-
Notifications
You must be signed in to change notification settings - Fork 5
Refactor user profile management and add Azure Container Apps support #213
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
indcoder
wants to merge
29
commits into
main
Choose a base branch
from
rf_registrant2user
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
29 commits
Select commit
Hold shift + click to select a range
138b011
♻️Refactor: Introduce UserProfile service & multi-event model
indcoder f62960c
Add Azure Container Apps support to AppHost
indcoder 6854137
Replace registration project restore with user profile
indcoder 2149101
Fix path for UserProfile project restore command
indcoder c79de19
Update dev env and Scalar API config; add ENC0118 note
indcoder 165fa53
Restrict "Schedule Event" button to VisageAdmin users
indcoder 6a875a0
Merge branch 'rf_registrant2user' of github.com:HackerspaceMumbai/Vis…
indcoder f4143ca
Initial plan
Copilot 5ff5ab9
Fix critical security vulnerabilities in authentication and authoriza…
Copilot 749c098
Fix authorization bypass in UserProfile endpoints and use migrations
Copilot 1595d27
Fix frontend/backend inconsistencies and documentation
Copilot 7127758
Align frontend RegistrationStatus enum with backend
Copilot c846821
Document required database migration fixes
Copilot 6cdb530
Fix EventRegistration default status to use Pending
Copilot 16d408b
Add documentation for known limitations and edge cases
Copilot 77f9502
Restore [Required] attribute on GovtId field
Copilot 2730d42
Fix CodeQL security issues: prevent information disclosure
Copilot a1fa7b6
Improve logging security: use proper logger and restrict debug logs
Copilot 8088462
Refine exception handling and JWT validation logic
Copilot 4777314
Merge pull request #214 from HackerspaceMumbai/copilot/fix-code-revie…
indcoder 9b7e555
🧪 ci: refine test selection and remove workload restore
indcoder 53fcb45
chore(🔨):Refactor DB init: dev uses EnsureCreated, prod uses migrate
indcoder be20326
Update services/Visage.Services.Eventing/Program.cs
indcoder fbe06b9
Update tests/Visage.Test.Aspire/QUICKSTART.md
indcoder 320c624
Enhance event reg security, concurrency, and feedback
indcoder 9822221
Update QUICKSTART.md setup instructions formatting
indcoder 1d2b189
Initial plan
Copilot 9f3eaa4
Implement security and data integrity fixes across Eventing and UserP…
Copilot 7074291
Merge pull request #218 from HackerspaceMumbai/copilot/update-event-r…
indcoder File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,178 @@ | ||
| # Database Migration Fixes Required | ||
|
|
||
| ## Overview | ||
| The `InitialUserProfile` migration (20260110145754) has several issues that need to be corrected with a new migration. | ||
|
|
||
| ## Issues Identified in Code Review | ||
|
|
||
| ### 1. Cross-Service Coupling - Event Table | ||
| **Problem**: The UserProfile service migration creates an `Event` table, which should only be managed by the Eventing service. | ||
|
|
||
| **Impact**: | ||
| - Violates microservice boundaries | ||
| - Creates CASCADE delete dependencies across services | ||
| - Causes data synchronization issues | ||
|
|
||
| **Fix**: Remove the Event table from UserProfile database. The EventId in EventRegistrations should be a simple string reference without a foreign key constraint. | ||
|
|
||
| ### 2. Missing Auth0Subject Column in Users Table | ||
| **Problem**: The Users table is missing the `Auth0Subject` column, which is defined in `Visage.Shared.Models.User.cs` with `[StringLength(255)]`. | ||
|
|
||
| **Impact**: | ||
| - Runtime errors when persisting user data | ||
