notazof/yavsc
1
0
Fork 0
Code Issues Pull requests Projects 1 Releases 3 Packages Wiki Activity Actions

Seed ApiResources + ApiResourceScopes, run seeder on every startup

Browse source 
The previous commit (37440171) added ApiScope rows for the
application scopes (admin, moderation, performer, client, blogs).
It was a partial fix: an ApiScope alone is not a valid scope from
DefaultResourceValidator's point of view. The validator only
recognises a scope if it can find an ApiResource that exposes it
(via ApiResourceScopes). Without that link, /connect/authorize
rejects the request with 'Scope X not found in store', even
though the scope row exists. This is what killed the PostIt login
in production.

This commit:

1. Extends Constants.ApiResourcesScopes with ResourceName +
   ResourceDisplayName. Topology: one ApiResource per scope
   ('admin' resource exposes 'admin' scope, 'blogs' resource
   exposes 'blogs' scope, etc.) — keeps each scope's audience
   specific if/when we split products across separate audiences.

2. Ensures EnsureDefaultApplicationScopes also inserts the
   matching ApiResource rows (deduped on Name) and ApiResourceScope
   rows linking each resource to its scope. Idempotent: missing
   rows are added, nothing is removed.

3. Removes the b.UseSeeding(...) call inside AddConfigurationStore.
   EF Core's UseSeeding callback only fires when the database is
   empty, so on a live ConfigurationDb (which already had Clients
   and ClientScopes) it never ran — that is why the previous commit
   had no visible effect on production. The seeder is now invoked
   explicitly from MigrateDatabase via SeedConfigurationDatabase,
   which resolves ConfigurationDbContext from the DI and runs
   EnsureDefaultConfiguration on every startup, regardless of
   whether the database was fresh.

   Seeding failures are caught and logged (best-effort) so a
   misconfigured seeder cannot prevent the host from booting.

Live data on yavsc.pschneider.fr is still missing the
ApiResource/ApiResourceScope rows; a one-shot SQL or a redeploy
with this commit is needed before PostIt can log in. Production
fix to follow.
This commit is contained in:
Paul Schneider 2026-06-25 21:28:13 +01:00
commit be334a69dc
2 changed files with 119 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/Yavsc.Org/Contants.cs
View file

@ -8,13 +8,20 @@ public static class Constants
"profile", "openid", "offline_access",
"admin", "moderation", "performer", "client" };
// One ApiResource per application scope. Each scope is exposed by
// exactly one resource, named after the scope ("admin" -> "admin"
// resource, "blogs" -> "blogs" resource). IdentityServer8's
// DefaultResourceValidator only recognises a scope at the
// /connect/authorize endpoint if it can find an ApiResource that
// exposes it — an orphaned ApiScope row is rejected with
// "Scope X not found in store" even though the row exists.
public static readonly ApiResourceScopeSpecification[] ApiResourcesScopes = {
new ApiResourceScopeSpecification { ScopeName = "admin", Description = "Admin access" },
new ApiResourceScopeSpecification { ScopeName = "moderation", Description = "Moderation access" },
new ApiResourceScopeSpecification { ScopeName = "performer", Description = "Performer access" },
new ApiResourceScopeSpecification { ScopeName = "client", Description = "Client access" },
new ApiResourceScopeSpecification { ScopeName = "blogs", Description = "Blogs access" }
new ApiResourceScopeSpecification { ScopeName = "admin", Description = "Admin access", ResourceName = "admin", ResourceDisplayName = "Admin API" },
new ApiResourceScopeSpecification { ScopeName = "moderation", Description = "Moderation access", ResourceName = "moderation", ResourceDisplayName = "Moderation API" },
new ApiResourceScopeSpecification { ScopeName = "performer", Description = "Performer access", ResourceName = "performer", ResourceDisplayName = "Performer API" },
new ApiResourceScopeSpecification { ScopeName = "client", Description = "Client access", ResourceName = "client", ResourceDisplayName = "Client API" },
new ApiResourceScopeSpecification { ScopeName = "blogs", Description = "Blogs access", ResourceName = "blogs", ResourceDisplayName = "Yavsc Blogs API" }
};
}
@ -22,4 +29,9 @@ public class ApiResourceScopeSpecification
{
public string ScopeName { get; set; }
public string Description { get; set; }
// The ApiResource that exposes this scope. IdentityServer8 requires
// scopes to be linked back to an ApiResource via the ApiResourceScopes
// table — without that link the scope is considered unknown.
public string ResourceName { get; set; }
public string ResourceDisplayName { get; set; }
}