Initial setup for Authorize access project (#1106)

TeachingRecordSystem/Directory.Packages.props

@@ -17,6 +17,7 @@
     <PackageVersion Include="Faker.Net" Version="2.0.154" />
     <PackageVersion Include="FakeXrmEasy.v9" Version="3.3.3" />
     <PackageVersion Include="FluentValidation.AspNetCore" Version="11.3.0" />
+    <PackageVersion Include="GovUk.OneLogin.AspNetCore" Version="0.1.1" />
     <PackageVersion Include="GovukNotify" Version="6.1.0" />
     <PackageVersion Include="GovUk.Frontend.AspNetCore" Version="1.4.0" />
     <PackageVersion Include="Hangfire.AspNetCore" Version="1.8.7" />

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/Infrastructure/Logging/WebApplicationBuilderExtensions.cs

@@ -0,0 +1,24 @@
+using Serilog;
+using TeachingRecordSystem.Hosting;
+
+namespace TeachingRecordSystem.AuthorizeAccessToATeacherRecord.Infrastructure.Logging;
+
+public static class WebApplicationBuilderExtensions
+{
+    public static WebApplicationBuilder ConfigureLogging(this WebApplicationBuilder builder)
+    {
+        if (builder.Environment.IsProduction())
+        {
+            builder.WebHost.UseSentry(dsn: builder.Configuration.GetRequiredValue("Sentry:Dsn"));
+        }
+
+        builder.Services.AddApplicationInsightsTelemetry();
+
+        // We want all logging to go through Serilog so that our filters are always applied
+        builder.Logging.ClearProviders();
+
+        builder.Host.UseSerilog((ctx, services, config) => config.ConfigureSerilog(ctx.HostingEnvironment, ctx.Configuration, services));
+
+        return builder;
+    }
+}

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/Pages/Index.cshtml

@@ -0,0 +1,6 @@
+@page
+@model TeachingRecordSystem.AuthorizeAccessToATeacherRecord.Pages.IndexModel
+@{
+}
+
+<h1>Hello world</h1>

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/Pages/Index.cshtml.cs

@@ -0,0 +1,10 @@
+using Microsoft.AspNetCore.Mvc.RazorPages;
+
+namespace TeachingRecordSystem.AuthorizeAccessToATeacherRecord.Pages;
+
+public class IndexModel : PageModel
+{
+    public void OnGet()
+    {
+    }
+}

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/Pages/Shared/_Layout.cshtml

@@ -1,3 +1,5 @@
 @{
     Layout = "_GovUkPageTemplate";
 }
+
+@RenderBody()

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/Program.cs

@@ -1,29 +1,66 @@
 using GovUk.Frontend.AspNetCore;
+using Joonasw.AspNetCore.SecurityHeaders;
+using TeachingRecordSystem.AuthorizeAccessToATeacherRecord.Infrastructure.Logging;
+using TeachingRecordSystem.Core;
+using TeachingRecordSystem.ServiceDefaults;
 
 var builder = WebApplication.CreateBuilder(args);
 
+builder.WebHost.ConfigureKestrel(options => options.AddServerHeader = false);
+
+builder.AddServiceDefaults(dataProtectionBlobName: "AuthorizeAccess");
+
+builder.ConfigureLogging();
+
 builder.Services.AddGovUkFrontend();
+builder.Services.AddCsp(nonceByteAmount: 32);
 
-// Add services to the container.
-builder.Services.AddRazorPages();
+builder.Services
+    .AddRazorPages();
 
 var app = builder.Build();
 
-// Configure the HTTP request pipeline.
-if (!app.Environment.IsDevelopment())
+app.MapDefaultEndpoints();
+
+if (app.Environment.IsDevelopment())
+{
+    app.UseDeveloperExceptionPage();
+    app.UseMigrationsEndPoint();
+}
+else if (!app.Environment.IsUnitTests())
 {
-    app.UseExceptionHandler("/Error");
-    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
-    app.UseHsts();
+    app.UseExceptionHandler("/error");
+    app.UseStatusCodePagesWithReExecute("/error", "?code={0}");
 }
 
