Activity protection

Directory.Build.props

@@ -11,5 +11,6 @@
       from without conflicting names.
     -->
     <UseProjectNamespaceForGitVersionInformation>true</UseProjectNamespaceForGitVersionInformation>
+    <NoWarn>NU1701, NU1901, NU1902</NoWarn>
   </PropertyGroup>
 </Project>

src/Yavsc.Api/Controllers/Business/ActivityApiController.cs

@@ -15,7 +15,6 @@ namespace Yavsc.Controllers
 {
     [Produces("application/json")]
     [Route("api/activity")]
-    [AllowAnonymous]
     public class ActivityApiController : Controller
     {
         private ApplicationDbContext _context;
@@ -88,7 +87,7 @@ namespace Yavsc.Controllers
         }
 
         // POST: api/ActivityApi
-        [HttpPost,Authorize("AdministratorOnly")]
+        [HttpPost, Authorize("AdministratorOnly")]
         public async Task<IActionResult> PostActivity([FromBody] Activity activity)
         {
             if (!ModelState.IsValid)

src/Yavsc.Api/Controllers/NativeConfidentialController.cs

@@ -1,15 +1,15 @@
 
-using System;
+
-using System.Linq;
 using System.Security.Claims;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.Logging;
+
-using Yavsc.Helpers;
 using Yavsc.Models;
 using Yavsc.Models.Identity;
 using Yavsc.Server.Helpers;
 
+#nullable enable
+
 [Authorize, Route("~/api/gcm")]
 public class NativeConfidentialController : Controller
 {

src/Yavsc.Blogs.Tests/BlogApiTests.cs

@@ -148,6 +148,38 @@ public sealed class BlogApiTests : IClassFixture<BlogsWebServerFixture>
         Assert.Equal(created.Id, doc.RootElement[0].GetProperty("id").GetInt64());
     }
 
+    [Fact]
+    public async Task PostBlog_sets_AuthorId_on_created_post_and_list_entry()
+    {
+        ResetDatabase();
+        using var http = NewClient(subject: "tester");
+
+        var draft = new BlogPost
+        {
+            Id = 0,
+            Title = "Billet avec auteur",
+            AuthorId = "payload-attacker",
+            Article = "Contenu de test.",
+            DateCreated = DateTime.UtcNow,
+            DateModified = DateTime.UtcNow
+        };
+
+        var postResponse = await http.PostAsJsonAsync("/api/v1/blog", draft);
+        Assert.Equal(HttpStatusCode.Created, postResponse.StatusCode);
+
+        var created = await postResponse.Content.ReadFromJsonAsync<BlogPost>();
+        Assert.NotNull(created);
+        Assert.Equal("tester", created!.AuthorId);
+
+        var listResponse = await http.GetAsync("/api/v1/blog");
+        Assert.Equal(HttpStatusCode.OK, listResponse.StatusCode);
+
+        using var doc = JsonDocument.Parse(await listResponse.Content.ReadAsStringAsync());
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.Equal(1, doc.RootElement.GetArrayLength());
+        Assert.Equal("tester", doc.RootElement[0].GetProperty("authorId").GetString());
+    }
+
     [Fact]
     public async Task GetBlog_returns_401_when_no_token_is_provided()
     {

src/Yavsc.Org/Extensions/HostingExtensions.cs

@@ -1189,6 +1189,8 @@ ADD COLUMN IF NOT EXISTS ""Moderated"" boolean NOT NULL DEFAULT FALSE;");
         }
     }
 
+#nullable enable
+
     static void LoadGoogleConfig(IConfigurationRoot configuration)
     {
         string? googleClientFile = configuration["Authentication:Google:GoogleWebClientJson"];
@@ -1204,6 +1206,7 @@ ADD COLUMN IF NOT EXISTS ""Moderated"" boolean NOT NULL DEFAULT FALSE;");
             Config.GServiceAccount = JsonConvert.DeserializeObject<GoogleServiceAccount>(safile.OpenText().ReadToEnd());
         }
     }
+#nullable disable
 
     public static IApplicationBuilder ConfigureFileServerApp(this IApplicationBuilder app,
                 bool enableDirectoryBrowsing = false)