From 0bfec269491f74625fa52d7323ac6f4bc7b42584 Mon Sep 17 00:00:00 2001
From: James Gunn <james@gunn.io>
Date: Thu, 28 Sep 2023 15:37:02 +0100
Subject: [PATCH] Use a TagHelperInitializer to set the Antiforgery attribute

---
 .../Pages/Cases/EditCase/Accept.cshtml        |  2 +-
 .../Pages/Cases/EditCase/Reject.cshtml        |  2 +-
 .../Pages/Persons/Index.cshtml                |  2 +-
 .../Pages/SignOut.cshtml                      |  4 +-
 .../Pages/Users/AddUser/Confirm.cshtml        |  4 +-
 .../Pages/Users/AddUser/Index.cshtml          |  4 +-
 .../Pages/Users/EditUser.cshtml               |  2 +-
 .../TeachingRecordSystem.SupportUi/Program.cs |  6 +-
 .../TagHelpers/FormTagHelperInitializer.cs    | 16 ++++++
 .../TagHelpers/TrsActionFormTagHelper.cs      | 55 -------------------
 10 files changed, 31 insertions(+), 66 deletions(-)
 create mode 100644 TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TagHelpers/FormTagHelperInitializer.cs
 delete mode 100644 TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TagHelpers/TrsActionFormTagHelper.cs

diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Cases/EditCase/Accept.cshtml b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Cases/EditCase/Accept.cshtml
index 33485c2ede..f2daeff5e1 100644
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Cases/EditCase/Accept.cshtml
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Cases/EditCase/Accept.cshtml
@@ -11,7 +11,7 @@
 <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds-from-desktop">
         <h1 class="govuk-heading-l">@ViewBag.Title</h1>
-        <form action="@LinkGenerator.AcceptCase(Model.TicketNumber)" method="post" asp-antiforgery="true">
+        <form action="@LinkGenerator.AcceptCase(Model.TicketNumber)" method="post">
             <govuk-summary-list>
                 <govuk-summary-list-row>
                     <govuk-summary-list-row-key>Current</govuk-summary-list-row-key>
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Cases/EditCase/Reject.cshtml b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Cases/EditCase/Reject.cshtml
index 320628d0a3..ef3f086d0c 100644
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Cases/EditCase/Reject.cshtml
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Cases/EditCase/Reject.cshtml
@@ -12,7 +12,7 @@
 <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds-from-desktop">
         <h1 class="govuk-heading-l">@ViewBag.Title</h1>
-        <form action="@LinkGenerator.RejectCase(Model.TicketNumber)" method="post" asp-antiforgery="true">
+        <form action="@LinkGenerator.RejectCase(Model.TicketNumber)" method="post">
             <govuk-radios asp-for="RejectionReasonChoice">
                 <govuk-radios-fieldset>
                     <govuk-radios-fieldset-legend>
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Persons/Index.cshtml b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Persons/Index.cshtml
index 52d35da1af..61151120a7 100644
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Persons/Index.cshtml
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Persons/Index.cshtml
@@ -10,7 +10,7 @@
 <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds-from-desktop">
         <div class="govuk-!-margin-bottom-6">
-            <form trs-action="l => l.Persons()" method="get" data-testid="search-form">
+            <form action="@LinkGenerator.Persons()" method="get" data-testid="search-form">
                 <div class="moj-search trs-search govuk-!-margin-bottom-4">
                     <govuk-input asp-for="Search"
                                  input-class="moj-search__input"
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/SignOut.cshtml b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/SignOut.cshtml
index fbacd54bd3..b2320e7c33 100644
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/SignOut.cshtml
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/SignOut.cshtml
@@ -1,4 +1,4 @@
-@page "/sign-out"
+@page "/sign-out"
 @addTagHelper *, Joonasw.AspNetCore.SecurityHeaders
 @model TeachingRecordSystem.SupportUi.Pages.SignOutModel
 @{
@@ -7,7 +7,7 @@
 
 <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds">
-        <form action="@LinkGenerator.SignOut()" method="post" asp-antiforgery="true">
+        <form action="@LinkGenerator.SignOut()" method="post">
             <govuk-button type="submit">Sign out</govuk-button>
         </form>
         <script asp-add-nonce="true">document.forms[0].submit();</script>
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Confirm.cshtml b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Confirm.cshtml
index 66ca7dd80a..934a518d45 100644
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Confirm.cshtml
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Confirm.cshtml
@@ -1,4 +1,4 @@
-@page "/users/add/confirm"
+@page "/users/add/confirm"
 @using TeachingRecordSystem.Core;
 @model TeachingRecordSystem.SupportUi.Pages.Users.AddUser.ConfirmModel
 @{
@@ -7,7 +7,7 @@
 
 <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds">
-        <form trs-action="l => l.AddUser(Model.UserId!)">
+        <form action="@LinkGenerator.AddUser(Model.UserId!)" method="post">
             <h1 class="govuk-heading-l">@ViewBag.Title</h1>
 
             <govuk-input asp-for="Email" type="email" disabled />
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Index.cshtml b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Index.cshtml
index f024bbf0d9..8146167e8f 100644
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Index.cshtml
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/AddUser/Index.cshtml
@@ -1,4 +1,4 @@
-@page "/users/add"
+@page "/users/add"
 @model TeachingRecordSystem.SupportUi.Pages.Users.AddUser.IndexModel
 @{
     ViewBag.Title = "Add user";
@@ -6,7 +6,7 @@
 
