Feature/943 tenant via iss

.github/workflows/frontend-test-action.yml

@@ -45,9 +45,9 @@ jobs:
               --name my_keycloak \
               -e KEYCLOAK_ADMIN=admin \
               -e KEYCLOAK_ADMIN_PASSWORD=keycloak \
-              -v ./docker/config/realm-export.json:/opt/keycloak/data/import/realm.json \
+              -v ./docker/config/realm-export-pitc.json:/opt/keycloak/data/import/realm-pitc.json \
               -p 8544:8080 \
-              quay.io/keycloak/keycloak:23.0.1 \
+              quay.io/keycloak/keycloak:24.0.2 \
               start-dev --import-realm
 
       - name: start backend
@@ -58,10 +58,16 @@ jobs:
         with:
           working-directory: frontend
           start: npm start
-          wait-on: 'http://localhost:8080/config, http://localhost:4200, http://localhost:8544'
+          wait-on: 'http://pitc.okr.localhost:8080/config, http://pitc.okr.localhost:4200, http://localhost:8544'
           wait-on-timeout: 120
           browser: chrome
           headed: true
 
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: cypress-screenshots
+          path: frontend/cypress/screenshots
+
       - name: remove docker containers
         run: docker ps -aq | xargs -r docker rm -f

.gitignore

@@ -31,3 +31,4 @@ sonar-project.properties
 /frontend/cypress/downloads/
 /frontend/cypress/screenshots/
 /toolchains.xml
+/backend/src/main/resources/db/okr_schema.sql

.run/OkrApplication-E2E.run.xml

@@ -1,7 +1,7 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="OkrApplication-E2E" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot">
     <option name="ACTIVE_PROFILES" value="integration-test" />
-    <option name="ALTERNATIVE_JRE_PATH" value="$USER_HOME$/.sdkman/candidates/java/current" />
+    <option name="ALTERNATIVE_JRE_PATH" value="$USER_HOME$/.jdks/corretto-17.0.9" />
     <option name="ALTERNATIVE_JRE_PATH_ENABLED" value="true" />
     <module name="backend" />
     <option name="SPRING_BOOT_MAIN_CLASS" value="ch.puzzle.okr.OkrApplication" />

README.md

@@ -4,10 +4,17 @@ This is an open source application for managing OKRs, developed by the team of a
 
 This project contains two parts:
 
+## Setup
+Add subdomains to hosts file:
+```shell
+sudo sh -c 'echo "127.0.0.1       pitc.okr.localhost\n127.0.0.1       acme.okr.localhost" >> /etc/hosts'
+```
+
 ## Frontend
 
 [Frontend description](frontend/README.md)
 
+
 ## Backend
 [Backend description](backend/README.md)
 

backend/pom.xml

@@ -107,7 +107,6 @@
                     <excludes>
                         <exclude>ch/puzzle/okr/models/**</exclude>
                         <exclude>ch/puzzle/okr/dto/**</exclude>
-                        <exclude>ch/puzzle/okr/mapper/**</exclude>
                         <exclude>ch/puzzle/okr/OkrApplication.*</exclude>
                         <exclude>ch/puzzle/okr/Constants.java</exclude>
                         <exclude>ch/puzzle/okr/ErrorKey.java</exclude>

backend/src/main/java/ch/puzzle/okr/Constants.java

@@ -17,4 +17,5 @@ private Constants() {
     public static final String QUARTER = "Quarter";
     public static final String TEAM = "Team";
     public static final String USER = "User";
+    public static final String USER_TEAM = "UserTeam";
 }

backend/src/main/java/ch/puzzle/okr/ErrorKey.java

@@ -4,5 +4,5 @@ public enum ErrorKey {
     ATTRIBUTE_NULL, ATTRIBUTE_CHANGED, ATTRIBUTE_SET_FORBIDDEN, ATTRIBUTE_NOT_SET, ATTRIBUTE_CANNOT_CHANGE,
     ATTRIBUTE_MUST_BE_DRAFT, KEY_RESULT_CONVERSION, ALREADY_EXISTS_SAME_NAME, CONVERT_TOKEN, DATA_HAS_BEEN_UPDATED,
     MODEL_NULL, MODEL_WITH_ID_NOT_FOUND, NOT_AUTHORIZED_TO_READ, NOT_AUTHORIZED_TO_WRITE, NOT_AUTHORIZED_TO_DELETE,
-    TOKEN_NULL
+    TOKEN_NULL, TRIED_TO_DELETE_LAST_ADMIN, TRIED_TO_REMOVE_LAST_OKR_CHAMPION
 }