| - Authentication flow breaks | ||
| - Cannot enforce authenticated ownership | ||
|
|
||
| **Fix**: Add `Auth0Subject` column: | ||
| ```sql | ||
| Auth0Subject nvarchar(255) NOT NULL | ||
| ``` | ||
|
|
||
| ### 3. Missing Auth0Subject Column in EventRegistrations Table | ||
| **Problem**: The EventRegistrations table is missing the `Auth0Subject` column, which is defined in `Visage.Shared.Models.EventRegistration.cs`. | ||
|
|
||
| **Impact**: | ||
| - Cannot enforce authenticated ownership for registrations | ||
| - Eventing service EventDB expects this column (see indexes at lines 72-74 of EventDB.cs) | ||
| - Schema mismatch between services | ||
|
|
||
| **Fix**: Add `Auth0Subject` column: | ||
| ```sql | ||
| Auth0Subject nvarchar(255) NOT NULL | ||
| ``` | ||
|
|
||
| ## Recommended Migration Steps | ||
|
|
||
| ### Option 1: Create New Migration (Recommended) | ||
| ```bash | ||
| # Navigate to UserProfile service directory | ||
| cd Visage.Services.UserProfile | ||
|
|
||
| # Enable aspire exec feature | ||
| aspire config set features.execCommandEnabled true | ||
|
|
||
| # Create the migration | ||
| aspire exec --resource userprofile-api --workdir /path/to/Visage.Services.UserProfile -- dotnet ef migrations add FixCrossServiceCouplingAndAuth0Subject | ||
| ``` | ||
|
|
||
| ### Option 2: Manual Migration File | ||
| If EF Core tools are not available, create a new migration file manually: | ||
|
|
||
| **Filename**: `Visage.Services.UserProfile/Migrations/YYYYMMDDHHMMSS_FixCrossServiceCouplingAndAuth0Subject.cs` | ||
|
|
||
| **Up Method**: | ||
| ```csharp | ||
| protected override void Up(MigrationBuilder migrationBuilder) | ||
| { | ||
| // Remove FK constraint from EventRegistrations to Event | ||
| migrationBuilder.DropForeignKey( | ||
| name: "FK_EventRegistrations_Event_EventId", | ||
| table: "EventRegistrations"); | ||
|
|
||
| // Drop the Event table (should only exist in Eventing service) | ||
| migrationBuilder.DropTable( | ||
| name: "Event"); | ||
|
|
||
| // Add Auth0Subject to Users table | ||
| migrationBuilder.AddColumn<string>( | ||
| name: "Auth0Subject", | ||
| table: "Users", | ||
| type: "nvarchar(255)", | ||
| maxLength: 255, | ||
| nullable: false, | ||
| defaultValue: ""); | ||
|
|
||
| // Add Auth0Subject to EventRegistrations table | ||
| migrationBuilder.AddColumn<string>( | ||
| name: "Auth0Subject", | ||
| table: "EventRegistrations", | ||
| type: "nvarchar(255)", | ||
| maxLength: 255, | ||
| nullable: false, | ||
| defaultValue: ""); | ||
| } | ||
| ``` | ||
|
|
||
| **Down Method**: | ||
| ```csharp | ||
| protected override void Down(MigrationBuilder migrationBuilder) | ||
| { | ||
| // Remove Auth0Subject columns | ||
| migrationBuilder.DropColumn( | ||
| name: "Auth0Subject", | ||
| table: "EventRegistrations"); | ||
|
|
||
| migrationBuilder.DropColumn( | ||
| name: "Auth0Subject", | ||
| table: "Users"); | ||
|
|
||
| // Recreate Event table | ||
| migrationBuilder.CreateTable( | ||
| name: "Event", | ||
| columns: table => new | ||
| { | ||
| Id = table.Column<string>(type: "nchar(26)", fixedLength: true, maxLength: 26, nullable: false), | ||
| Title = table.Column<string>(type: "nvarchar(100)", maxLength: 100, nullable: false), | ||
| Type = table.Column<string>(type: "nvarchar(50)", maxLength: 50, nullable: true), | ||
| Description = table.Column<string>(type: "nvarchar(2000)", maxLength: 2000, nullable: true), | ||
| StartDate = table.Column<DateOnly>(type: "date", nullable: false), | ||
| StartTime = table.Column<TimeOnly>(type: "time", nullable: false), | ||
| EndDate = table.Column<DateOnly>(type: "date", nullable: false), | ||
