DMED-119 - Spike: direktes Einbinden der edu-sharing-Suchumgebung in den "Lern-Store" der SVS

ansible/roles/schulcloud-server-core/tasks/main.yml

@@ -22,6 +22,12 @@
     tags:
       - service
 
+  - name: Edu Sharing Service
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      template: api-edu-sharing-svc.yml.j2
+
   - name: FwuLearningContentsService
     kubernetes.core.k8s:
       kubeconfig: ~/.kube/config
@@ -193,6 +199,19 @@
     tags:
       - ingress
 
+  - name: Edu Sharing Deployment
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      template: api-edu-sharing-deployment.yml.j2
+
+  - name: Edu Sharing Ingress
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      template: api-edu-sharing-ingress.yml.j2
+      apply: yes
+
   - name: FwuLearningContentsDeployment
     kubernetes.core.k8s:
       kubeconfig: ~/.kube/config

ansible/roles/schulcloud-server-core/templates/admin-api-server-configmap.yml.j2

@@ -21,3 +21,7 @@ data:
   IDENTITY_MANAGEMENT__EXTERNAL_URI: "{{ IDENTITY_MANAGEMENT__EXTERNAL_URI }}"
   IDENTITY_MANAGEMENT__TENANT: "{{ IDENTITY_MANAGEMENT__TENANT }}"
   IDENTITY_MANAGEMENT__CLIENTID: "{{ IDENTITY_MANAGEMENT__CLIENTID }}"
+  EDU_SHARING__APP_ID: "{{ EDU_SHARING__APP_ID }}"
+  EDU_SHARING__API_URL: "{{ EDU_SHARING__API_URL }}"
+  EDU_SHARING_CONNECT_SRC_URLS: "{{ EDU_SHARING_CONNECT_SRC_URLS }}"
+  EDU_SHARING_IMG_SRC_URLS: "{{ EDU_SHARING_IMG_SRC_URLS }}"

ansible/roles/schulcloud-server-core/templates/api-edu-sharing-deployment.yml.j2

@@ -0,0 +1,123 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api-edu-sharing-deployment
+  namespace: {{ NAMESPACE }}
+  labels:
+    app: api-edu-sharing
+    app.kubernetes.io/part-of: schulcloud-verbund
+    app.kubernetes.io/version: {{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+    app.kubernetes.io/name: api-edu-sharing
+    app.kubernetes.io/component: edu-sharing
+    app.kubernetes.io/managed-by: ansible
+    git.branch: {{ SCHULCLOUD_SERVER_BRANCH_NAME }}
+    git.repo: {{ SCHULCLOUD_SERVER_REPO_NAME }}
+spec:
+  replicas: {{ API_EDU_SHARING_REPLICAS|default("1", true) }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      #maxUnavailable: 1
+  revisionHistoryLimit: 4
+  paused: false
+  selector:
+    matchLabels:
+      app: api-edu-sharing
+  template:
+    metadata:
+      labels:
+        app: api-edu-sharing
+        app.kubernetes.io/part-of: schulcloud-verbund
+        app.kubernetes.io/version: {{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+        app.kubernetes.io/name: api-edu-sharing
+        app.kubernetes.io/component: edu-sharing
+        app.kubernetes.io/managed-by: ansible
+        git.branch: {{ SCHULCLOUD_SERVER_BRANCH_NAME }}
+        git.repo: {{ SCHULCLOUD_SERVER_REPO_NAME }}
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        runAsNonRoot: true
+      containers:
+      - name: api-edu-sharing
+        image: {{ SCHULCLOUD_SERVER_IMAGE }}:{{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 4450
+          name: api-edu-sharing
+          protocol: TCP
+        envFrom:
+        - configMapRef:
+            name: api-configmap
+        - secretRef:
+            name: api-secret
+        command: ['npm', 'run', 'nest:start:edu-sharing:prod']
+        readinessProbe:
+          httpGet:
+            path: api/v3/docs
+            port: 4450
+          timeoutSeconds: 4
+          failureThreshold: 3
+          periodSeconds: 5
+        # liveless if unsatisfactory reply
+        livenessProbe:
+          httpGet:
+            path: api/v3/docs
+            port: 4450
+          timeoutSeconds: 4
+          failureThreshold: 3
+          periodSeconds: 15
+        startupProbe:
+          httpGet:
+            path: api/v3/docs
+            port: 4450
+          timeoutSeconds: 4
+          failureThreshold:  36
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: {{ API_EDU_SHARING_CPU_LIMITS|default("2000m", true) }}
+            memory: {{ API_EDU_SHARING_MEMORY_LIMITS|default("500Mi", true) }}
+          requests:
+            cpu: {{ API_EDU_SHARING_CPU_REQUESTS|default("100m", true) }}
+            memory: {{ API_EDU_SHARING_MEMORY_REQUESTS|default("50Mi", true) }}
+{% if AFFINITY_ENABLE is defined and AFFINITY_ENABLE|bool %}
+      affinity:
+        podAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 9
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/part-of
+                  operator: In
+                  values:
+                  - schulcloud-verbund
+              topologyKey: "kubernetes.io/hostname"
+              namespaceSelector: {}
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+{% if ANIT_AFFINITY_NODEPOOL_ENABLE is defined and ANIT_AFFINITY_NODEPOOL_ENABLE|bool %}
+          - weight: 10
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - api-edu-sharing
+              topologyKey: {{ ANIT_AFFINITY_NODEPOOL_TOPOLOGY_KEY }}
+{% endif %}
+          - weight: 20
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - api-edu-sharing
+              topologyKey: "topology.kubernetes.io/zone"
+{% endif %}