backend/src/main/java/ch/puzzle/okr/FlywayMultitenantConfig.java

@@ -0,0 +1,22 @@
+package ch.puzzle.okr;
+
+import ch.puzzle.okr.multitenancy.FlywayMultitenantMigrationInitializer;
+import org.springframework.boot.autoconfigure.flyway.FlywayMigrationStrategy;
+import org.springframework.cache.interceptor.KeyGenerator;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class FlywayMultitenantConfig {
+
+    @Bean
+    public FlywayMigrationStrategy cleanMigrateStrategy(FlywayMultitenantMigrationInitializer flywayMigration) {
+        return flyway -> flywayMigration.migrateFlyway();
+    }
+
+    @Bean("customKeyGenerator")
+    public KeyGenerator keyGenerator() {
+        return new UserKeyGenerator();
+    }
+
+}

backend/src/main/java/ch/puzzle/okr/OkrApplication.java

@@ -3,8 +3,8 @@
 import ch.puzzle.okr.service.clientconfig.ClientCustomizationProperties;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.scheduling.annotation.EnableScheduling;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
 
 @SpringBootApplication
 @EnableScheduling

backend/src/main/java/ch/puzzle/okr/SecurityConfig.java

@@ -1,16 +1,30 @@
 package ch.puzzle.okr;
 
+import com.nimbusds.jose.proc.SecurityContext;
+import com.nimbusds.jwt.proc.ConfigurableJWTProcessor;
+import com.nimbusds.jwt.proc.DefaultJWTProcessor;
+import com.nimbusds.jwt.proc.JWTClaimsSetAwareJWSKeySelector;
+import com.nimbusds.jwt.proc.JWTProcessor;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.http.HttpStatus;
+import org.springframework.security.authentication.AuthenticationEventPublisher;
+import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
+import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
+import org.springframework.security.oauth2.core.OAuth2TokenValidator;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.jwt.JwtDecoder;
+import org.springframework.security.oauth2.jwt.JwtValidators;
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.HttpStatusEntryPoint;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
@@ -41,6 +55,22 @@ public SecurityFilterChain securityHeadersFilter(HttpSecurity http) throws Excep
         return setHeaders(http).build();
     }
 
+    @Bean
+    JWTProcessor<SecurityContext> jwtProcessor(JWTClaimsSetAwareJWSKeySelector<SecurityContext> keySelector) {
+        ConfigurableJWTProcessor<SecurityContext> jwtProcessor = new DefaultJWTProcessor<>();
+        jwtProcessor.setJWTClaimsSetAwareJWSKeySelector(keySelector);
+        return jwtProcessor;
+    }
+
+    @Bean
+    JwtDecoder jwtDecoder(JWTProcessor<SecurityContext> jwtProcessor, OAuth2TokenValidator<Jwt> jwtValidator) {
+        NimbusJwtDecoder decoder = new NimbusJwtDecoder(jwtProcessor);
+        OAuth2TokenValidator<Jwt> validator = new DelegatingOAuth2TokenValidator<>(JwtValidators.createDefault(),
+                jwtValidator);
+        decoder.setJwtValidator(validator);
+        return decoder;
+    }
+
     private HttpSecurity setHeaders(HttpSecurity http) throws Exception {
         http.headers(h -> h
                 .contentSecurityPolicy(e -> e.policyDirectives("default-src 'self';"
@@ -69,4 +99,11 @@ private HttpSecurity setHeaders(HttpSecurity http) throws Exception {
                                 + " publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), "
                                 + "usb=(), web-share=(), xr-spatial-tracking=()")));
     }
+
+    @Bean
+    public AuthenticationEventPublisher authenticationEventPublisher(
+            ApplicationEventPublisher applicationEventPublisher) {
+        return new DefaultAuthenticationEventPublisher(applicationEventPublisher);
+    }
+
 }

backend/src/main/java/ch/puzzle/okr/SpringCachingConfig.java

@@ -1,5 +1,7 @@
 package ch.puzzle.okr;
 
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.multitenancy.TenantContext;
 import org.springframework.cache.CacheManager;
 import org.springframework.cache.annotation.EnableCaching;
 import org.springframework.cache.concurrent.ConcurrentMapCacheManager;
@@ -11,10 +13,13 @@
 public class SpringCachingConfig {
 
     public static final String AUTHORIZATION_USER_CACHE = "authorizationUsers";
-    public static final String USER_CACHE = "users";
 