| EndTime = table.Column<TimeOnly>(type: "time", nullable: false), | ||
| Location = table.Column<string>(type: "nvarchar(500)", maxLength: 500, nullable: true), | ||
| CoverPicture = table.Column<string>(type: "nvarchar(500)", maxLength: 500, nullable: true), | ||
| AttendeesPercentage = table.Column<decimal>(type: "decimal(18,2)", nullable: true), | ||
| Hashtag = table.Column<string>(type: "nvarchar(100)", maxLength: 100, nullable: true), | ||
| Theme = table.Column<string>(type: "nvarchar(200)", maxLength: 200, nullable: true) | ||
| }, | ||
| constraints: table => | ||
| { | ||
| table.PrimaryKey("PK_Event", x => x.Id); | ||
| }); | ||
|
|
||
| // Recreate FK constraint | ||
| migrationBuilder.AddForeignKey( | ||
| name: "FK_EventRegistrations_Event_EventId", | ||
| table: "EventRegistrations", | ||
| column: "EventId", | ||
| principalTable: "Event", | ||
| principalColumn: "Id", | ||
| onDelete: ReferentialAction.Cascade); | ||
| } | ||
| ``` | ||
|
|
||
| ## Testing After Migration | ||
|
|
||
| 1. Verify the migration applies successfully: | ||
| ```bash | ||
| aspire exec --resource userprofile-api --workdir /path/to/Visage.Services.UserProfile -- dotnet ef database update | ||
| ``` | ||
|
|
||
| 2. Run integration tests: | ||
| ```bash | ||
| dotnet test tests/Visage.Test.Aspire/Visage.Test.Aspire.csproj | ||
| ``` | ||
|
|
||
| 3. Verify User creation works with Auth0Subject: | ||
| ```bash | ||
| # Test the POST /api/users endpoint with Auth0 authentication | ||
| ``` | ||
|
|
||
| 4. Verify Event registration works: | ||
| ```bash | ||
| # Test the POST /api/registrations endpoint | ||
| ``` | ||
|
|
||
| ## Related Files | ||
| - `/home/runner/work/Visage/Visage/Visage.Services.UserProfile/Migrations/20260110145754_InitialUserProfile.cs` | ||
| - `/home/runner/work/Visage/Visage/Visage.Shared/Models/User.cs` (line 22: Auth0Subject property) | ||
| - `/home/runner/work/Visage/Visage/Visage.Shared/Models/EventRegistration.cs` (line 35: Auth0Subject property) | ||
| - `/home/runner/work/Visage/Visage/services/Visage.Services.Eventing/EventDB.cs` (lines 72-74: Auth0Subject indexes) | ||
|
|
||
| ## Status | ||
| ⚠️ **Action Required**: These database schema changes cannot be completed in this environment due to missing EF Core tooling. They need to be applied in the actual development environment where: | ||
| - EF Core tools are installed | ||
| - Aspire CLI is available | ||
| - Database connections are configured | ||
|
|
||
| All other code review suggestions have been addressed in the current PR. |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 1950
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 50
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 2010
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 1152
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 1465
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 50
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 298
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 737
🏁 Script executed:
Repository: HackerspaceMumbai/Visage
Length of output: 1137
Replace
--treenode-filterwith--filterfor TUnit compatibility.TUnit uses
--filter "Category=<value>"syntax, not--treenode-filter. The test framework is TUnit 1.5.70, and the categories (Smoke,RequiresAuth) exist in the codebase. The--projectflag is valid. However, the filter command will fail or silently skip filtering with the current syntax.Corrected filter syntax
Also applies to: 65-66 (replace
--treenode-filter "/*/*/*/*[Category=RequiresAuth]"with--filter "Category=RequiresAuth")🤖 Prompt for AI Agents