add security to management endpoints

SecurityService.BusinessLogic/SecurityServiceOptions.cs

@@ -17,6 +17,7 @@ public ServiceOptions()
         this.TokenOptions = new TokenOptions();
         this.SignInOptions = new SignInOptions();
         this.UserOptions = new UserOptions();
+        this.ManagementBootstrap = new ManagementBootstrapOptions();
     }
 
     #region Properties
@@ -45,9 +46,28 @@ public ServiceOptions()
 
     public UserOptions UserOptions { get; set; }
 
+    public ManagementBootstrapOptions ManagementBootstrap { get; set; }
+
     #endregion
 }
 
+public sealed class ManagementBootstrapOptions
+{
+    public bool Enabled { get; set; }
+
+    public string ClientId { get; set; } = string.Empty;
+
+    public string ClientSecret { get; set; } = string.Empty;
+
+    public string ClientName { get; set; } = "Management Bootstrap Client";
+
+    public string? AdminUserName { get; set; }
+
+    public string? AdminEmail { get; set; }
+
+    public string? AdminPassword { get; set; }
+}
+
 public class KestrelOptions
 {
     public bool AutoDiscoverFromContentRoot { get; set; }
@@ -172,4 +192,4 @@ public string CreateClientAssertion(string clientId, string issuer, Int32 expire
 
         return new JwtSecurityTokenHandler().WriteToken(token);
     }
-}
+}

SecurityService.Client/ISecurityServiceClient.cs

@@ -15,6 +15,8 @@ public interface ISecurityServiceClient
     {
         #region Methods
 
+        void SetAccessToken(String accessToken);
+
         Task<Result> CreateApiResource(CreateApiResourceRequest createApiResourceRequest,
                                                                   CancellationToken cancellationToken);
         Task<Result> CreateApiScope(CreateApiScopeRequest createApiScopeRequest,
@@ -78,4 +80,4 @@ Task<Result<List<UserResponse>>> GetUsers(String userName,
 
         #endregion
     }
-}
+}

SecurityService.Client/SecurityServiceClient.cs

@@ -6,6 +6,7 @@ namespace SecurityService.Client
     using System;
     using System.Collections.Generic;
     using System.Net.Http;
+    using System.Net.Http.Headers;
     using System.Text;
     using System.Threading;
     using System.Threading.Tasks;
@@ -32,6 +33,8 @@ public class SecurityServiceClient : ClientProxyBase, ISecurityServiceClient
         /// </summary>
         private readonly Func<String, String> BaseAddressResolver;
 
+        private readonly HttpClient HttpClient;
+
         #endregion
 
         #region Constructors
@@ -48,10 +51,16 @@ public SecurityServiceClient(Func<String, String> baseAddressResolver,
         {
             this.BaseAddressResolver = baseAddressResolver;
             this.BaseAddress = baseAddressResolver("SecurityService");            
+            this.HttpClient = httpClient;
         }
 
         #endregion
 
+        public void SetAccessToken(String accessToken)
+        {
+            this.HttpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
+        }
+
         #region Methods
 
         public async Task<Result> CreateApiResource(CreateApiResourceRequest createApiResourceRequest,
@@ -561,4 +570,4 @@ private async Task<Result<TokenResponse>> GetToken(String tokenRequest,
 
         #endregion
     }
-}
+}

SecurityService.IntegrationTests/Common/DockerHelper.cs

@@ -13,6 +13,7 @@ namespace SecurityService.IntergrationTests.Common
     using System.Net;
     using System.Net.Http;
     using System.Security.Cryptography.X509Certificates;
+    using System.Threading;
     using System.Threading.Tasks;
 
     public class DockerHelper : Shared.IntegrationTesting.TestContainers.DockerHelper
@@ -42,6 +43,14 @@ public override async Task StartContainersForScenarioRun(String scenarioName, Do
                 HttpClient httpClient = this.CreatePinnedHttpClient();
                 this.SecurityServiceClient = new SecurityServiceClient(securityServiceBaseAddressResolver, httpClient, Serialise, Deserialise);
 