 <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds">
-        <form trs-action="l => l.AddUser()">
+        <form action="@LinkGenerator.AddUser()" method="post">
             <h1 class="govuk-heading-l">@ViewBag.Title</h1>
 
             <govuk-input asp-for="Email" type="email" autocomplete="off" />
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/EditUser.cshtml b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/EditUser.cshtml
index f98667eaf3..91068aa818 100644
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/EditUser.cshtml
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Pages/Users/EditUser.cshtml
@@ -11,7 +11,7 @@
 
 <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds">
-        <form trs-action="l => l.EditUser(Model.UserId!)">
+        <form action="@LinkGenerator.EditUser(Model.UserId!)" method="post">
             <h1 class="govuk-heading-l">@ViewBag.Title</h1>
 
             <govuk-input asp-for="Email" type="email" disabled />
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Program.cs b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Program.cs
index 98aa7fe58e..6817231c68 100644
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Program.cs
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/Program.cs
@@ -6,6 +6,8 @@
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.Mvc.Authorization;
+using Microsoft.AspNetCore.Mvc.Razor;
+using Microsoft.AspNetCore.Mvc.TagHelpers;
 using Microsoft.Extensions.Caching.Distributed;
 using Microsoft.Extensions.Diagnostics.HealthChecks;
 using Microsoft.Identity.Web;
@@ -19,6 +21,7 @@
 using TeachingRecordSystem.SupportUi.Infrastructure.Redis;
 using TeachingRecordSystem.SupportUi.Infrastructure.Security;
 using TeachingRecordSystem.SupportUi.Services;
+using TeachingRecordSystem.SupportUi.TagHelpers;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -177,7 +180,8 @@
     .AddTransient<CheckUserExistsFilter>()
     .AddSingleton<IClock, Clock>()
     .AddSupportUiServices(builder.Configuration, builder.Environment)
-    .AddSingleton<ReferenceDataCache>();
+    .AddSingleton<ReferenceDataCache>()
+    .AddSingleton<ITagHelperInitializer<FormTagHelper>, FormTagHelperInitializer>();
 
 var app = builder.Build();
 
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TagHelpers/FormTagHelperInitializer.cs b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TagHelpers/FormTagHelperInitializer.cs
new file mode 100644
index 0000000000..77dfd55343
--- /dev/null
+++ b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TagHelpers/FormTagHelperInitializer.cs
@@ -0,0 +1,16 @@
+using Microsoft.AspNetCore.Mvc.Razor;
+using Microsoft.AspNetCore.Mvc.Rendering;
+using Microsoft.AspNetCore.Mvc.TagHelpers;
+
+namespace TeachingRecordSystem.SupportUi.TagHelpers;
+
+public class FormTagHelperInitializer : ITagHelperInitializer<FormTagHelper>
+{
+    public void Initialize(FormTagHelper helper, ViewContext context)
+    {
+        if (helper.Antiforgery is null)
+        {
+            helper.Antiforgery = true;
+        }
+    }
+}
diff --git a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TagHelpers/TrsActionFormTagHelper.cs b/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TagHelpers/TrsActionFormTagHelper.cs
deleted file mode 100644
index ffb20df229..0000000000
--- a/TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TagHelpers/TrsActionFormTagHelper.cs
+++ /dev/null
@@ -1,55 +0,0 @@
-using System.Diagnostics.CodeAnalysis;
-using Microsoft.AspNetCore.Mvc.Rendering;
-using Microsoft.AspNetCore.Mvc.ViewFeatures;
-using Microsoft.AspNetCore.Razor.TagHelpers;
-
-namespace TeachingRecordSystem.SupportUi.TagHelpers;
-
-[HtmlTargetElement("form", Attributes = "trs-action")]
-public class TrsActionFormTagHelper : TagHelper
-{
-    private readonly IHtmlGenerator _htmlGenerator;
-    private readonly TrsLinkGenerator _linkGenerator;
-
-    public TrsActionFormTagHelper(IHtmlGenerator htmlGenerator, TrsLinkGenerator linkGenerator)
-    {
-        _htmlGenerator = htmlGenerator;
-        _linkGenerator = linkGenerator;
-    }
-
-    [HtmlAttributeName("trs-action")]
-    [DisallowNull]
-    public Func<TrsLinkGenerator, string>? Action { get; set; }
-
-    [HtmlAttributeName("method")]
-    public string? Method { get; set; }
-
-    [HtmlAttributeNotBound]
-    [ViewContext]
-    [DisallowNull]
-    public ViewContext? ViewContext { get; set; }
-
-    public override void Process(TagHelperContext context, TagHelperOutput output)
-    {
-        if (Action is null)
-        {
-            throw new InvalidOperationException("trs-action must be specified.");
-        }
-
-        var action = Action(_linkGenerator);
-        output.Attributes.Add("action", action);
-
-        var method = Method;
-        if (method is null)
-        {
-            method = "post";
-            output.Attributes.Add("method", method);
-        }
-
-        if (!string.Equals(method, "get", StringComparison.OrdinalIgnoreCase))
-        {
-            var antiforgeryTag = _htmlGenerator.GenerateAntiforgery(ViewContext);
-            output.PostContent.AppendHtml(antiforgeryTag);
-        }
-    }
-}