@mriekki/project-forge 4.26.1 → 4.27.1

package/assets/generated/authentication/samples/ProjectForgeAuth.Api/Program.cs

@@ -0,0 +1,40 @@
+using ProjectForge.Auth.Runtime;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// The first administrator must be configured explicitly using the Google
+// issuer/subject recorded through trusted administration. Nothing automatically
+// promotes the first visitor or a member of the shared Household Registry.
+if (args is ["admin-init"])
+{
+    var path = builder.Configuration["ProjectForge:Authentication:DbPath"]
+        ?? throw new InvalidOperationException("App-owned authentication DB path required.");
+    var subject = Environment.GetEnvironmentVariable("PF_INITIAL_APP_ADMIN_SUBJECT");
+    var email = Environment.GetEnvironmentVariable("PF_INITIAL_APP_ADMIN_EMAIL");
+    if (string.IsNullOrWhiteSpace(subject) || string.IsNullOrWhiteSpace(email))
+        throw new InvalidOperationException("Preapproved administrator Google subject and email required.");
+    var store = new ProjectAuthStore(path);
+    store.Initialize();
+    store.BootstrapAdministrator(
+        "https://accounts.google.com", subject, email, DateTimeOffset.UtcNow);
+    Console.WriteLine("Explicit per-Project administrator initialized; no public enrollment opened.");
+    return;
+}
+if (args.Length != 0)
+    throw new ArgumentException("Unknown command; supported host action: admin-init.");
+
+builder.Services.AddProjectForgeProjectAuth(builder.Configuration);
+var app = builder.Build();
+
+// Before any static files, OIDC middleware or endpoints: verify the physical
+// Caddy peer, exact host, HTTPS protocol and canonical forwarding evidence.
+app.UseProjectForgeAuthPublicOrigin(app.Configuration);
+app.UseRateLimiter();
+app.UseAuthentication();
+app.UseAuthorization();
+app.UseDefaultFiles();
+app.UseStaticFiles();
+app.MapProjectForgeAuth();
+app.Run();
+
+public partial class Program { }

package/assets/generated/authentication/samples/ProjectForgeAuth.Api/ProjectForgeAuth.Api.csproj

@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.14" />
+    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.14" />
+    <ProjectReference Include="../../src/ProjectForge.Auth.Runtime/ProjectForge.Auth.Runtime.csproj" />
+  </ItemGroup>
+</Project>

package/assets/generated/authentication/samples/ProjectForgeAuth.Api/wwwroot/auth.js

@@ -0,0 +1,65 @@
+// Example Project login UI. API is the identity/authorization authority.
+const el = id => document.getElementById(id);
+let csrf = null;
+async function get(path) {
+    const response = await fetch(path, {credentials:"same-origin",cache:"no-store"});
+    if (response.status === 401) return null;
+    if (!response.ok) throw new Error("Authentication service unavailable");
+    return response.json();
+}
+async function initialize() {
+    const [person, proof] = await Promise.all([get("/api/auth/me"), get("/api/auth/csrf")]);
+    csrf = proof?.requestToken ?? null;
+    el("anti").value = csrf ?? "";
+    if (!person) {
+        el("status").textContent = "Sign in or accept an administrator-issued Project invitation.";
+        el("login").hidden = false;
+        el("join").hidden = false;
+        return;
+    }
+    el("status").textContent = "Signed in to this Project.";
+    el("approved").hidden = false;
+    el("admin").hidden = person.isAdministrator !== true;
+}
+async function post(path, body) {
+    if (!csrf) throw new Error("CSRF protection unavailable");
+    return fetch(path, {
+        method:"POST",credentials:"same-origin",cache:"no-store",
+        headers:{"Content-Type":"application/json","X-PF-CSRF":csrf},
+        body:JSON.stringify(body)
+    });
+}
+el("logout").addEventListener("click", async () => {
+    try {
+        const response = await post("/api/auth/logout", {});
+        if (response.ok) location.reload();
+        else el("status").textContent = "Sign-out was not completed.";
+    } catch {el("status").textContent = "Unable to sign out."; }
+});
+el("create-invite").addEventListener("submit", async event => {
+    event.preventDefault();
+    const field = event.currentTarget.elements.namedItem("recipientEmail");
+    try {
+        const response = await post("/api/auth/invitations",
+            {recipientEmail:field.value});
+        if (!response.ok) {
+            el("invite-result").textContent = "Invitation not created.";
+            return;
+        }
+        if (response.status === 204) {
+            el("invite-result").textContent =
+                "Invitation submitted to the Project's configured email provider.";
+            field.value = "";
+            return;
+        }
+        const ticket = await response.json();
+        el("invite-result").textContent =
+            "Share this one-time token privately (never in a URL): " + ticket.token;
+        field.value = "";
+    } catch {el("invite-result").textContent = "Invitation not created."; }
+});
+initialize().catch(() => {
+    el("status").textContent = "Unable to verify Project authentication status.";
+    el("login").hidden = true;
+    el("join").hidden = true;
+});

package/assets/generated/authentication/samples/ProjectForgeAuth.Api/wwwroot/index.html

