Add HTTP message signature to webhook messages (#1689)

DFE-Digital · Nov 19, 2024 · 0b25e4d · 0b25e4d
1 parent 03f2a16
commit 0b25e4d
Show file tree

Hide file tree

Showing 24 changed files with 1,044 additions and 64 deletions.
diff --git a/TeachingRecordSystem/Directory.Packages.props b/TeachingRecordSystem/Directory.Packages.props
@@ -71,6 +71,9 @@
     <PackageVersion Include="Moq" Version="4.20.70" />
     <PackageVersion Include="Npgsql.DependencyInjection" Version="8.0.3" />
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.10" />
+    <PackageVersion Include="NSign.AspNetCore" Version="1.1.0" />
+    <PackageVersion Include="NSign.Client" Version="1.1.0" />
+    <PackageVersion Include="NSign.SignatureProviders" Version="1.1.0" />
     <PackageVersion Include="OpenIddict.AspNetCore" Version="5.2.0" />
     <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="5.2.0" />
     <PackageVersion Include="Optional" Version="4.0.0" />

diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.Api/packages.lock.json b/TeachingRecordSystem/src/TeachingRecordSystem.Api/packages.lock.json
@@ -982,6 +982,18 @@
           "Microsoft.Extensions.Logging.Abstractions": "8.0.0"
         }
       },
+      "NSign.Abstractions": {
+        "type": "Transitive",
+        "resolved": "1.1.0",
+        "contentHash": "UGgFyDoeyz0fLm7P/Qu7TqOqeLEBySIU8qCRCPKoCmn3wmp67OXLkYyxAUL4s9J1SwVhWjPc8AdvBHSJecJ+cw==",
+        "dependencies": {
+          "Microsoft.Extensions.Logging.Abstractions": "8.0.1",
+          "Microsoft.Extensions.Options": "8.0.2",
+          "Microsoft.Extensions.Options.DataAnnotations": "8.0.0",
+          "StructuredFieldValues": "0.6.3",
+          "System.Collections.Immutable": "8.0.0"
+        }
+      },
       "OpenIddict.Abstractions": {
         "type": "Transitive",
         "resolved": "5.2.0",
@@ -1200,6 +1212,11 @@
           "Pipelines.Sockets.Unofficial": "2.2.8"
         }
       },
+      "StructuredFieldValues": {
+        "type": "Transitive",
+        "resolved": "0.6.3",
+        "contentHash": "EgCsxEnSeXuamDL6AV8ygCI+WHNodfgARlpqBT1MQjy4Qxg8VQA7IHlH5jFbzhXKpWIL2mU8+/Ed3yW/At9vWg=="
+      },
       "Swashbuckle.AspNetCore.Swagger": {
         "type": "Transitive",
         "resolved": "6.6.2",
@@ -1277,8 +1294,8 @@
       },
       "System.Collections.Immutable": {
         "type": "Transitive",
-        "resolved": "1.5.0",
