feat: allow access to values stored in cache from templates

[jgomer2001]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #9115

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The provided code changes focus on the Agama engine and its related components, introducing a new dependency on the jans-core-cache artifact, adding a CacheService dependency to the Page class, improving logging in the MethodInvoker class, and updating the documentation for the Agama framework's flow navigation, UI pages, and assets handling.

Expand for full summary

Summary:

The provided code changes cover several files in the Jans Auth Server project, primarily focused on the Agama engine and its related components. The changes introduce a new dependency on the jans-core-cache artifact, add a CacheService dependency to the Page class, improve logging in the MethodInvoker class, and update the documentation for the Agama framework's flow navigation, UI pages, and assets handling.

From an application security perspective, the changes do not appear to introduce any obvious security vulnerabilities. The addition of the CacheService dependency and the improvements to the MethodInvoker class are reasonable enhancements that can improve the application's performance and reliability. The documentation updates also provide valuable information for developers working with the Agama framework, including details on template security and user input handling.

However, it is important to thoroughly review the implementation of the CacheService and ensure that it does not introduce any security risks, such as improper handling of cached data or potential injection vulnerabilities. Additionally, the use of the 3-parameter variant of the RRF instruction, which can provide a callback URL, should be carefully reviewed to ensure that the callback URL is properly validated and secured to prevent potential open redirect or other attacks.

Overall, the changes in this pull request appear to be routine improvements and do not raise any immediate security concerns. As an application security engineer, I would recommend continuing to monitor the codebase and dependencies for any potential security issues, and to thoroughly test the application to ensure that the changes do not introduce any unintended consequences or vulnerabilities.

Files Changed:

1. jans-auth-server/agama/engine/src/main/java/io/jans/agama/engine/page/Page.java:

   • Added a new dependency, CacheService, to the Page class.
   • Introduced a new static constant CACHE_KEY to store the key for accessing the CacheService instance in the dataModel map.
   • Updated the getDataModel() method to add the CacheService instance to the dataModel map.

2. jans-auth-server/agama/engine/pom.xml:

   • Added a new dependency to the project, jans-core-cache from the io.jans group.

3. jans-auth-server/agama/engine/src/main/java/io/jans/agama/engine/service/MethodInvoker.java:

   • Updated the log message in the candidateMethodEntries method to use the getName() method instead of getClass().getName() to get the class name.

4. docs/admin/developer/agama/flows-navigation-ui.md:

   • Provided a detailed explanation of the Agama framework's flow navigation, UI pages, and assets handling.
   • Highlighted the importance of template security and user input handling.
   • Discussed the potential security implications of the 3-parameter variant of the RRF instruction, which can provide a callback URL.

Code Analysis

We ran 9 analyzers against 4 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding
Authn/Authz Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.