notazof/yavsc
1
1
Fork 0
Code Issues 1 Pull requests Projects 2 Releases 6 Packages Wiki Activity Actions

postit: trailing-slash regression + loopback browser cleanup; identityserver: BC cert loader + SecurityKey

Browse source 
PostIt
- LoginPage renders StatusMessage as a read-only TextBox so the
  text is mouse-selectable and copyable (no copy button).
- LoginPageViewModel exposes ExternalUrl (Authentication.Authority
  with trailing slash stripped) and DiscoveryUrl
  (ExternalUrl + '/.well-known/openid-configuration'). LoginAsync
  surfaces the discovery URL before the call and suffixes it onto
  every error message, so reachability issues are diagnosable by
  pasting the URL into a browser.
- LoopbackBrowser (used for the OIDC redirect listener on desktop)
  now bounds the GetContextAsync wait at 5 minutes and calls both
  Stop() and Close() in the finally, so the listener is always
  released even if the user abandons the flow. Without this, the
  next PostIt launch fails with 'Failed to listen on prefix
  http://127.0.0.1:7890/ because it conflicts with an existing
  registration on the machine.'
- Add LoginPageViewModelTests.LoginAsync_works_when_authority_has_trailing_slash
  to lock in the discovery URL contract.
- Add LoopbackBrowserTests covering both timeout and happy-path
  listener cleanup.

Yavsc.Org
- Drop the CustomEntries['jwks_uri'] override from commit 84160f07.
  IdentityServer8 reserves that key and rejects the override with
  'Discovery custom entry jwks_uri cannot be added, because it
  already exists.' The default /.well-known/openid-configuration/jwks
  endpoint is what DiscoveryKeyEndpoint actually serves.
- Replace X509Certificate2.CreateFromPemFile + the 3-arg
  X509Certificate2(path, key, X509KeyStorageFlags) ctor with a
  BouncyCastle-backed loader. The BCL path raised
  InvalidOperationException during AddSigningCredential and aborted
  the runtime with SIGABRT (code=6/ABRT, libcoreclr.so stack) on
  the production EC Let's Encrypt cert. BouncyCastle 2.6.2
  PemReader accepts PKCS#1 + PKCS#8 EC/RSA PEMs uniformly; RSA
  path uses DotNetUtilities.ToRSA, EC path rebuilds ECDsa from
  ECParameters with the curve dispatched by NIST order bit length
  (256/384/521).
- Switch the signing credential handed to IdentityServer8 from
  X509Certificate2 to a SigningCredentials built from a SecurityKey
  (RsaSecurityKey / ECDsaSecurityKey). The cert loaded fine but
  IdentityServer8's key material service reads cert.PrivateKey at
  runtime — on Linux that handle is not retained across the
  X509Certificate2 / runtime boundary, so CreateJwkDocumentAsync
  raised NullReferenceException on the first GET /jwks. The
  SecurityKey is a pure managed object whose Key is a live
  AsymmetricAlgorithm, which survives every read IdentityServer
  does.
- Add BouncyCastle.Cryptography 2.6.2 to src/Yavsc.Org/Yavsc.Org.csproj
  and the matching PackageVersion in Directory.Packages props.
- Wrap the loader in a try/catch that prints the full managed
  stack to stderr on failure, so future PEM-format issues surface
  in journalctl instead of being hidden behind SIGABRT.
This commit is contained in:
Paul Schneider 2026-06-21 07:30:11 +01:00
commit d62e59ba30
8 changed files with 380 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