-app.UseHttpsRedirection();
+app.UseCsp(csp =>
+{
+    var pageTemplateHelper = app.Services.GetRequiredService<PageTemplateHelper>();
+
+    csp.ByDefaultAllow
+        .FromSelf();
+
+    csp.AllowScripts
+        .FromSelf()
+        .From(pageTemplateHelper.GetCspScriptHashes())
+        .AddNonce();
+
+    // Ensure ASP.NET Core's auto refresh works
+    // See https://github.com/dotnet/aspnetcore/issues/33068
+    if (builder.Environment.IsDevelopment())
+    {
+        csp.AllowConnections
+            .ToAnywhere();
+    }
+});
+
 app.UseStaticFiles();
 
 app.UseRouting();
 
 app.UseAuthorization();
 
 app.MapRazorPages();
+app.MapControllers();
 
 app.Run();

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/TeachingRecordSystem.AuthorizeAccessToATeacherRecord.csproj

@@ -6,6 +6,16 @@
 
   <ItemGroup>
     <PackageReference Include="GovUk.Frontend.AspNetCore" />
+    <PackageReference Include="GovUk.OneLogin.AspNetCore" />
+    <PackageReference Include="Joonasw.AspNetCore.SecurityHeaders" />
+    <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" />
+    <PackageReference Include="Sentry.AspNetCore" />
+    <PackageReference Include="Serilog.AspNetCore" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\TeachingRecordSystem.Core\TeachingRecordSystem.Core.csproj" />
+    <ProjectReference Include="..\TeachingRecordSystem.ServiceDefaults\TeachingRecordSystem.ServiceDefaults.csproj" />
   </ItemGroup>
 
 </Project>

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/appsettings.Development.json

@@ -1,9 +1,11 @@
 {
   "DetailedErrors": true,
-  "Logging": {
-    "LogLevel": {
+  "Serilog": {
+    "MinimumLevel": {
       "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
+      "Override": {
+        "Microsoft.AspNetCore": "Warning"
+      }
     }
   }
 }

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/appsettings.Production.json

@@ -0,0 +1,10 @@
+{
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Error",
+      "Override": {
+        "TeachingRecordSystem.SupportUi": "Warning"
+      }
+    }
+  }
+}

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/appsettings.Testing.json

@@ -0,0 +1,10 @@
+{
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Error",
+      "Override": {
+        "Microsoft.AspNetCore": "Fatal"
+      }
+    }
+  }
+}

TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccessToATeacherRecord/appsettings.json

@@ -1,9 +1,12 @@
 {
-  "Logging": {
-    "LogLevel": {
+  "Serilog": {
+    "MinimumLevel": {
       "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
+      "Override": {
+        "Microsoft.AspNetCore": "Warning"
+      }
+    },
+    "Enrich": [ "FromLogContext" ]
   },
   "AllowedHosts": "*"
 }

TeachingRecordSystem/src/TeachingRecordSystem.SupportUi/TeachingRecordSystem.SupportUi.csproj

@@ -9,13 +9,11 @@
   </Target>
 
   <ItemGroup>
-    <PackageReference Include="AspNetCore.HealthChecks.NpgSql" />
     <PackageReference Include="AspNetCore.HealthChecks.Redis" />
     <PackageReference Include="GovUk.Frontend.AspNetCore" />
     <PackageReference Include="Humanizer.Core" />
     <PackageReference Include="Joonasw.AspNetCore.SecurityHeaders" />
     <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" />
-    <PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" />
     <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" />
     <PackageReference Include="Microsoft.Identity.Web" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" />

justfile

@@ -64,6 +64,10 @@ run-api:
 watch-api:
   @cd {{solution-root / "src" / "TeachingRecordSystem.Api"}} && dotnet watch
 
+# Run the AuthorizeAccess project in Development mode and watch for file changes
+watch-authz:
+  @cd {{solution-root / "src" / "TeachingRecordSystem.AuthorizeAccessToATeacherRecord"}} && dotnet watch
+
 # Run the UI project in Development mode and watch for file changes
 watch-ui:
   @cd {{solution-root / "src" / "TeachingRecordSystem.SupportUi"}} && dotnet watch