Public Access
jaap-jan
d3b14e6bc0
Options, JWT bearer validation, the /meta and .well-known endpoints, and a dev compose stack with Keycloak. Verified end to end: compose up, migrate, run, both discovery endpoints return correct payloads, and readiness reports the schema current. Configuration: - Strongly-typed options for Server, Oidc, Relay and Sync, all ValidateOnStart. A self-hosted server that boots half-configured and fails later per-request is far harder to diagnose than one that refuses to start and names the bad setting. - Cross-field validation the annotations cannot express: relay needs a WebSocketUrl when enabled, idle timeout must be under max session duration, item payload cap under batch cap. - Startup warnings for combinations that are individually valid but dangerous together: RequireHttpsMetadata false outside Development, and AllowEmailLinking (which turns any token bearing a victim's email into account takeover, hence default false). Auth: - JwtBearer with ClockSkew cut to 30s from the 5-minute default; five minutes of slack on a credential granting vault ciphertext access is more than any clock needs. - IncludeErrorDetails off, and a FallbackPolicy so an endpoint without an explicit policy still requires a caller rather than silently being public. Discovery, per ADR 0002: - /api/v1/meta reports versions, features and push caps. - /.well-known/dodossh-configuration is the onboarding story: the user types one server URL and the client discovers OIDC authority, client id, scopes and relay endpoint. Two environment problems found by actually running the stack: - PostgreSQL 18 changed its data mount point. Mounting /var/lib/postgresql/data — correct through 17 — makes the image refuse to start; 18+ wants a single mount at /var/lib/postgresql with the cluster in a subdirectory. - Keycloak moved to host port 18080. An unrelated Apache Tomcat on this machine holds 127.0.0.1:8080, and a loopback-specific bind beats Docker's 0.0.0.0 publish for "localhost". It presents as Keycloak 404ing every realm while its own log says the import succeeded, which is a genuinely misleading failure. Also: CA1848 is enforced, not advisory — warnings are errors, so the .editorconfig comment claiming otherwise was wrong. Startup and health logging now uses [LoggerMessage]. And a clean rebuild is back to zero warnings; the incremental build had been hiding 40 in test projects (banned Guid.NewGuid, an obsolete Testcontainers constructor, and two analyzer families that are genuinely noise under a test host). Verified: 0 warnings on a clean rebuild, 122 tests pass, format clean.
153 lines
7.1 KiB
INI
153 lines
7.1 KiB
INI
# EditorConfig for DodoSSH — https://editorconfig.org
|
|
root = true
|
|
|
|
[*]
|
|
charset = utf-8
|
|
end_of_line = lf
|
|
indent_style = space
|
|
indent_size = 4
|
|
insert_final_newline = true
|
|
trim_trailing_whitespace = true
|
|
|
|
[*.{json,yml,yaml,js,ts,css,html,axaml,xaml,csproj,props,targets,slnx}]
|
|
indent_size = 2
|
|
|
|
[*.md]
|
|
# Two trailing spaces are a hard line break in Markdown.
|
|
trim_trailing_whitespace = false
|
|
|
|
[*.{cmd,bat,ps1}]
|
|
end_of_line = crlf
|
|
|
|
[*.cs]
|
|
indent_size = 4
|
|
|
|
#### Language conventions ####
|
|
|
|
csharp_style_namespace_declarations = file_scoped:error
|
|
csharp_using_directive_placement = outside_namespace:error
|
|
csharp_style_var_for_built_in_types = false:suggestion
|
|
csharp_style_var_when_type_is_apparent = true:suggestion
|
|
csharp_style_var_elsewhere = false:suggestion
|
|
csharp_prefer_braces = true:suggestion
|
|
csharp_style_prefer_primary_constructors = true:suggestion
|
|
csharp_style_expression_bodied_methods = when_on_single_line:suggestion
|
|
csharp_style_expression_bodied_properties = true:suggestion
|
|
|
|
dotnet_sort_system_directives_first = true
|
|
dotnet_separate_import_directive_groups = false
|
|
|
|
dotnet_style_qualification_for_field = false:suggestion
|
|
dotnet_style_qualification_for_property = false:suggestion
|
|
dotnet_style_qualification_for_method = false:suggestion
|
|
dotnet_style_readonly_field = true:warning
|
|
dotnet_style_require_accessibility_modifiers = for_non_interface_members:warning
|
|
dotnet_style_coalesce_expression = true:suggestion
|
|
dotnet_style_null_propagation = true:suggestion
|
|
dotnet_style_prefer_is_null_check_over_reference_equality_method = true:suggestion