77
src/PostIt.Tests/LoginPageViewModelTests.cs
View file

@ -42,6 +42,83 @@ public class LoginPageViewModelTests
$"Login reported error: {vm.StatusMessage}");
}
[Fact]
public async Task LoginAsync_refuses_to_call_OidcClient_when_Authority_is_empty()
{
// Regression: when no user settings file exists and the embedded
// default somehow fails to load (e.g. resource stripped at publish
// time), the ViewModel must NOT hand a blank Authority to
// OidcClient — IdentityModel would build a bogus authorize URL
// like "http://127.0.0.1:1/" which the browser rejects with a
// confusing error. Surface a clear, actionable message instead.
//
// SettingsLoadOverride is set to a no-op so the test fixture's
// pre-loaded Settings object survives the call to LoginAsync.
var settings = new PostIt.Settings
{
Authentication = new AuthenticationSettings
{
Authority = "",
ClientId = "postit-tests",
},
RedirectUri = "http://127.0.0.1:7890/",
Scopes = new[] { "openid" },
};
var browserInvoked = false;
var vm = new LoginPageViewModel(settings, () =>
{
browserInvoked = true;
return null;
})
{
// Skip the disk / embedded read so the Authority stays empty.
SettingsLoadOverride = () => System.Threading.Tasks.Task.CompletedTask,
};
await vm.LoginAsync();
Assert.False(
browserInvoked,
"Browser factory was invoked even though Authority was empty.");
Assert.NotNull(vm.StatusMessage);
Assert.Contains("Configuration manquante", vm.StatusMessage);
Assert.Contains("postit-settings.json", vm.StatusMessage);
Assert.True(string.IsNullOrEmpty(vm.AccessToken));
}
[Fact]
public async Task LoginAsync_works_when_authority_has_trailing_slash()
{
// Regression: with Authority ending in "/" (the production
// postit-settings.json shape for https://yavsc.pschneider.fr/),
// the discovery URL OidcClient computes must NOT contain a
// double slash before /.well-known/openid-configuration. The
// stub advertises itself without the trailing slash; OidcClient
// must bridge.
using var authority = await OidcStubAuthority.StartAsync();
var browser = new FakeAuthorizingBrowser(authority.LoopbackRedirectUri);
var settings = new PostIt.Settings
{
Authentication = new AuthenticationSettings
{
Authority = authority.Issuer + "/",
ClientId = "postit-tests"
},
RedirectUri = authority.LoopbackRedirectUri,
Scopes = new[] { "openid" }
};
var vm = new LoginPageViewModel(settings, browser.CreateBrowser);
await vm.LoginAsync();
Assert.True(
!string.IsNullOrEmpty(vm.AccessToken),
$"Login with trailing slash failed. StatusMessage={vm.StatusMessage ?? "<null>"}");
}
[Fact]
public void RegisterUrl_and_ForgotPasswordUrl_are_derived_from_authority()
{

92
src/PostIt.Tests/LoopbackBrowserTests.cs Normal file
View file

@ -0,0 +1,92 @@
using System.Net;
using System.Net.Sockets;
using PostIt.Services;
namespace PostIt.Tests;
/// <summary>
/// Regression coverage for the loopback browser that PostIt uses to
/// receive the OIDC authorization-code callback on a local port.
/// Specifically: the listener must always be released, even when the
/// flow is abandoned (timeout or caller cancellation). Without this,
/// the next PostIt launch fails with "Failed to listen on prefix
/// http://127.0.0.1:7890/ because it conflicts with an existing
/// registration on the machine."
/// </summary>
public class LoopbackBrowserTests
{
[Fact]
public async Task InvokeAsync_releases_listener_when_no_browser_responds_within_timeout()
{
// Pick a free port for this test (don't reuse 7890 — it could be
// bound by a real PostIt running on the developer's machine).
var port = GetFreePort();
var prefix = $"http://127.0.0.1:{port}/";
var browser = new LoopbackBrowser();
var options = new IdentityModel.OidcClient.Browser.BrowserOptions(
"http://127.0.0.1:1/", // never reached
prefix);
// The internal wait timeout is 5 minutes; we don't want the test
// to actually wait that long. Instead we cancel via the outer
// token and verify the listener is released.
using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
var result = await browser.InvokeAsync(options, cts.Token);
// The cancellation propagates as Timeout because the outer token
// fires first (the test is faster than the 5-minute internal wait).
// We don't care which BrowserResultType is returned here — only
// that the port is free afterwards.
Assert.NotNull(result);
// Critical assertion: the port is free. If the listener leaked,
// a TcpListener binding to the same port would throw.
using var probe = new TcpListener(IPAddress.Loopback, port);
probe.Start();
probe.Stop();
}
[Fact]
public async Task InvokeAsync_releases_listener_when_browser_actually_responds()
{
var port = GetFreePort();
var prefix = $"http://127.0.0.1:{port}/";
var browser = new LoopbackBrowser();
var options = new IdentityModel.OidcClient.Browser.BrowserOptions(
"http://127.0.0.1:1/", // never reached (we respond directly below)
prefix);
// Race the listener against a fake browser callback.
var browserTask = browser.InvokeAsync(options);
// Give the listener a moment to bind.
await Task.Delay(50);
// Simulate the browser returning the redirect with code + state.
using var http = new HttpClient();
var response = await http.GetAsync($"{prefix.TrimEnd('/')}/?code=***&state=***");
// We don't care about the response body; just that the request
// was accepted (otherwise the listener hadn't bound yet).
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
var result = await browserTask;
Assert.Equal(IdentityModel.OidcClient.Browser.BrowserResultType.Success, result.ResultType);
// Listener should be released now.
using var probe = new TcpListener(IPAddress.Loopback, port);
probe.Start();
probe.Stop();
}
private static int GetFreePort()
{
var l = new TcpListener(IPAddress.Loopback, 0);
l.Start();
var port = ((IPEndPoint)l.LocalEndpoint).Port;
l.Stop();
return port;
}
}