     @Bean
     public CacheManager cacheManager() {
-        return new ConcurrentMapCacheManager(AUTHORIZATION_USER_CACHE, USER_CACHE);
+        return new ConcurrentMapCacheManager(AUTHORIZATION_USER_CACHE);
+    }
+
+    public static String cacheKey(User user) {
+        return TenantContext.getCurrentTenant() + "_" + user.getEmail();
     }
 }

backend/src/main/java/ch/puzzle/okr/UserKeyGenerator.java

@@ -0,0 +1,16 @@
+package ch.puzzle.okr;
+
+import ch.puzzle.okr.models.User;
+import ch.puzzle.okr.multitenancy.TenantContext;
+import org.springframework.cache.interceptor.KeyGenerator;
+
+import java.lang.reflect.Method;
+import java.text.MessageFormat;
+
+public class UserKeyGenerator implements KeyGenerator {
+    @Override
+    public Object generate(Object target, Method method, Object... params) {
+        User user = (User) params[0];
+        return MessageFormat.format("{0}{1}{2}", TenantContext.getCurrentTenant(), user.getEmail(), user.getId());
+    }
+}

backend/src/main/java/ch/puzzle/okr/controller/CacheController.java

@@ -24,13 +24,6 @@ public void emptyAuthorizationUsersCache() {
         cacheService.emptyAuthorizationUsersCache();
     }
 
-    @Operation(summary = "Delete users cache", description = "Delete users cache")
-    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Users cache deleted") })
-    @PostMapping("emptyUsersCache")
-    public void emptyUsersCache() {
-        cacheService.emptyUsersCache();
-    }
-
     @Operation(summary = "Delete all caches", description = "Delete all caches")
     @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "All caches deleted") })
     @PostMapping("emptyAllCaches")

backend/src/main/java/ch/puzzle/okr/controller/ClientConfigController.java

@@ -2,12 +2,15 @@
 
 import ch.puzzle.okr.dto.ClientConfigDto;
 import ch.puzzle.okr.service.clientconfig.ClientConfigService;
+import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
+import java.util.Map;
+
 @RestController
 @RequestMapping("/config")
 public class ClientConfigController {
@@ -19,7 +22,8 @@ public ClientConfigController(ClientConfigService configService) {
     }
 
     @GetMapping
-    public ResponseEntity<ClientConfigDto> getConfig() {
-        return ResponseEntity.status(HttpStatus.OK).body(configService.getConfigBasedOnActiveEnv());
+    public ResponseEntity<ClientConfigDto> getConfig(HttpServletRequest request) {
+        return ResponseEntity.status(HttpStatus.OK)
+                .body(configService.getConfigBasedOnActiveEnv(request.getServerName()));
     }
 }

backend/src/main/java/ch/puzzle/okr/controller/OverviewController.java

@@ -1,8 +1,6 @@
 package ch.puzzle.okr.controller;
 
-import ch.puzzle.okr.dto.overview.DashboardDto;
 import ch.puzzle.okr.dto.overview.OverviewDto;
-import ch.puzzle.okr.mapper.DashboardMapper;
 import ch.puzzle.okr.mapper.OverviewMapper;
 import ch.puzzle.okr.service.authorization.OverviewAuthorizationService;
 import io.swagger.v3.oas.annotations.Operation;
@@ -23,14 +21,12 @@
 @RequestMapping("api/v2/overview")
 public class OverviewController {
     private final OverviewMapper overviewMapper;
-    private final DashboardMapper dashboardMapper;
     private final OverviewAuthorizationService overviewAuthorizationService;
 
-    public OverviewController(OverviewMapper overviewMapper, OverviewAuthorizationService overviewAuthorizationService,
-            DashboardMapper dashboardMapper) {
+    public OverviewController(OverviewMapper overviewMapper,
+            OverviewAuthorizationService overviewAuthorizationService) {
         this.overviewMapper = overviewMapper;
         this.overviewAuthorizationService = overviewAuthorizationService;
-        this.dashboardMapper = dashboardMapper;
     }
 
     @Operation(summary = "Get all teams and their objectives", description = "Get a List of teams with their objectives")
@@ -41,14 +37,11 @@ public OverviewController(OverviewMapper overviewMapper, OverviewAuthorizationSe
             @ApiResponse(responseCode = "401", description = "Not authorized to read teams with their objectives", content = @Content),
             @ApiResponse(responseCode = "404", description = "The quarter or one of the teams were not found", content = @Content) })
     @GetMapping("")
-    public ResponseEntity<DashboardDto> getOverview(
+    public ResponseEntity<List<OverviewDto>> getOverview(
             @RequestParam(required = false, defaultValue = "", name = "team") List<Long> teamFilter,
             @RequestParam(required = false, defaultValue = "", name = "quarter") Long quarterFilter,
             @RequestParam(required = false, defaultValue = "", name = "objectiveQuery") String objectiveQuery) {
-        boolean hasWriteAllAccess = overviewAuthorizationService.hasWriteAllAccess();
-        return ResponseEntity.status(HttpStatus.OK)
-                .body(dashboardMapper.toDto(overviewMapper.toDto(
-                        overviewAuthorizationService.getFilteredOverview(quarterFilter, teamFilter, objectiveQuery)),
-                        hasWriteAllAccess));
+        return ResponseEntity.status(HttpStatus.OK).body(overviewMapper
+                .toDto(overviewAuthorizationService.getFilteredOverview(quarterFilter, teamFilter, objectiveQuery)));
     }
 }