+                SimpleResults.Result<SecurityService.DataTransferObjects.TokenResponse> bootstrapToken = await this.SecurityServiceClient.GetToken("management-bootstrap", "management-bootstrap-secret", CancellationToken.None);
+                if (bootstrapToken.IsFailed || String.IsNullOrWhiteSpace(bootstrapToken.Data?.AccessToken))
+                {
+                    throw new InvalidOperationException("Unable to obtain the integration-test management bootstrap token.");
+                }
+
+                this.SecurityServiceClient.SetAccessToken(bootstrapToken.Data.AccessToken);
+
                 ServicePointManager.SecurityProtocol = SecurityProtocolType.SystemDefault;
             }
             catch
@@ -72,6 +81,9 @@ public override ContainerBuilder SetupSecurityServiceContainer()
             environmentVariables.Add("ServiceOptions:PasswordOptions:RequireUpperCase", "false");
             environmentVariables.Add("ServiceOptions:UserOptions:RequireUniqueEmail", "false");
             environmentVariables.Add("ServiceOptions:SignInOptions:RequireConfirmedEmail", "false");
+            environmentVariables.Add("ServiceOptions:ManagementBootstrap:Enabled", "true");
+            environmentVariables.Add("ServiceOptions:ManagementBootstrap:ClientId", "management-bootstrap");
+            environmentVariables.Add("ServiceOptions:ManagementBootstrap:ClientSecret", "management-bootstrap-secret");
             environmentVariables.Add("ConnectionStrings:PersistedGrantDbContext", this.SetConnectionString($"PersistedGrantStore-{this.TestId}", this.UseSecureSqlServerDatabase));
             environmentVariables.Add("ConnectionStrings:ConfigurationDbContext", this.SetConnectionString($"Configuration-{this.TestId}", this.UseSecureSqlServerDatabase));
             environmentVariables.Add("ConnectionStrings:AuthenticationDbContext", this.SetConnectionString($"Authentication-{this.TestId}", this.UseSecureSqlServerDatabase));

SecurityService.OpenIdConnect.IntegrationTests/Common/DockerHelper.cs

@@ -113,6 +113,14 @@ public override async Task StartContainersForScenarioRun(String scenarioName, Do
                 this.httpClient = this.CreatePinnedHttpClient();
                 this.SecurityServiceClient = new SecurityServiceClient(securityServiceBaseAddressResolver, this.httpClient, Serialise, Deserialise);
 
+                SimpleResults.Result<SecurityService.DataTransferObjects.TokenResponse> bootstrapToken = await this.SecurityServiceClient.GetToken("management-bootstrap", "management-bootstrap-secret", CancellationToken.None);
+                if (bootstrapToken.IsFailed || String.IsNullOrWhiteSpace(bootstrapToken.Data?.AccessToken))
+                {
+                    throw new InvalidOperationException("Unable to obtain the integration-test management bootstrap token.");
+                }
+
+                this.SecurityServiceClient.SetAccessToken(bootstrapToken.Data.AccessToken);
+
                 DockerHelper.AddEntryToHostsFile("127.0.0.1", SecurityServiceContainerName);
                 DockerHelper.AddEntryToHostsFile("localhost", SecurityServiceContainerName);
             }
@@ -264,6 +272,9 @@ public override ContainerBuilder SetupSecurityServiceContainer()
             environmentVariables.Add($"ServiceOptions:PasswordOptions:RequireUpperCase","false");
             environmentVariables.Add($"ServiceOptions:UserOptions:RequireUniqueEmail","false");
             environmentVariables.Add($"ServiceOptions:SignInOptions:RequireConfirmedEmail","false");
+            environmentVariables.Add("ServiceOptions:ManagementBootstrap:Enabled", "true");
+            environmentVariables.Add("ServiceOptions:ManagementBootstrap:ClientId", "management-bootstrap");
+            environmentVariables.Add("ServiceOptions:ManagementBootstrap:ClientSecret", "management-bootstrap-secret");
 
             environmentVariables.Add("ConnectionStrings:PersistedGrantDbContext",this.SetConnectionString($"PersistedGrantStore-{this.TestId}", this.UseSecureSqlServerDatabase));
             environmentVariables.Add("ConnectionStrings:ConfigurationDbContext", this.SetConnectionString( $"Configuration-{this.TestId}", this.UseSecureSqlServerDatabase));

SecurityService.UnitTests/Authorization/ManagementAuthorizationPolicyTests.cs

@@ -0,0 +1,24 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization.Infrastructure;
+using OpenIddict.Validation.AspNetCore;
+using SecurityService.Authorization;
+using Shouldly;
+
+namespace SecurityService.UnitTests.Authorization;
+
+public sealed class ManagementAuthorizationPolicyTests
+{
+    [Fact]
+    public void AddManagementApiPolicy_RequiresAnAuthenticatedUser()
+    {
+        var options = new AuthorizationOptions();
+
+        ManagementAuthorizationPolicies.AddManagementApiPolicy(options);
+
+        var policy = options.GetPolicy(ManagementAuthorizationPolicies.ManagementApi);
+
+        policy.ShouldNotBeNull();
+        policy!.Requirements.ShouldContain(requirement => requirement is DenyAnonymousAuthorizationRequirement);
+        policy.AuthenticationSchemes.ShouldContain(OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme);
+    }
+}