ansible/roles/schulcloud-server-core/templates/api-edu-sharing-ingress.yml.j2

@@ -0,0 +1,42 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ NAMESPACE }}-api-edu-sharing-ingress
+  namespace: {{ NAMESPACE }}
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "{{ TLS_ENABLED|default("false") }}"
+    nginx.ingress.kubernetes.io/proxy-body-size: "{{ INGRESS_MAX_BODY_SIZE|default("2560") }}m"
+    nginx.org/client-max-body-size: "{{ INGRESS_MAX_BODY_SIZE|default("2560") }}m"
+    # The following properties added with BC-3606.
+    # The header size of the request is too big. For e.g. state and the permanent growing jwt.
+    # Nginx throws away the Location header, resulting in the 502 Bad Gateway.
+    nginx.ingress.kubernetes.io/client-header-buffer-size: 100k
+    nginx.ingress.kubernetes.io/http2-max-header-size: 96k
+    nginx.ingress.kubernetes.io/large-client-header-buffers: 4 100k
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 96k
+    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
+{% if CLUSTER_ISSUER is defined %}
+    cert-manager.io/cluster-issuer: {{ CLUSTER_ISSUER }}
+{% endif %}
+
+spec:
+  ingressClassName: {{ INGRESS_CLASS }}
+{% if CLUSTER_ISSUER is defined or (TLS_ENABLED is defined and TLS_ENABLED|bool) %}
+  tls:
+  - hosts:
+      - {{ DOMAIN }}
+{% if CLUSTER_ISSUER is defined %}
+    secretName: {{ DOMAIN }}-tls
+{% endif %}
+{% endif %}
+  rules:
+  - host: {{ DOMAIN }}
+    http:
+      paths:
+      - path: /api/v3/edu-sharing/
+        backend:
+          service:
+            name: api-edu-sharing-svc
+            port:
+              number: {{ PORT_EDU_SHARING_SERVICE }}
+        pathType: Prefix

ansible/roles/schulcloud-server-core/templates/api-edu-sharing-svc.yml.j2

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-edu-sharing-svc
+  namespace: {{ NAMESPACE }}
+  labels:
+    app: api-edu-sharing
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ PORT_EDU_SHARING_SERVICE }}
+      targetPort: 4450
+      protocol: TCP
+      name: api-edu-sharing
+  selector:
+    app: api-edu-sharing

apps/server/src/apps/edu-sharing.app.ts

@@ -0,0 +1,55 @@
+/* istanbul ignore file */
+/* eslint-disable no-console */
+import { NestFactory } from '@nestjs/core';
+import { ExpressAdapter } from '@nestjs/platform-express';
+import express from 'express';
+
+// register source-map-support for debugging
+import { install as sourceMapInstall } from 'source-map-support';
+
+// application imports
+import { EduSharingApiModule } from '@modules/edu-sharing/edu-sharing-api.module';
+import { API_VERSION_PATH } from '@modules/edu-sharing/edu-sharing.const';
+import { SwaggerDocumentOptions } from '@nestjs/swagger';
+import { LegacyLogger } from '@src/core/logger';
+import { enableOpenApiDocs } from '@src/shared/controller/swagger';
+
+async function bootstrap() {
+	sourceMapInstall();
+
+	// create the NestJS application on a seperate express instance
+	const nestExpress = express();
+
+	const nestExpressAdapter = new ExpressAdapter(nestExpress);
+	const nestApp = await NestFactory.create(EduSharingApiModule, nestExpressAdapter);
+
+	// WinstonLogger
+	nestApp.useLogger(await nestApp.resolve(LegacyLogger));
+
+	// customize nest app settings
+	nestApp.enableCors({ exposedHeaders: ['Content-Disposition'] });
+
+	const options: SwaggerDocumentOptions = {
+		operationIdFactory: (_controllerKey: string, methodKey: string) => methodKey,
+	};
+	enableOpenApiDocs(nestApp, 'docs', options);
+
+	await nestApp.init();
+
+	// mount instances
+	const rootExpress = express();
+
+	const port = 4450;
+	const basePath = API_VERSION_PATH;
+
+	// exposed alias mounts
+	rootExpress.use(basePath, nestExpress);
+	rootExpress.listen(port);
+
+	console.log('#################################');
+	console.log(`### Start edu-sharing Server  ###`);
+	console.log(`### Port:     ${port}            ###`);
+	console.log(`### Base path: ${basePath}        ###`);
+	console.log('#################################');
+}
+void bootstrap();