@@ -0,0 +1,44 @@
+<!doctype html>
+<html lang="en"><head>
+<meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/>
+<meta name="referrer" content="no-referrer"/>
+<title>Project Forge | Project Authentication</title>
+<style>
+:root{font-family:system-ui,-apple-system,"Segoe UI",sans-serif;color-scheme:light dark}
+body{max-width:690px;margin:40px auto;padding:0 20px;line-height:1.5}
+main{padding:26px;border:1px solid #9aabb878;border-radius:16px}
+h1{font-size:1.75rem;margin:.1em 0}
+button,a.action{font:inherit;padding:10px 18px;background:#17688e;color:white;border:0;border-radius:8px;cursor:pointer;text-decoration:none}
+form{display:flex;flex-wrap:wrap;gap:12px;align-items:end;margin-top:18px}
+label{display:flex;flex-direction:column;flex:1;gap:5px}
+input{font:inherit;padding:8px;border:1px solid #b1bcc7;border-radius:8px}
+section{margin-top:24px}
+small{color:#667d8c}
+</style></head>
+<body><main>
+<small>PROJECT FORGE</small>
+<h1>Project authentication</h1>
+<p>Sign in using this Project's own Google identity and invitation approval. Household Registry membership does not automatically grant access.</p>
+<p id="status" role="status" aria-live="polite">Checking account status…</p>
+<div id="login" hidden><a class="action" href="/api/auth/google">Sign in with Google</a></div>
+<section id="join" hidden>
+<h2>Accept your Project invitation</h2>
+<form method="post" action="/api/auth/google/invite" id="invite-form">
+<label>One-time invitation token
+<input name="invitationToken" type="password" autocomplete="off" maxlength="64" required/></label>
+<input id="anti" name="__RequestVerificationToken" type="hidden"/>
+<button type="submit">Sign in and accept</button>
+</form></section>
+<section id="approved" hidden>
+<p>You're approved for this Project. Your account identity belongs to this Project, not the Household Registry.</p>
+<button id="logout" type="button">Sign out</button>
+</section>
+<section id="admin" hidden>
+<h2>Invite another Project user</h2>
+<form id="create-invite">
+<label>Google email
+<input name="recipientEmail" type="email" maxlength="254" autocomplete="off" required/></label>
+<button>Create invitation</button></form>
+<p id="invite-result" aria-live="polite"></p>
+</section>
+</main><script src="/auth.js" defer></script></body></html>

