | writer.WriteEndObject(); |
| | 6 | 42 | | }, "s-"); |
| | | 43 | | } |
| | | 44 | | |
| | | 45 | | public string CalculateRegistryVersion(IEnumerable<(string SourceName, ConnectionSourceOwnership Ownership, Connecti |
| | | 46 | | { |
| | 18 | 47 | | return CalculateHash(writer => |
| | 18 | 48 | | { |
| | 18 | 49 | | writer.WriteStartArray(); |
| | 174 | 50 | | foreach (var (sourceName, ownership, snapshot) in snapshots.OrderBy(x => x.SourceName, StringComparer.Ordina |
| | 18 | 51 | | { |
| | 23 | 52 | | writer.WriteStartObject(); |
| | 23 | 53 | | writer.WriteString("source", sourceName); |
| | 23 | 54 | | writer.WriteString("ownership", ownership.ToString()); |
| | 23 | 55 | | WriteScope(writer, snapshot.Scope); |
| | 23 | 56 | | writer.WriteString("version", snapshot.Version); |
| | 23 | 57 | | writer.WriteEndObject(); |
| | 18 | 58 | | } |
| | 18 | 59 | | |
| | 18 | 60 | | writer.WriteEndArray(); |
| | 36 | 61 | | }, "r-"); |
| | | 62 | | } |
| | | 63 | | |
| | | 64 | | public static string CalculateConfigurationConnectionId(ConnectionScope scope, string key) |
| | | 65 | | { |
| | 6 | 66 | | var payload = $"{scope.Kind}\n{scope.TenantId}\n{NormalizeKey(key)}"; |
| | 6 | 67 | | var hash = SHA256.HashData(Encoding.UTF8.GetBytes(payload)); |
| | 6 | 68 | | return $"configuration-{Convert.ToHexString(hash).ToLowerInvariant()}"; |
| | | 69 | | } |
| | | 70 | | |
| | 162193 | 71 | | public static string NormalizeKey(string? key) => key?.Trim().ToLowerInvariant() ?? string.Empty; |
| | | 72 | | |
| | | 73 | | private static string CalculateHash(Action<Utf8JsonWriter> write, string prefix) |
| | | 74 | | { |
| | 76 | 75 | | using var stream = new MemoryStream(); |
| | 76 | 76 | | using (var writer = new Utf8JsonWriter(stream)) |
| | 76 | 77 | | write(writer); |
| | | 78 | | |
| | 76 | 79 | | var hash = SHA256.HashData(stream.ToArray()); |
| | 76 | 80 | | return prefix + Convert.ToHexString(hash).ToLowerInvariant(); |
| | 76 | 81 | | } |
| | | 82 | | |
| | | 83 | | private static void WriteMaterial(Utf8JsonWriter writer, IdentityProviderConnection connection) |
| | | 84 | | { |
| | 55 | 85 | | writer.WriteStartObject(); |
| | 55 | 86 | | writer.WriteString("tenantId", connection.TenantId); |
| | 55 | 87 | | writer.WriteString("key", NormalizeKey(connection.Key)); |
| | 55 | 88 | | writer.WriteString("adapterType", connection.AdapterType); |
| | 55 | 89 | | writer.WriteNumber("adapterSettingsVersion", connection.AdapterSettingsVersion); |
| | 55 | 90 | | writer.WritePropertyName("adapterSettings"); |
| | 55 | 91 | | WriteJson(writer, connection.AdapterSettings); |
| | 55 | 92 | | writer.WritePropertyName("secretBindings"); |
| | 55 | 93 | | writer.WriteStartArray(); |
| | 140 | 94 | | foreach (var binding in (connection.SecretBindings ?? new Dictionary<string, SecretBinding>()).OrderBy(x => x.Ke |
| | | 95 | | { |
| | 10 | 96 | | writer.WriteStartObject(); |
| | 10 | 97 | | writer.WriteString("name", binding.Key); |
| | 10 | 98 | | writer.WriteString("resolverType", binding.Value.ResolverType); |
| | 10 | 99 | | writer.WriteString("reference", binding.Value.Reference); |
| | 10 | 100 | | writer.WriteString("expectedType", binding.Value.ExpectedType); |
| | 10 | 101 | | writer.WriteString("expectedScope", binding.Value.ExpectedScope); |
| | 10 | 102 | | writer.WriteEndObject(); |
| | | 103 | | } |
| | | 104 | | |
| | 55 | 105 | | writer.WriteEndArray(); |
| | 55 | 106 | | writer.WriteBoolean("isEnabled", connection.IsEnabled); |
| | 55 | 107 | | writer.WriteBoolean("overridesConfigurationConnection", connection.OverridesConfigurationConnection); |
| | 55 | 108 | | writer.WriteBoolean("isArchived", connection.ArchivedAt.HasValue); |
| | 55 | 109 | | writer.WriteString("upstreamLogoutMode", connection.UpstreamLogoutMode.ToString()); |
| | 55 | 110 | | writer.WritePropertyName("unlinkedPolicy"); |
| | 55 | 111 | | WritePolicy(writer, connection.UnlinkedPolicy); |
| | 55 | 112 | | writer.WritePropertyName("permissionGrantSources"); |
| | 55 | 113 | | writer.WriteStartArray(); |
| | 110 | 114 | | foreach (var grantSource in (connection.PermissionGrantSources ?? []).OrderBy(x => x.Order).ThenBy(x => x.Type, |