apps/server/src/modules/edu-sharing/README.md

@@ -0,0 +1,6 @@
+# Module Description - edu-sharing
+
+## Summary
+
+This module is a stand alone service.
+The service handles the retrieval of a valid "ticket" (session) from the respective edu-sharing back end.

apps/server/src/modules/edu-sharing/controller/dto/edu-sharing.params.ts

@@ -0,0 +1,12 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString } from 'class-validator';
+
+export class TicketParams {
+	@IsString()
+	@ApiProperty({
+		description: 'The ticket to be evaluated.',
+		required: true,
+		nullable: false,
+	})
+	ticket!: string;
+}

apps/server/src/modules/edu-sharing/controller/dto/index.ts

@@ -0,0 +1 @@
+export * from './edu-sharing.params';

apps/server/src/modules/edu-sharing/controller/edu-sharing.controller.ts

@@ -0,0 +1,71 @@
+import { CurrentUser, ICurrentUser, JwtAuthentication } from '@infra/auth-guard';
+import {
+	Controller,
+	ForbiddenException,
+	Get,
+	InternalServerErrorException,
+	NotAcceptableException,
+	NotFoundException,
+	Param,
+} from '@nestjs/common';
+import { ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+import { LoginDto } from '../dto';
+import { EduSharingUC } from '../uc';
+import { TicketParams } from './dto';
+
+@ApiTags('edu-sharing')
+@Controller('edu-sharing')
+export class EduSharingController {
+	constructor(private readonly eduSharingUC: EduSharingUC) {}
+
+	@JwtAuthentication()
+	@ApiOperation({
+		summary: 'Fetches the edu-sharing ticket for a given user name.',
+	})
+	@ApiResponse({ status: 200, type: String })
+	@ApiResponse({ status: 206, type: String })
+	@ApiResponse({ status: 403, type: ForbiddenException })
+	@ApiResponse({ status: 404, type: NotFoundException })
+	@ApiResponse({ status: 406, type: NotAcceptableException })
+	@ApiResponse({ status: 500, type: InternalServerErrorException })
+	@Get('/')
+	async getTicketForUser(@CurrentUser() currentUser: ICurrentUser): Promise<string | undefined> {
+		const ticket = await this.eduSharingUC.getTicketForUser(currentUser.userId);
+
+		return ticket;
+	}
+
+	@JwtAuthentication()
+	@ApiOperation({
+		summary:
+			'Gets detailed information about a ticket. Will throw an exception if the given ticket is not valid anymore.',
+	})
+	@ApiResponse({ status: 200, type: String })
+	@ApiResponse({ status: 206, type: String })
+	@ApiResponse({ status: 403, type: ForbiddenException })
+	@ApiResponse({ status: 404, type: NotFoundException })
+	@ApiResponse({ status: 406, type: NotAcceptableException })
+	@ApiResponse({ status: 500, type: InternalServerErrorException })
+	@Get('/validate/:ticket')
+	async getTicketAuthenticationInfo(@Param() params: TicketParams): Promise<LoginDto> {
+		const result = await this.eduSharingUC.getTicketAuthenticationInfo(params);
+
+		return result;
+	}
+
+	@ApiOperation({
+		summary: 'Returns the required XML for registering the service against an edu-sharing repository.',
+	})
+	@ApiResponse({ status: 200, type: String })
+	@ApiResponse({ status: 206, type: String })
+	@ApiResponse({ status: 403, type: ForbiddenException })
+	@ApiResponse({ status: 404, type: NotFoundException })
+	@ApiResponse({ status: 406, type: NotAcceptableException })
+	@ApiResponse({ status: 500, type: InternalServerErrorException })
+	@Get('/register')
+	getEduAppXMLData(): string {
+		const xmlData = this.eduSharingUC.getEduAppXMLData();
+
+		return xmlData;
+	}
+}

apps/server/src/modules/edu-sharing/controller/index.ts

@@ -0,0 +1 @@
+export * from './edu-sharing.controller';

apps/server/src/modules/edu-sharing/dto/authentication-token.dto.ts

@@ -0,0 +1,4 @@
+export interface AuthenticationTokenDto {
+	ticket?: string;
+	userId?: string;
+}