package/assets/generated/authentication/src/ProjectForge.Auth/AdmissionPolicy.cs

@@ -0,0 +1,167 @@
+using System;
+using System.Collections.Generic;
+
+namespace ProjectForge.Auth;
+
+/// <summary>
+/// Immutable OIDC identity key. Provider token validation is the responsibility
+/// of a trusted adapter: never construct one from unsigned browser parameters.
+/// Comparison is deliberately ordinal; provider subjects are not email aliases.
+/// </summary>
+public sealed record ExternalIdentityKey
+{
+    public string Issuer { get; }
+    public string Subject { get; }
+
+    public ExternalIdentityKey(string issuer, string subject)
+    {
+        if (string.IsNullOrWhiteSpace(issuer) ||
+            !Uri.TryCreate(issuer, UriKind.Absolute, out var address) ||
+            address.Scheme != Uri.UriSchemeHttps ||
+            !string.IsNullOrEmpty(address.UserInfo) ||
+            !string.IsNullOrEmpty(address.Query) ||
+            !string.IsNullOrEmpty(address.Fragment))
+        {
+            throw new ArgumentException("An absolute HTTPS issuer is required.", nameof(issuer));
+        }
+
+        if (string.IsNullOrWhiteSpace(subject) || subject != subject.Trim())
+        {
+            throw new ArgumentException("A stable, nonblank subject is required.", nameof(subject));
+        }
+
+        Issuer = issuer;
+        Subject = subject;
+    }
+}
+
+/// <summary>
+/// An assertion already authenticated by the host's OIDC middleware.
+/// This type does not verify tokens, issuer allowlists, nonce, audience or PKCE.
+/// </summary>
+public sealed record VerifiedExternalPrincipal(
+    ExternalIdentityKey Identity,
+    string? Email,
+    bool EmailVerified);
+
+public enum ApplicationAccountState
+{
+    PendingApproval,
+    Approved,
+    Disabled
+}
+
+/// <summary>
+/// Snapshot read from the owning application's trusted account store.
+/// Public-facing responses must not distinguish unknown, disabled or unlinked users.
+/// </summary>
+public sealed record AccountSnapshot(
+    Guid AccountId,
+    ApplicationAccountState State,
+    IReadOnlySet<ExternalIdentityKey> LinkedIdentities);
+
+public enum SignInDecision
+{
+    Denied,
+    Allowed
+}
+
+/// <summary>
+/// An application-store-validated invitation proof. The caller must validate
+/// a one-time token hash and redeem it transactionally with the account write.
+/// A matching email alone never constitutes an invitation.
+/// </summary>
+public sealed record ValidatedInvitation(
+    Guid InvitationId,
+    string IntendedEmail,
+    ExternalIdentityKey? BoundIdentity,
+    DateTimeOffset ExpiresAt,
+    bool TokenProofVerified,
+    bool Consumed,
+    bool Revoked);
+
+/// <summary>
+/// Explicitly reviewed, time-bounded, stable identity for initial administrator
+/// creation. No "first user to sign in becomes admin" behavior.
+/// </summary>
+public sealed record PreapprovedAdministratorSeed(
+    ExternalIdentityKey Identity,
+    DateTimeOffset ExpiresAt,
+    bool Enabled);
+
+/// <summary>
+/// Fail-closed, side-effect-free policy primitives for the initial Google OIDC
+/// household preset. These do not create users, issue sessions, send email,
+/// mutate storage, or replace proper OIDC validation or transaction boundaries.
+/// </summary>
+public sealed class InviteOnlyAdmissionPolicy
+{
+    public SignInDecision EvaluateSignIn(
+        VerifiedExternalPrincipal principal,
+        AccountSnapshot? account)
+    {
+        ArgumentNullException.ThrowIfNull(principal);
+
+        if (!HasVerifiedEmail(principal) ||
+            account is null ||
+            account.AccountId == Guid.Empty ||
+            account.State != ApplicationAccountState.Approved ||
+            account.LinkedIdentities is null ||
+            !account.LinkedIdentities.Contains(principal.Identity))
+        {
+            return SignInDecision.Denied;
+        }
+
+        return SignInDecision.Allowed;
+    }
+
+    public bool MayAcceptInvitation(
+        VerifiedExternalPrincipal principal,
+        ValidatedInvitation? invitation,
+        DateTimeOffset now)
+    {
+        ArgumentNullException.ThrowIfNull(principal);
+
+        if (!HasVerifiedEmail(principal) ||
+            invitation is null ||
+            invitation.InvitationId == Guid.Empty ||
+            !invitation.TokenProofVerified ||
+            invitation.Consumed ||
+            invitation.Revoked ||
+            now >= invitation.ExpiresAt ||
+            !SameNormalizedEmail(principal.Email!, invitation.IntendedEmail))
+        {
+            return false;
+        }
+
+        return invitation.BoundIdentity is null ||
+               invitation.BoundIdentity == principal.Identity;
+    }
+
+    public bool MayInitializeFirstAdministrator(
+        VerifiedExternalPrincipal principal,
+        PreapprovedAdministratorSeed? seed,
+        int existingAdministratorCount,
+        DateTimeOffset now)
+    {
+        ArgumentNullException.ThrowIfNull(principal);
+
+        return HasVerifiedEmail(principal) &&
+               existingAdministratorCount == 0 &&
+               seed is { Enabled: true } &&
+               now < seed.ExpiresAt &&
+               seed.Identity == principal.Identity;
+    }
+
+    private static bool HasVerifiedEmail(VerifiedExternalPrincipal principal) =>
+        principal.Identity is not null &&
+        principal.EmailVerified &&
+        !string.IsNullOrWhiteSpace(principal.Email);
+
+    private static bool SameNormalizedEmail(string asserted, string intended) =>
+        !string.IsNullOrWhiteSpace(intended) &&
+        string.Equals(
+            asserted.Trim(),
+            intended.Trim(),
+            StringComparison.OrdinalIgnoreCase);
+}

package/assets/generated/authentication/src/ProjectForge.Auth/AuthenticationDiagnostics.cs