SecurityService.UnitTests/Endpoints/ManagementEndpointsTests.cs

@@ -0,0 +1,36 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.AspNetCore.Routing;
+using MediatR;
+using SecurityService.BusinessLogic.Requests;
+using SecurityService.Authorization;
+using SecurityService.Endpoints;
+using Shouldly;
+
+namespace SecurityService.UnitTests.Endpoints;
+
+public sealed class ManagementEndpointsTests
+{
+    [Fact]
+    public async Task MapManagementEndpoints_AppliesManagementPolicyToEveryRoute()
+    {
+        var builder = WebApplication.CreateBuilder();
+        builder.Services.AddMediatR(configuration =>
+            configuration.RegisterServicesFromAssembly(typeof(SecurityServiceCommands).Assembly));
+        using var app = builder.Build();
+
+        app.MapManagementEndpoints();
+        await app.StartAsync();
+
+        var endpoints = app.Services.GetRequiredService<EndpointDataSource>()
+            .Endpoints
+            .OfType<RouteEndpoint>()
+            .ToArray();
+
+        endpoints.ShouldNotBeEmpty();
+        endpoints.All(endpoint => endpoint.Metadata.GetMetadata<IAuthorizeData>()?.Policy == ManagementAuthorizationPolicies.ManagementApi)
+            .ShouldBeTrue();
+    }
+}

SecurityService.UnitTests/HostedServices/ManagementBootstrapperTests.cs

@@ -0,0 +1,116 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Microsoft.EntityFrameworkCore;
+using OpenIddict.Abstractions;
+using SecurityService.BusinessLogic;
+using SecurityService.Database.DbContexts;
+using SecurityService.HostedServices;
+using SecurityService.UnitTests.Infrastructure;
+using Shouldly;
+
+namespace SecurityService.UnitTests.HostedServices;
+
+public sealed class ManagementBootstrapperTests
+{
+    [Fact]
+    public async Task InitializeAsync_WhenEnabled_CreatesBootstrapClientAndIsIdempotent()
+    {
+        using var provider = TestServiceProviderFactory.Create(
+            Guid.NewGuid().ToString(),
+            configureOptions: options =>
+            {
+                options.ManagementBootstrap.Enabled = true;
+                options.ManagementBootstrap.ClientId = "bootstrap-client";
+                options.ManagementBootstrap.ClientSecret = "bootstrap-secret";
+            });
+
+        using var scope = provider.CreateScope();
+        var bootstrapper = new ManagementBootstrapper(
+            scope.ServiceProvider.GetRequiredService<SecurityServiceDbContext>(),
+            scope.ServiceProvider.GetRequiredService<IOpenIddictApplicationManager>(),
+            scope.ServiceProvider.GetRequiredService<Microsoft.AspNetCore.Identity.UserManager<SecurityService.Database.Entities.ApplicationUser>>(),
+            scope.ServiceProvider.GetRequiredService<Microsoft.AspNetCore.Identity.RoleManager<Microsoft.AspNetCore.Identity.IdentityRole>>(),
+            scope.ServiceProvider.GetRequiredService<IOptions<ServiceOptions>>());
+
+        await bootstrapper.InitializeAsync(CancellationToken.None);
+        await bootstrapper.InitializeAsync(CancellationToken.None);
+
+        var dbContext = scope.ServiceProvider.GetRequiredService<SecurityServiceDbContext>();
+        var applicationManager = scope.ServiceProvider.GetRequiredService<IOpenIddictApplicationManager>();
+
+        (await applicationManager.FindByClientIdAsync("bootstrap-client")).ShouldNotBeNull();
+        (await dbContext.ClientDefinitions.CountAsync(client => client.ClientId == "bootstrap-client")).ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task InitializeAsync_WhenBootstrapApplicationSecretConflicts_FailsClearly()
+    {
+        using var provider = TestServiceProviderFactory.Create(
+            Guid.NewGuid().ToString(),
+            configureOptions: options =>
+            {
+                options.ManagementBootstrap.Enabled = true;
+                options.ManagementBootstrap.ClientId = "bootstrap-client";
+                options.ManagementBootstrap.ClientSecret = "configured-secret";
+            });
+
+        using var scope = provider.CreateScope();
+        var applicationManager = scope.ServiceProvider.GetRequiredService<IOpenIddictApplicationManager>();
+        await applicationManager.CreateAsync(new OpenIddictApplicationDescriptor
+        {
+            ClientId = "bootstrap-client",
+            ClientSecret = "existing-secret",
+            ClientType = OpenIddictConstants.ClientTypes.Confidential,
+            ConsentType = OpenIddictConstants.ConsentTypes.Implicit
+        });
+
+        var bootstrapper = CreateBootstrapper(scope);
+
+        var exception = await Should.ThrowAsync<InvalidOperationException>(() => bootstrapper.InitializeAsync(CancellationToken.None));
+
+        exception.Message.ShouldContain("bootstrap application");
+        exception.Message.ShouldContain("secret");
+    }
+
+    [Fact]
+    public async Task InitializeAsync_WhenBootstrapAdministratorEmailConflicts_FailsClearly()
+    {
+        using var provider = TestServiceProviderFactory.Create(
+            Guid.NewGuid().ToString(),
+            configureOptions: options =>
+            {
+                options.ManagementBootstrap.Enabled = true;
+                options.ManagementBootstrap.ClientId = "bootstrap-client";
+                options.ManagementBootstrap.ClientSecret = "bootstrap-secret";
+                options.ManagementBootstrap.AdminUserName = "administrator";
+                options.ManagementBootstrap.AdminEmail = "configured@example.com";
+                options.ManagementBootstrap.AdminPassword = "Password1!";
+            });
+
+        using var scope = provider.CreateScope();
+        var userManager = scope.ServiceProvider.GetRequiredService<Microsoft.AspNetCore.Identity.UserManager<SecurityService.Database.Entities.ApplicationUser>>();
+        (await userManager.CreateAsync(new SecurityService.Database.Entities.ApplicationUser
+        {
+            UserName = "administrator",
+            Email = "existing@example.com"
+        }, "Password1!"))
+            .Succeeded.ShouldBeTrue();
+
+        var bootstrapper = CreateBootstrapper(scope);
+
+        var exception = await Should.ThrowAsync<InvalidOperationException>(() => bootstrapper.InitializeAsync(CancellationToken.None));
+
+        exception.Message.ShouldContain("bootstrap administrator");
+        exception.Message.ShouldContain("email");
+    }
+
+    private static ManagementBootstrapper CreateBootstrapper(IServiceScope scope)
+    {
+        return new ManagementBootstrapper(
+            scope.ServiceProvider.GetRequiredService<SecurityServiceDbContext>(),
+            scope.ServiceProvider.GetRequiredService<IOpenIddictApplicationManager>(),
+            scope.ServiceProvider.GetRequiredService<Microsoft.AspNetCore.Identity.UserManager<SecurityService.Database.Entities.ApplicationUser>>(),
+            scope.ServiceProvider.GetRequiredService<Microsoft.AspNetCore.Identity.RoleManager<Microsoft.AspNetCore.Identity.IdentityRole>>(),
+            scope.ServiceProvider.GetRequiredService<IOptions<ServiceOptions>>());
+    }
+}

