yavsc/src/Yavsc.Server/Settings/SiteSettings.cs

77 lines
2.2 KiB
C#
Raw Normal View History

#nullable enable annotations
2019-05-07 14:01:23 +01:00
using Yavsc.Models.Relationship;
2016-05-30 13:53:56 +02:00
namespace Yavsc
2016-05-17 18:22:18 +02:00
{
public class SiteSettings
{
2026-09-17 22:22:18 +01:00
public string Title { get; set; }
2026-09-17 22:22:18 +01:00
public string Slogan { get; set; }
public string Banner { get; set; }
2017-02-21 12:02:12 +01:00
2026-09-17 22:22:18 +01:00
public string StyleSheet { get; set; }
public string FavIcon { get; set; }
public string Logo { get; set; }
/// <summary>
Split Site:Audience into Site:ExternalUrl + Site:CorsAllowedOrigins The Site:Audience setting was conflating two distinct concepts: an OAuth JWT audience (a single resource identifier) and a CORS allow-list (an array of origins). Collapsing them caused several latent bugs: - OAuth/JWT validation expected a single string while CORS WithOrigins accepts an array. - Password-reset callback URLs and OAuth client RedirectUri/Origin were being built from what was meant to be an audience identifier, not a base URL. - Yavsc.Org's main CORS policy was hardcoded to '*', with no way to restrict it without code changes. Changes: - SiteSettings.Audience (string) replaced with CorsAllowedOrigins (IList<string>). - OAuth JWT Authority still reads Site:Authority; Audience now reads Site:ExternalUrl (Org only; Api/Blogs use ValidateAudience=false). - MailSender and AccountController build reset-callback URLs from Site:ExternalUrl. - ClientController uses Site:ExternalUrl for OAuth RedirectUri/Origin defaults on newly created clients. - Yavsc.Api and Yavsc.Blogs now read CORS origins from Site:CorsAllowedOrigins instead of hardcoded URLs. Add shared AddYavscCors / AddYavscJwtBearer extension methods in Yavsc.Server/Helpers/ServiceExtensions.cs to enforce a single configuration contract across all runtime services (Api, Blogs, Org). Fails closed when CorsAllowedOrigins is empty; fails fast at startup when Site:Authority is missing. Remove obsolete ConfigurationHelpers.GetAudience (no remaining callers). Local appsettings-*.json files (which carry deployment-specific values and are gitignored) must be updated to add Site:CorsAllowedOrigins.
2026-06-19 13:15:21 +01:00
/// Origins to allow via the CORS "default" policy.
/// Each entry must be a full origin (scheme + host [+ port]), e.g. "https://app.example.com".
/// </summary>
2026-09-17 22:22:18 +01:00
public IList<string> CorsAllowedOrigins { get; set; }
Split Site:Audience into Site:ExternalUrl + Site:CorsAllowedOrigins The Site:Audience setting was conflating two distinct concepts: an OAuth JWT audience (a single resource identifier) and a CORS allow-list (an array of origins). Collapsing them caused several latent bugs: - OAuth/JWT validation expected a single string while CORS WithOrigins accepts an array. - Password-reset callback URLs and OAuth client RedirectUri/Origin were being built from what was meant to be an audience identifier, not a base URL. - Yavsc.Org's main CORS policy was hardcoded to '*', with no way to restrict it without code changes. Changes: - SiteSettings.Audience (string) replaced with CorsAllowedOrigins (IList<string>). - OAuth JWT Authority still reads Site:Authority; Audience now reads Site:ExternalUrl (Org only; Api/Blogs use ValidateAudience=false). - MailSender and AccountController build reset-callback URLs from Site:ExternalUrl. - ClientController uses Site:ExternalUrl for OAuth RedirectUri/Origin defaults on newly created clients. - Yavsc.Api and Yavsc.Blogs now read CORS origins from Site:CorsAllowedOrigins instead of hardcoded URLs. Add shared AddYavscCors / AddYavscJwtBearer extension methods in Yavsc.Server/Helpers/ServiceExtensions.cs to enforce a single configuration contract across all runtime services (Api, Blogs, Org). Fails closed when CorsAllowedOrigins is empty; fails fast at startup when Site:Authority is missing. Remove obsolete ConfigurationHelpers.GetAudience (no remaining callers). Local appsettings-*.json files (which carry deployment-specific values and are gitignored) must be updated to add Site:CorsAllowedOrigins.
2026-06-19 13:15:21 +01:00
/// <summary>
2025-09-07 17:43:13 +01:00
/// External Url
/// </summary>
/// <value></value>
2026-09-17 22:22:18 +01:00
public string ExternalUrl { get; set; }
2025-09-07 17:43:13 +01:00
/// <summary>
/// Base URL of the API fronting this site.
/// </summary>
2026-09-17 22:22:18 +01:00
public string ApiUrl { get; set; }
/// <summary>
2025-09-07 17:43:13 +01:00
/// Must be a fqdn.
/// </summary>
/// <returns></returns>
2026-09-17 22:22:18 +01:00
public string Authority { get; set; }
2016-11-07 19:34:56 +01:00
/// <summary>
/// Owner's email
/// </summary>
/// <returns></returns>
2026-09-17 22:22:18 +01:00
public StaticContact Owner { get; set; }
2025-03-04 18:05:21 +00:00
2016-11-07 19:34:56 +01:00
/// <summary>
/// Administrator's email
/// </summary>
/// <returns></returns>
2026-09-17 22:22:18 +01:00
public StaticContact Admin { get; set; }
2017-07-03 20:30:00 +02:00
2026-09-17 22:22:18 +01:00
public string DataDir { get; set; }
public string Avatars { get; set; }
2023-03-26 20:41:42 +01:00
public long Quota { get; set; }
2026-09-17 22:22:18 +01:00
public string Blog { get; set; }
public string Bills { get; set; }
public string GitRepository { get; set; }
2016-05-17 18:22:18 +02:00
2016-11-07 19:34:56 +01:00
/// <summary>
/// Specifies the directory where should be
2016-11-07 19:34:56 +01:00
/// generated pdf files using pandoc
/// </summary>
/// <returns>The temporary directory to use</returns>
2026-09-17 22:22:18 +01:00
public string TempDir { get; set; }
2020-10-09 19:35:39 +01:00
/// <summary>
/// Disk usage user list maximum length in memory
/// </summary>
/// <value></value>
2026-09-17 22:22:18 +01:00
public int DUUserListLen { get; set; }
2020-10-09 19:35:39 +01:00
/// <summary>
/// Default acl file name
/// </summary>
/// <value></value>
2026-09-17 22:22:18 +01:00
public string AccessListFileName { get; set; }
2020-10-09 19:35:39 +01:00
2016-05-17 18:22:18 +02:00
}
}