Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add FAPI validations for DCR #2178

Merged
merged 43 commits into from
Oct 25, 2023
Merged

Add FAPI validations for DCR #2178

merged 43 commits into from
Oct 25, 2023

Conversation

SachiniSiriwardene
Copy link
Contributor

@SachiniSiriwardene SachiniSiriwardene commented Oct 3, 2023 •
edited by madurangasiriwardena
Loading

Proposed changes in this pull request

Issue : wso2/product-is#16841

When should this PR be merged

[Please describe any preconditions that need to be addressed before we
can merge this pull request.]

Follow up actions

[List any possible follow-up actions here; for instance, testing data
migrations, software that we need to install on staging and production
environments.]

Checklist (for reviewing)

General

  • Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
  • Is the PR labeled correctly?

Functionality

  • Are all requirements met? Compare implemented functionality with the requirements specification.
  • Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

  • Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
  • Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
  • Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

  • Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
  • If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
  • If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

  • Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
  • Are all UI and API inputs run through forms or serializers?
  • Are all external inputs validated and sanitized appropriately?
  • Does all branching logic have a default case?
  • Does this solution handle outliers and edge cases gracefully?
  • Are all external communications secured and restricted to SSL?

Documentation

  • Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
  • Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
  • Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

lalaji
lalaji reviewed Oct 6, 2023
View reviewed changes
...identity.oauth.dcr/src/main/java/org/wso2/carbon/identity/oauth/dcr/service/DCRMService.java Outdated
try {
signedJWT = SignedJWT.parse(softwareStatement);
} catch (ParseException e) {
throw new DCRMClientException(DCRMConstants.ErrorCodes.INVALID_SOFTWARE_STATEMENT,
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

e is missing.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed in 6ee33bb

@SachiniSiriwardene
add fapi compliant property to service provider
2e64b9e
@SachiniSiriwardene
add unit tests for signature validation
6dafaf8
@SachiniSiriwardene
Merge branch 'master' of https://github.com/wso2-extensions/identity-…
aacab81 
…inbound-auth-oauth into master_DCR_Validations
@SachiniSiriwardene
fix pr comments
6b66a41
@SachiniSiriwardene
refactor error handling
54a629e
@SachiniSiriwardene
Merge branch 'master' of https://github.com/wso2-extensions/identity-…
6a3a108 
…inbound-auth-oauth into master_DCR_Validations

� Conflicts:
�	components/org.wso2.carbon.identity.oauth.common/src/main/java/org/wso2/carbon/identity/oauth/common/OAuthConstants.java
@SachiniSiriwardene
check FAPI validation enabled for DCR
5f0f8d4
@SachiniSiriwardene
refactor code
1bf041a
@SachiniSiriwardene
refactor code
63f8978
@SachiniSiriwardene
Merge branch 'master' of https://github.com/wso2-extensions/identity-…
5bfc80f 
…inbound-auth-oauth into master_DCR_Validations

� Conflicts:
�	components/org.wso2.carbon.identity.oauth.common/src/main/java/org/wso2/carbon/identity/oauth/common/OAuthConstants.java
�	components/org.wso2.carbon.identity.oauth.dcr/src/test/java/org/wso2/carbon/identity/oauth/dcr/service/DCRMServiceTest.java
�	components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthAdminServiceImpl.java
@SachiniSiriwardene
Merge branch 'master' of https://github.com/wso2-extensions/identity-…
df951e1 
…inbound-auth-oauth into master_DCR_Validations
@SachiniSiriwardene
add changes to send ssa in response
b7afd8d
@SachiniSiriwardene SachiniSiriwardene mentioned this pull request Oct 19, 2023
Merged
janakamarasena
janakamarasena reviewed Oct 25, 2023
View reviewed changes
...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthAdminServiceImpl.java Outdated
Comment on lines 2402 to 2408
if (application.getCallbackUrl().startsWith(
OAuthConstants.CALLBACK_URL_REGEXP_PREFIX)) {
String redirectURI = application.getCallbackUrl();
redirectURI = redirectURI.substring(redirectURI.indexOf("(") + 1,
redirectURI.indexOf(")"));
callBackURIList = Arrays.asList(redirectURI.split("\\|"));
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern could contain complete regexes can this logic handle that without breaking?

@jenkins-is-staging
Copy link

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/6640322157

@jenkins-is-staging
Copy link

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6640322157
Status: success

jenkins-is-staging
jenkins-is-staging approved these changes Oct 25, 2023
View reviewed changes
Copy link

@jenkins-is-staging jenkins-is-staging left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/6640322157

@janakamarasena janakamarasena merged commit ad689f1 into wso2-extensions:master Oct 25, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lalaji lalaji lalaji left review comments

@madurangasiriwardena madurangasiriwardena madurangasiriwardena left review comments

@jenkins-is-staging jenkins-is-staging jenkins-is-staging approved these changes

@janakamarasena janakamarasena janakamarasena approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@SachiniSiriwardene @jenkins-is-staging @madurangasiriwardena @lalaji @janakamarasena