yavsc/src/Yavsc.Server/Settings/SiteSettings.cs

88 lines
2.8 KiB
C#
Raw Normal View History

2019-05-07 14:01:23 +01:00
using Yavsc.Models.Relationship;
2016-05-30 13:53:56 +02:00
namespace Yavsc
2016-05-17 18:22:18 +02:00
{
public class SiteSettings
{
2025-03-04 18:05:21 +00:00
public string Title { get; set; } = "Yavsc";
2025-07-09 11:17:16 +01:00
2025-03-04 18:05:21 +00:00
public string Slogan { get; set; } = "";
2025-07-09 13:16:01 +01:00
public string Banner { get; set; } = "";
2017-02-21 12:02:12 +01:00
2025-03-04 18:05:21 +00:00
public string StyleSheet { get; set; } = "site.css";
public string FavIcon { get; set; } = "favicon.ico";
public string Logo { get; set; } = "logo.png";
/// <summary>
Split Site:Audience into Site:ExternalUrl + Site:CorsAllowedOrigins The Site:Audience setting was conflating two distinct concepts: an OAuth JWT audience (a single resource identifier) and a CORS allow-list (an array of origins). Collapsing them caused several latent bugs: - OAuth/JWT validation expected a single string while CORS WithOrigins accepts an array. - Password-reset callback URLs and OAuth client RedirectUri/Origin were being built from what was meant to be an audience identifier, not a base URL. - Yavsc.Org's main CORS policy was hardcoded to '*', with no way to restrict it without code changes. Changes: - SiteSettings.Audience (string) replaced with CorsAllowedOrigins (IList<string>). - OAuth JWT Authority still reads Site:Authority; Audience now reads Site:ExternalUrl (Org only; Api/Blogs use ValidateAudience=false). - MailSender and AccountController build reset-callback URLs from Site:ExternalUrl. - ClientController uses Site:ExternalUrl for OAuth RedirectUri/Origin defaults on newly created clients. - Yavsc.Api and Yavsc.Blogs now read CORS origins from Site:CorsAllowedOrigins instead of hardcoded URLs. Add shared AddYavscCors / AddYavscJwtBearer extension methods in Yavsc.Server/Helpers/ServiceExtensions.cs to enforce a single configuration contract across all runtime services (Api, Blogs, Org). Fails closed when CorsAllowedOrigins is empty; fails fast at startup when Site:Authority is missing. Remove obsolete ConfigurationHelpers.GetAudience (no remaining callers). Local appsettings-*.json files (which carry deployment-specific values and are gitignored) must be updated to add Site:CorsAllowedOrigins.
2026-06-19 13:15:21 +01:00
/// Origins to allow via the CORS "default" policy.
/// Each entry must be a full origin (scheme + host [+ port]), e.g. "https://app.example.com".
/// </summary>
Split Site:Audience into Site:ExternalUrl + Site:CorsAllowedOrigins The Site:Audience setting was conflating two distinct concepts: an OAuth JWT audience (a single resource identifier) and a CORS allow-list (an array of origins). Collapsing them caused several latent bugs: - OAuth/JWT validation expected a single string while CORS WithOrigins accepts an array. - Password-reset callback URLs and OAuth client RedirectUri/Origin were being built from what was meant to be an audience identifier, not a base URL. - Yavsc.Org's main CORS policy was hardcoded to '*', with no way to restrict it without code changes. Changes: - SiteSettings.Audience (string) replaced with CorsAllowedOrigins (IList<string>). - OAuth JWT Authority still reads Site:Authority; Audience now reads Site:ExternalUrl (Org only; Api/Blogs use ValidateAudience=false). - MailSender and AccountController build reset-callback URLs from Site:ExternalUrl. - ClientController uses Site:ExternalUrl for OAuth RedirectUri/Origin defaults on newly created clients. - Yavsc.Api and Yavsc.Blogs now read CORS origins from Site:CorsAllowedOrigins instead of hardcoded URLs. Add shared AddYavscCors / AddYavscJwtBearer extension methods in Yavsc.Server/Helpers/ServiceExtensions.cs to enforce a single configuration contract across all runtime services (Api, Blogs, Org). Fails closed when CorsAllowedOrigins is empty; fails fast at startup when Site:Authority is missing. Remove obsolete ConfigurationHelpers.GetAudience (no remaining callers). Local appsettings-*.json files (which carry deployment-specific values and are gitignored) must be updated to add Site:CorsAllowedOrigins.
2026-06-19 13:15:21 +01:00
public IList<string> CorsAllowedOrigins { get; set; } = new List<string>
{
"https://localhost:5001"
};
/// <summary>
2025-09-07 17:43:13 +01:00
/// External Url
/// </summary>
/// <value></value>
public string ExternalUrl { get; set; } = "http://lua.pschneider.fr";
/// <summary>
/// Must be a fqdn.
/// </summary>
/// <returns></returns>
2025-03-04 18:05:21 +00:00
public string Authority { get; set; } = "lua.pschneider.fr";
2016-11-07 19:34:56 +01:00
/// <summary>
/// Owner's email
/// </summary>
/// <returns></returns>
2025-03-04 18:05:21 +00:00
public StaticContact Owner { get; set; } = new StaticContact
{
EMail = "root@lua.pschneider.fr",
Name = "Root"
} ;
2016-11-07 19:34:56 +01:00
/// <summary>
/// Administrator's email
/// </summary>
/// <returns></returns>
2025-03-04 18:05:21 +00:00
public StaticContact Admin { get; set; } = new StaticContact
{
EMail = "root@lua.pschneider.fr",
Name = "Root"
} ;
2017-07-03 20:30:00 +02:00
2025-03-04 18:05:21 +00:00
public string DataDir { get; set; } = "data";
2023-03-26 20:41:42 +01:00
public string Avatars { get; set; } = "avatars";
public long Quota { get; set; }
public string Blog { get; set; } = "blogs";
public string Bills { get; set; } = "bills";
public string GitRepository { get; set; } = "sources";
2016-05-17 18:22:18 +02:00
2025-03-04 18:05:21 +00:00
public string BusinessName { get; set; } = "Yavsc";
public string? Street { get; set; }
public string? PostalCode { get; set; }
public string? CountryCode { get; set; }
2017-05-30 23:42:04 +02:00
2025-03-04 18:05:21 +00:00
public string HomeViewName { get; set; } = "Home";
2016-11-07 19:34:56 +01:00
/// <summary>
/// Specifies the directory where should be
2016-11-07 19:34:56 +01:00
/// generated pdf files using pandoc
/// </summary>
/// <returns>The temporary directory to use</returns>
2023-03-26 20:41:42 +01:00
public string TempDir { get; set; } = "temp";
2020-10-09 19:35:39 +01:00
/// <summary>
/// Disk usage user list maximum length in memory
/// </summary>
/// <value></value>
public int DUUserListLen { get; set; } = 256;
/// <summary>
/// Default acl file name
/// </summary>
/// <value></value>
public string AccessListFileName { get; set; } = ".access";
2016-05-17 18:22:18 +02:00
}
}