@@ -0,0 +1,159 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace ProjectForge.Auth;
+
+// Fixed internal diagnostics. These states must be populated only by trusted
+// application middleware and must never include raw Google tokens, provider
+// response bodies, account emails, usernames, session IDs or exception text.
+public enum AuthenticationStage
+{
+    PublicOrigin,
+    OidcAssertion,
+    AccountAdmission,
+    Session,
+    ApplicationAuthorization,
+    InvitationEmail
+}
+
+public enum AuthenticationStageState
+{
+    NotChecked,
+    Passed,
+    Failed,
+    Blocked
+}
+
+public enum AuthenticationFailureCode
+{
+    None,
+    PublicOriginRejected,
+    OidcAssertionRejected,
+    AccountNotAdmitted,
+    SessionRejected,
+    ApplicationAccessDenied,
+    InvitationDeliveryUnavailable,
+    Unclassified
+}
+
+public sealed record AuthenticationStageEvidence(
+    AuthenticationStage Stage,
+    AuthenticationStageState State,
+    AuthenticationFailureCode FailureCode);
+
+public sealed record AuthenticationDiagnosticSummary(
+    int SchemaVersion,
+    string Status,
+    AuthenticationFailureCode ReasonCode,
+    IReadOnlyList<AuthenticationStage> Proved,
+    IReadOnlyList<AuthenticationStage> Failed,
+    IReadOnlyList<AuthenticationStage> Blocked,
+    IReadOnlyList<AuthenticationStage> NotChecked,
+    DateTimeOffset ObservedAt,
+    bool Mutated)
+{
+    // Public callers receive a uniform response, regardless of known,
+    // uninvited, disabled or unlinked account state.
+    public string PublicFailureMessage => "Unable to complete sign-in.";
+}
+
+/// <summary>
+/// Deterministic, bounded, side-effect-free diagnostic projection.
+/// This does not perform Google authentication, grant access or issue sessions.
+/// </summary>
+public static class AuthenticationDiagnostics
+{
+    private static readonly AuthenticationStage[] Stages =
+    [
+        AuthenticationStage.PublicOrigin,
+        AuthenticationStage.OidcAssertion,
+        AuthenticationStage.AccountAdmission,
+        AuthenticationStage.Session,
+        AuthenticationStage.ApplicationAuthorization,
+        AuthenticationStage.InvitationEmail
+    ];
+
+    private static readonly IReadOnlyDictionary<AuthenticationStage, AuthenticationFailureCode> ExpectedFailures =
+        new Dictionary<AuthenticationStage, AuthenticationFailureCode>
+        {
+            [AuthenticationStage.PublicOrigin] = AuthenticationFailureCode.PublicOriginRejected,
+            [AuthenticationStage.OidcAssertion] = AuthenticationFailureCode.OidcAssertionRejected,
+            [AuthenticationStage.AccountAdmission] = AuthenticationFailureCode.AccountNotAdmitted,
+            [AuthenticationStage.Session] = AuthenticationFailureCode.SessionRejected,
+            [AuthenticationStage.ApplicationAuthorization] = AuthenticationFailureCode.ApplicationAccessDenied,
+            [AuthenticationStage.InvitationEmail] = AuthenticationFailureCode.InvitationDeliveryUnavailable
+        };
+
+    public static AuthenticationDiagnosticSummary Summarize(
+        IEnumerable<AuthenticationStageEvidence> observations,
+        DateTimeOffset observedAt)
+    {
+        ArgumentNullException.ThrowIfNull(observations);
+        var byStage = new Dictionary<AuthenticationStage, AuthenticationStageEvidence>();
+        foreach (var entry in observations)
+        {
+            if (entry is null || !ExpectedFailures.ContainsKey(entry.Stage) ||
+                !Enum.IsDefined(entry.State) || !Enum.IsDefined(entry.FailureCode) ||
+                !byStage.TryAdd(entry.Stage, entry))
+            {
+                throw new ArgumentException("Invalid or duplicate authentication stage observation.", nameof(observations));
+            }
+
+            if (entry.State == AuthenticationStageState.Failed &&
+                entry.FailureCode != ExpectedFailures[entry.Stage] &&
+                entry.FailureCode != AuthenticationFailureCode.Unclassified)
+            {
+                throw new ArgumentException("Failure code conflicts with stage.", nameof(observations));
+            }
+
+            if (entry.State != AuthenticationStageState.Failed &&
+                entry.FailureCode != AuthenticationFailureCode.None)
+            {
+                throw new ArgumentException("A nonfailed stage cannot report a failure code.", nameof(observations));
+            }
+        }
+
+        var proved = new List<AuthenticationStage>(6);
+        var failed = new List<AuthenticationStage>(6);
+        var blocked = new List<AuthenticationStage>(6);
+        var notChecked = new List<AuthenticationStage>(6);
+        var failure = AuthenticationFailureCode.None;
+        foreach (var stage in Stages)
+        {
+            var state = byStage.TryGetValue(stage, out var evidence)
+                ? evidence.State
+                : AuthenticationStageState.NotChecked;
+            switch (state)
+            {
+                case AuthenticationStageState.Passed:
+                    proved.Add(stage);
+                    break;
+                case AuthenticationStageState.Failed:
+                    failed.Add(stage);
+                    if (failure == AuthenticationFailureCode.None)
+                    {
+                        failure = evidence!.FailureCode;
+                    }
+                    break;
+                case AuthenticationStageState.Blocked:
+                    blocked.Add(stage);
+                    break;
+                default:
+                    notChecked.Add(stage);
+                    break;
+            }
+        }
+
+        // Email invitation delivery is not a prerequisite for an already
+        // approved user's interactive sign-in.
+        var required = Stages.Take(5).ToArray();
+        var allRequiredProved = required.All(proved.Contains);
+        var status = required.Any(failed.Contains) ? "failed"
+            : required.Any(blocked.Contains) ? "blocked"
+            : allRequiredProved ? "proved" : "incomplete";
+        return new AuthenticationDiagnosticSummary(
+            1, status, failure, proved, failed, blocked, notChecked,
+            observedAt.ToUniversalTime(), Mutated: false);
+    }
+}