SecurityService.UnitTests/Infrastructure/TestServiceProviderFactory.cs

@@ -12,7 +12,7 @@ namespace SecurityService.UnitTests.Infrastructure;
 
 public static class TestServiceProviderFactory
 {
-    public static ServiceProvider Create(string databaseName, UserManager<ApplicationUser>? userManager = null, SignInManager<ApplicationUser>? signInManager = null)
+    public static ServiceProvider Create(string databaseName, UserManager<ApplicationUser>? userManager = null, SignInManager<ApplicationUser>? signInManager = null, Action<ServiceOptions>? configureOptions = null)
     {
         var rsa = RSA.Create(2048);
         var key = new RsaSecurityKey(rsa);
@@ -26,6 +26,7 @@ public static ServiceProvider Create(string databaseName, UserManager<Applicatio
             options.IssuerUrl = "https://localhost:5001";
             options.InMemoryDatabaseName = databaseName;
             options.SeedDefaultScopes = true;
+            configureOptions?.Invoke(options);
         });
         services.AddSingleton<IClientJwtService, ClientJwtService>();
         services.AddLogging();

SecurityService/Authorization/ManagementAuthorizationPolicies.cs

@@ -0,0 +1,16 @@
+using Microsoft.AspNetCore.Authorization;
+using OpenIddict.Validation.AspNetCore;
+
+namespace SecurityService.Authorization;
+
+public static class ManagementAuthorizationPolicies
+{
+    public static string ManagementApi { get; } = "ManagementApi";
+
+    public static void AddManagementApiPolicy(AuthorizationOptions options)
+    {
+        options.AddPolicy(ManagementApi, policy =>
+            policy.AddAuthenticationSchemes(OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme)
+                  .RequireAuthenticatedUser());
+    }
+}