-        "contentHash": "EXKiDFsChZW0RjrZ4FYHu9aW6+P4MCgEDCklsVseRfhoO0F+dXeMSsMRAlVXIo06kGJ/zv+2w1a2uc2+kxxSaQ=="
+        "resolved": "8.0.0",
+        "contentHash": "AurL6Y5BA1WotzlEvVaIDpqzpIPvYnnldxru8oXJU2yFxFUy3+pNXjXd1ymO+RA0rq0+590Q8gaz2l3Sr7fmqg=="
       },
       "System.Collections.NonGeneric": {
         "type": "Transitive",
@@ -1626,8 +1643,8 @@
       },
       "System.IO.Pipelines": {
         "type": "Transitive",
-        "resolved": "5.0.1",
-        "contentHash": "qEePWsaq9LoEEIqhbGe6D5J8c9IqQOUuTzzV6wn1POlfdLkJliZY3OlB0j0f17uMWlqZYjH7txj+2YbyrIA8Yg=="
+        "resolved": "8.0.0",
+        "contentHash": "FHNOatmUq0sqJOkTx+UF/9YK1f180cnW5FVqnQMvYUN0elp6wFzbtPSiqbo1/ru8ICp43JM1i7kKkk6GsNGHlA=="
       },
       "System.Linq": {
         "type": "Transitive",
@@ -2479,6 +2496,8 @@
           "Microsoft.Extensions.Options.DataAnnotations": "[8.0.0, )",
           "Microsoft.PowerPlatform.Dataverse.Client": "[1.1.27, )",
           "Microsoft.PowerPlatform.Dataverse.Client.Dynamics": "[1.1.27, )",
+          "NSign.Client": "[1.1.0, )",
+          "NSign.SignatureProviders": "[1.1.0, )",
           "Npgsql.DependencyInjection": "[8.0.3, )",
           "Npgsql.EntityFrameworkCore.PostgreSQL": "[8.0.10, )",
           "OpenIddict.EntityFrameworkCore": "[5.2.0, )",
@@ -2960,6 +2979,30 @@
           "Npgsql": "8.0.5"
         }
       },
+      "NSign.Client": {
+        "type": "CentralTransitive",
+        "requested": "[1.1.0, )",
+        "resolved": "1.1.0",
+        "contentHash": "wfHRl6NDEc92nJXZjPqCgEBvqC8z/+uLWUOQ+YcBna5BHdb+Xx2Rr8Ixc1yjNVC6TioxjJjtqXaVpJhPVLPh/Q==",
+        "dependencies": {
+          "Microsoft.Extensions.Http": "8.0.0",
+          "Microsoft.Extensions.Logging.Abstractions": "8.0.1",
+          "Microsoft.Extensions.Options": "8.0.2",
+          "NSign.Abstractions": "1.1.0",
+          "StructuredFieldValues": "0.6.3",
+          "System.Collections.Immutable": "8.0.0",
+          "System.IO.Pipelines": "8.0.0"
+        }
+      },
+      "NSign.SignatureProviders": {
+        "type": "CentralTransitive",
+        "requested": "[1.1.0, )",
+        "resolved": "1.1.0",
+        "contentHash": "poa3Qez1ds4w28TWQyPzKa/Yd4WOY9Pto8qWI96wNRHp76ZfV9M2kfZ6JH7ma3uAgInwpYEoAc+2Z0h6/E/sSA==",
+        "dependencies": {
+          "NSign.Abstractions": "1.1.0"
+        }
+      },
       "OpenIddict.EntityFrameworkCore": {
         "type": "CentralTransitive",
         "requested": "[5.2.0, )",

diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccess/packages.lock.json b/TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccess/packages.lock.json
@@ -945,6 +945,18 @@
           "Microsoft.Extensions.Logging.Abstractions": "8.0.0"
         }
       },
+      "NSign.Abstractions": {
+        "type": "Transitive",
+        "resolved": "1.1.0",
+        "contentHash": "UGgFyDoeyz0fLm7P/Qu7TqOqeLEBySIU8qCRCPKoCmn3wmp67OXLkYyxAUL4s9J1SwVhWjPc8AdvBHSJecJ+cw==",
+        "dependencies": {
+          "Microsoft.Extensions.Logging.Abstractions": "8.0.1",
+          "Microsoft.Extensions.Options": "8.0.2",
+          "Microsoft.Extensions.Options.DataAnnotations": "8.0.0",
+          "StructuredFieldValues": "0.6.3",
+          "System.Collections.Immutable": "8.0.0"
+        }
+      },
       "OpenIddict": {
         "type": "Transitive",
         "resolved": "5.2.0",
@@ -1292,6 +1304,11 @@
         "resolved": "1.1.6",
         "contentHash": "aLJu7Q0mVk0e9QwjJLEh70tXQ0Url8fHITrHXwqF+eq7N20jGMOhkmTXUUjpPim+rCm0I4fARcVBRzJPSipN+w=="
       },
+      "StructuredFieldValues": {
+        "type": "Transitive",
+        "resolved": "0.6.3",
+        "contentHash": "EgCsxEnSeXuamDL6AV8ygCI+WHNodfgARlpqBT1MQjy4Qxg8VQA7IHlH5jFbzhXKpWIL2mU8+/Ed3yW/At9vWg=="
+      },
       "System.AppContext": {
         "type": "Transitive",
         "resolved": "4.3.0",
@@ -1348,8 +1365,8 @@
       },
       "System.Collections.Immutable": {
         "type": "Transitive",
-        "resolved": "1.5.0",
-        "contentHash": "EXKiDFsChZW0RjrZ4FYHu9aW6+P4MCgEDCklsVseRfhoO0F+dXeMSsMRAlVXIo06kGJ/zv+2w1a2uc2+kxxSaQ=="
+        "resolved": "8.0.0",
+        "contentHash": "AurL6Y5BA1WotzlEvVaIDpqzpIPvYnnldxru8oXJU2yFxFUy3+pNXjXd1ymO+RA0rq0+590Q8gaz2l3Sr7fmqg=="
       },
       "System.Collections.NonGeneric": {
         "type": "Transitive",
@@ -1695,6 +1712,11 @@
         "resolved": "6.0.0",
         "contentHash": "Rfm2jYCaUeGysFEZjDe7j1R4x6Z6BzumS/vUT5a1AA/AWJuGX71PoGB0RmpyX3VmrGqVnAwtfMn39OHR8Y/5+g=="
       },
+      "System.IO.Pipelines": {
+        "type": "Transitive",
+        "resolved": "8.0.0",
+        "contentHash": "FHNOatmUq0sqJOkTx+UF/9YK1f180cnW5FVqnQMvYUN0elp6wFzbtPSiqbo1/ru8ICp43JM1i7kKkk6GsNGHlA=="
+      },
       "System.Linq": {
         "type": "Transitive",
         "resolved": "4.3.0",
@@ -2540,6 +2562,8 @@
           "Microsoft.Extensions.Options.DataAnnotations": "[8.0.0, )",
           "Microsoft.PowerPlatform.Dataverse.Client": "[1.1.27, )",
           "Microsoft.PowerPlatform.Dataverse.Client.Dynamics": "[1.1.27, )",
+          "NSign.Client": "[1.1.0, )",
+          "NSign.SignatureProviders": "[1.1.0, )",
           "Npgsql.DependencyInjection": "[8.0.3, )",
           "Npgsql.EntityFrameworkCore.PostgreSQL": "[8.0.10, )",
           "OpenIddict.EntityFrameworkCore": "[5.2.0, )",
@@ -3027,6 +3051,30 @@
           "Npgsql": "8.0.5"
         }
       },
+      "NSign.Client": {
+        "type": "CentralTransitive",
+        "requested": "[1.1.0, )",
+        "resolved": "1.1.0",
+        "contentHash": "wfHRl6NDEc92nJXZjPqCgEBvqC8z/+uLWUOQ+YcBna5BHdb+Xx2Rr8Ixc1yjNVC6TioxjJjtqXaVpJhPVLPh/Q==",
+        "dependencies": {
+          "Microsoft.Extensions.Http": "8.0.0",
+          "Microsoft.Extensions.Logging.Abstractions": "8.0.1",
+          "Microsoft.Extensions.Options": "8.0.2",
+          "NSign.Abstractions": "1.1.0",
+          "StructuredFieldValues": "0.6.3",
+          "System.Collections.Immutable": "8.0.0",
+          "System.IO.Pipelines": "8.0.0"
+        }
+      },
+      "NSign.SignatureProviders": {
+        "type": "CentralTransitive",
+        "requested": "[1.1.0, )",
+        "resolved": "1.1.0",
+        "contentHash": "poa3Qez1ds4w28TWQyPzKa/Yd4WOY9Pto8qWI96wNRHp76ZfV9M2kfZ6JH7ma3uAgInwpYEoAc+2Z0h6/E/sSA==",
+        "dependencies": {
+          "NSign.Abstractions": "1.1.0"
+        }
+      },
       "OpenIddict.EntityFrameworkCore": {
         "type": "CentralTransitive",
         "requested": "[5.2.0, )",

diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.Cli/packages.lock.json b/TeachingRecordSystem/src/TeachingRecordSystem.Cli/packages.lock.json
@@ -668,6 +668,18 @@
           "Microsoft.Extensions.Logging.Abstractions": "8.0.0"
         }
       },
+      "NSign.Abstractions": {
+        "type": "Transitive",
+        "resolved": "1.1.0",
+        "contentHash": "UGgFyDoeyz0fLm7P/Qu7TqOqeLEBySIU8qCRCPKoCmn3wmp67OXLkYyxAUL4s9J1SwVhWjPc8AdvBHSJecJ+cw==",
+        "dependencies": {
+          "Microsoft.Extensions.Logging.Abstractions": "8.0.1",
+          "Microsoft.Extensions.Options": "8.0.2",
+          "Microsoft.Extensions.Options.DataAnnotations": "8.0.0",
+          "StructuredFieldValues": "0.6.3",
+          "System.Collections.Immutable": "8.0.0"
+        }
+      },
       "OpenIddict.Abstractions": {
         "type": "Transitive",
         "resolved": "5.2.0",
@@ -826,6 +838,11 @@
         "resolved": "1.1.6",
         "contentHash": "aLJu7Q0mVk0e9QwjJLEh70tXQ0Url8fHITrHXwqF+eq7N20jGMOhkmTXUUjpPim+rCm0I4fARcVBRzJPSipN+w=="
       },
+      "StructuredFieldValues": {
+        "type": "Transitive",
+        "resolved": "0.6.3",
+        "contentHash": "EgCsxEnSeXuamDL6AV8ygCI+WHNodfgARlpqBT1MQjy4Qxg8VQA7IHlH5jFbzhXKpWIL2mU8+/Ed3yW/At9vWg=="
+      },
       "System.AppContext": {
         "type": "Transitive",
         "resolved": "4.3.0",
@@ -882,8 +899,8 @@
       },
       "System.Collections.Immutable": {
         "type": "Transitive",
-        "resolved": "1.5.0",
-        "contentHash": "EXKiDFsChZW0RjrZ4FYHu9aW6+P4MCgEDCklsVseRfhoO0F+dXeMSsMRAlVXIo06kGJ/zv+2w1a2uc2+kxxSaQ=="
+        "resolved": "8.0.0",
+        "contentHash": "AurL6Y5BA1WotzlEvVaIDpqzpIPvYnnldxru8oXJU2yFxFUy3+pNXjXd1ymO+RA0rq0+590Q8gaz2l3Sr7fmqg=="
       },
       "System.Collections.NonGeneric": {
         "type": "Transitive",
@@ -1212,6 +1229,11 @@
         "resolved": "6.0.0",
         "contentHash": "Rfm2jYCaUeGysFEZjDe7j1R4x6Z6BzumS/vUT5a1AA/AWJuGX71PoGB0RmpyX3VmrGqVnAwtfMn39OHR8Y/5+g=="
       },
+      "System.IO.Pipelines": {
+        "type": "Transitive",
+        "resolved": "8.0.0",
+        "contentHash": "FHNOatmUq0sqJOkTx+UF/9YK1f180cnW5FVqnQMvYUN0elp6wFzbtPSiqbo1/ru8ICp43JM1i7kKkk6GsNGHlA=="
+      },
       "System.Linq": {
         "type": "Transitive",
         "resolved": "4.3.0",
@@ -2052,6 +2074,8 @@
           "Microsoft.Extensions.Options.DataAnnotations": "[8.0.0, )",
           "Microsoft.PowerPlatform.Dataverse.Client": "[1.1.27, )",
           "Microsoft.PowerPlatform.Dataverse.Client.Dynamics": "[1.1.27, )",
+          "NSign.Client": "[1.1.0, )",
+          "NSign.SignatureProviders": "[1.1.0, )",
           "Npgsql.DependencyInjection": "[8.0.3, )",
           "Npgsql.EntityFrameworkCore.PostgreSQL": "[8.0.10, )",
           "OpenIddict.EntityFrameworkCore": "[5.2.0, )",
@@ -2452,6 +2476,30 @@
           "Npgsql": "8.0.5"
         }
       },
+      "NSign.Client": {
+        "type": "CentralTransitive",
+        "requested": "[1.1.0, )",
+        "resolved": "1.1.0",
+        "contentHash": "wfHRl6NDEc92nJXZjPqCgEBvqC8z/+uLWUOQ+YcBna5BHdb+Xx2Rr8Ixc1yjNVC6TioxjJjtqXaVpJhPVLPh/Q==",
+        "dependencies": {
+          "Microsoft.Extensions.Http": "8.0.0",
+          "Microsoft.Extensions.Logging.Abstractions": "8.0.1",
+          "Microsoft.Extensions.Options": "8.0.2",
+          "NSign.Abstractions": "1.1.0",
+          "StructuredFieldValues": "0.6.3",
+          "System.Collections.Immutable": "8.0.0",
+          "System.IO.Pipelines": "8.0.0"
+        }
+      },
+      "NSign.SignatureProviders": {
+        "type": "CentralTransitive",
+        "requested": "[1.1.0, )",
+        "resolved": "1.1.0",
+        "contentHash": "poa3Qez1ds4w28TWQyPzKa/Yd4WOY9Pto8qWI96wNRHp76ZfV9M2kfZ6JH7ma3uAgInwpYEoAc+2Z0h6/E/sSA==",
+        "dependencies": {
+          "NSign.Abstractions": "1.1.0"
+        }
+      },
       "OpenIddict.EntityFrameworkCore": {
         "type": "CentralTransitive",
         "requested": "[5.2.0, )",

diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.Core/Services/Webhooks/WebhookOptions.cs b/TeachingRecordSystem/src/TeachingRecordSystem.Core/Services/Webhooks/WebhookOptions.cs
@@ -6,4 +6,20 @@ public class WebhookOptions
 {
     [Required]
     public required string CanonicalDomain { get; set; }
+
+    [Required]
+    public required string SigningKeyId { get; set; }
+
+    [Required]
+    public required WebhookOptionsKey[] Keys { get; set; }
+}
+
+public class WebhookOptionsKey
+{
+    [Required]
+    public required string KeyId { get; set; }
+    [Required]
+    public required string CertificatePem { get; set; }
+    [Required]
+    public required string PrivateKeyPem { get; set; }
 }