| | | 115 | | { |
| | 0 | 116 | | writer.WriteStartObject(); |
| | 0 | 117 | | writer.WriteString("type", grantSource.Type); |
| | 0 | 118 | | writer.WriteNumber("settingsVersion", grantSource.SettingsVersion); |
| | 0 | 119 | | writer.WriteNumber("order", grantSource.Order); |
| | 0 | 120 | | writer.WritePropertyName("settings"); |
| | 0 | 121 | | WriteJson(writer, grantSource.Settings); |
| | 0 | 122 | | writer.WriteEndObject(); |
| | | 123 | | } |
| | | 124 | | |
| | 55 | 125 | | writer.WriteEndArray(); |
| | 55 | 126 | | writer.WritePropertyName("claimProjection"); |
| | 55 | 127 | | WriteClaimProjection(writer, connection.ClaimProjection); |
| | 55 | 128 | | writer.WriteEndObject(); |
| | 55 | 129 | | } |
| | | 130 | | |
| | | 131 | | private static void WriteScope(Utf8JsonWriter writer, ConnectionScope scope) |
| | | 132 | | { |
| | 26 | 133 | | writer.WriteString("scopeKind", scope.Kind.ToString()); |
| | 26 | 134 | | writer.WriteString("scopeTenantId", scope.TenantId); |
| | 26 | 135 | | } |
| | | 136 | | |
| | | 137 | | private static void WritePolicy(Utf8JsonWriter writer, PolicySelection? policy) |
| | | 138 | | { |
| | 55 | 139 | | if (policy is null) |
| | | 140 | | { |
| | 50 | 141 | | writer.WriteNullValue(); |
| | 50 | 142 | | return; |
| | | 143 | | } |
| | | 144 | | |
| | 5 | 145 | | writer.WriteStartObject(); |
| | 5 | 146 | | writer.WriteString("type", policy.Type); |
| | 5 | 147 | | writer.WriteNumber("settingsVersion", policy.SettingsVersion); |
| | 5 | 148 | | writer.WritePropertyName("settings"); |
| | 5 | 149 | | WriteJson(writer, policy.Settings); |
| | 5 | 150 | | writer.WriteEndObject(); |
| | 5 | 151 | | } |
| | | 152 | | |
| | | 153 | | private static void WriteClaimProjection(Utf8JsonWriter writer, ClaimProjection? projection) |
| | | 154 | | { |
| | 55 | 155 | | projection ??= ClaimProjection.Empty; |
| | 55 | 156 | | writer.WriteStartObject(); |
| | 55 | 157 | | WriteStringSet(writer, "allowedClaimTypes", projection.AllowedClaimTypes); |
| | 55 | 158 | | WriteStringSet(writer, "redactedClaimTypes", projection.RedactedClaimTypes); |
| | 55 | 159 | | writer.WriteNumber("maximumClaimCount", projection.MaximumClaimCount); |
| | 55 | 160 | | writer.WriteNumber("maximumValueLength", projection.MaximumValueLength); |
| | 55 | 161 | | writer.WriteNumber("maximumTotalBytes", projection.MaximumTotalBytes); |
| | 55 | 162 | | writer.WriteEndObject(); |
| | 55 | 163 | | } |
| | | 164 | | |
| | | 165 | | private static void WriteStringSet(Utf8JsonWriter writer, string propertyName, IReadOnlySet<string>? values) |
| | | 166 | | { |
| | 110 | 167 | | writer.WritePropertyName(propertyName); |
| | 110 | 168 | | writer.WriteStartArray(); |
| | 256 | 169 | | foreach (var value in values is null ? Enumerable.Empty<string>() : values.OrderBy(x => x, StringComparer.Ordina |
| | 12 | 170 | | writer.WriteStringValue(value); |
| | 110 | 171 | | writer.WriteEndArray(); |
| | 110 | 172 | | } |
| | | 173 | | |
| | | 174 | | private static void WriteJson(Utf8JsonWriter writer, JsonElement value) |
| | | 175 | | { |
| | 146 | 176 | | switch (value.ValueKind) |
| | | 177 | | { |
| | | 178 | | case JsonValueKind.Undefined: |
| | 7 | 179 | | writer.WriteNullValue(); |
| | 7 | 180 | | break; |
| | | 181 | | case JsonValueKind.Object: |
| | 63 | 182 | | writer.WriteStartObject(); |
| | 372 | 183 | | foreach (var property in value.EnumerateObject().OrderBy(x => x.Name, StringComparer.Ordinal)) |
| | | 184 | | { |
| | 82 | 185 | | writer.WritePropertyName(property.Name); |
| | 82 | 186 | | WriteJson(writer, property.Value); |
| | | 187 | | } |
| | | 188 | | |
| | 63 | 189 | | writer.WriteEndObject(); |
| | 63 | 190 | | break; |
| | | 191 | | case JsonValueKind.Array: |
| | 5 | 192 | | writer.WriteStartArray(); |
| | 18 | 193 | | foreach (var item in value.EnumerateArray()) |
| | 4 | 194 | | WriteJson(writer, item); |
| | 5 | 195 | | writer.WriteEndArray(); |
| | 5 | 196 | | break; |
| | | 197 | | default: |
| | 71 | 198 | | value.WriteTo(writer); |
| | | 199 | | break; |
| | | 200 | | } |
| | 71 | 201 | | } |
| | | 202 | | } |