package/assets/generated/authentication/src/ProjectForge.Auth/ProjectForge.Auth.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+</Project>

package/assets/generated/authentication/src/ProjectForge.Auth/PwaExistingProjectCompatibility.cs

@@ -0,0 +1,64 @@
+using System;
+
+namespace ProjectForge.Auth;
+
+/// <summary>
+/// Compatibility boundary for existing Family Meal Planner FB-001 accounts.
+/// This adapts the already-linked Google identity to the reusable approval
+/// policy WITHOUT changing its on-disk 32-hex string GUID, password hash,
+/// email-recovery flow, session credentials, data or membership.
+////
+//// PWA still owns password sign-in, session issuance, OIDC code flow and
+//// initial enrollment behavior until a separately approved runtime cutover.
+/// The adapter must be called only after the PWA's trusted Google middleware
+/// validated the OIDC assertion, issuer and subject. An unverified email
+/// remains unverified under the PWA-compatible mode; it never links by email.
+/// </summary>
+public sealed record ExistingPwaGoogleAccount(
+    string AccountIdN,
+    string LinkedIssuer,
+    string LinkedSubject,
+    string Email,
+    bool EmailVerifiedByGoogle);
+
+public sealed record ExistingPwaCompatibilityResult(
+    SignInDecision Decision,
+    string? PreservedAccountId,
+    string ReasonCode,
+    bool PreserveUnverifiedEmailState);
+
+public sealed class PwaExistingProjectCompatibility
+{
+    // Existing PWA FB-001 deliberately allows a verified OIDC assertion with
+    // email_verified=false to create a non-email-verified account/session.
+    // Its service tests document that behavior. New Projects default to the
+    // stricter invite-only policy; migration must not silently tighten PWA.
+    public ExistingPwaCompatibilityResult EvaluateExistingGoogleLink(
+        ExistingPwaGoogleAccount? account,
+        string authenticatedIssuer,
+        string authenticatedSubject)
+    {
+        if (account is null ||
+            !Guid.TryParseExact(account.AccountIdN, "N", out var id) ||
+            id == Guid.Empty ||
+            account.AccountIdN != id.ToString("N") ||
+            authenticatedIssuer != "https://accounts.google.com" ||
+            account.LinkedIssuer != authenticatedIssuer ||
+            string.IsNullOrWhiteSpace(account.LinkedSubject) ||
+            account.LinkedSubject != authenticatedSubject ||
+            string.IsNullOrWhiteSpace(account.Email))
+        {
+            return new ExistingPwaCompatibilityResult(
+                SignInDecision.Denied, null, "existing-link-not-proven", false);
+        }
+
+        // OIDC token validation and application-session issuance remain PWA
+        // responsibilities. This adapter is a non-destructive exact-link
+        // check, not a household membership or email verification grant.
+        return new ExistingPwaCompatibilityResult(
+            SignInDecision.Allowed,
+            account.AccountIdN,
+            "existing-link-verified-pwa-compatibility",
+            !account.EmailVerifiedByGoogle);
+    }
+}