|
|
|
|
# Async methods must be suffixed Async (VSTHRD200 equivalent via naming rules below).
|
|
dotnet_naming_rule.async_methods_end_in_async.severity = warning
|
|
dotnet_naming_rule.async_methods_end_in_async.symbols = any_async_method
|
|
dotnet_naming_rule.async_methods_end_in_async.style = ends_with_async
|
|
dotnet_naming_symbols.any_async_method.applicable_kinds = method
|
|
dotnet_naming_symbols.any_async_method.required_modifiers = async
|
|
dotnet_naming_style.ends_with_async.required_suffix = Async
|
|
dotnet_naming_style.ends_with_async.capitalization = pascal_case
|
|
|
|
dotnet_naming_rule.interfaces_start_with_i.severity = warning
|
|
dotnet_naming_rule.interfaces_start_with_i.symbols = any_interface
|
|
dotnet_naming_rule.interfaces_start_with_i.style = starts_with_i
|
|
dotnet_naming_symbols.any_interface.applicable_kinds = interface
|
|
dotnet_naming_style.starts_with_i.required_prefix = I
|
|
dotnet_naming_style.starts_with_i.capitalization = pascal_case
|
|
|
|
# Constants and static readonly fields are PascalCase, per .NET convention. These rules must
|
|
# come before the camelCase rule below: the first matching rule wins, and a rule matching all
|
|
# private fields would otherwise force `const int Foo` to be named `foo`.
|
|
dotnet_naming_rule.constants_are_pascal_case.severity = warning
|
|
dotnet_naming_rule.constants_are_pascal_case.symbols = any_const_field
|
|
dotnet_naming_rule.constants_are_pascal_case.style = pascal_case_style
|
|
dotnet_naming_symbols.any_const_field.applicable_kinds = field
|
|
dotnet_naming_symbols.any_const_field.applicable_accessibilities = *
|
|
dotnet_naming_symbols.any_const_field.required_modifiers = const
|
|
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.severity = warning
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.symbols = static_readonly_field
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.style = pascal_case_style
|
|
dotnet_naming_symbols.static_readonly_field.applicable_kinds = field
|
|
dotnet_naming_symbols.static_readonly_field.applicable_accessibilities = *
|
|
dotnet_naming_symbols.static_readonly_field.required_modifiers = static, readonly
|
|
|
|
dotnet_naming_style.pascal_case_style.capitalization = pascal_case
|
|
|
|
# Private instance fields are camelCase.
|
|
dotnet_naming_rule.private_fields_are_camel_case.severity = warning
|
|
dotnet_naming_rule.private_fields_are_camel_case.symbols = private_field
|
|
dotnet_naming_rule.private_fields_are_camel_case.style = camel_case_style
|
|
dotnet_naming_symbols.private_field.applicable_kinds = field
|
|
dotnet_naming_symbols.private_field.applicable_accessibilities = private
|
|
dotnet_naming_style.camel_case_style.capitalization = camel_case
|
|
|
|
#### Diagnostics ####
|
|
|
|
# Formatting violations fail the build; `dotnet format --verify-no-changes` gates CI.
|
|
dotnet_diagnostic.IDE0055.severity = error
|
|
|
|
# ConfigureAwait is not meaningful in ASP.NET Core (no SynchronizationContext). It IS
|
|
# meaningful in the Avalonia client, which re-enables CA2007 in its own .editorconfig.
|
|
dotnet_diagnostic.CA2007.severity = none
|
|
|
|
# Require LoggerMessage source generation over ILogger extension calls — allocation-free,
|
|
# and event ids plus message templates become a greppable inventory rather than string
|
|
# literals scattered through the code. Effectively an error, since warnings are errors;
|
|
# stated as such rather than pretending it is advisory.
|
|
dotnet_diagnostic.CA1848.severity = warning
|
|
|
|
# Exceptions carry ProblemDetails codes, not localised text.
|
|
dotnet_diagnostic.CA1303.severity = none
|
|
|
|
# CA1711 reserves the suffixes Flags, Permission, Collection, Stream and friends for
|
|
# .NET Framework CAS and BCL base types that have no bearing on this codebase. The BCL
|
|
# itself ships BindingFlags. PermissionFlags is the clearest name for a [Flags] enum of
|
|
# permissions, and contorting domain vocabulary to satisfy a legacy rule costs more than
|
|
# it returns.
|
|
dotnet_diagnostic.CA1711.severity = none
|
|
|
|
# CA1724 flags any type whose name collides with a BCL *namespace* (e.g. a type named
|
|
# Permissions vs System.Security.Permissions). Namespace-qualified resolution makes this
|
|
# a non-issue in practice and it heavily constrains domain naming.
|
|
dotnet_diagnostic.CA1724.severity = none
|
|
|
|
# MA0048 requires one type per file. Good for large types, actively worse for small DTO
|
|
# clusters: splitting SyncPullRequest from SyncPullResponse means a reviewer opens two files
|
|
# to understand one endpoint's contract. The BCL groups related types the same way.
|
|
dotnet_diagnostic.MA0048.severity = none
|
|
|
|
# We use file-scoped namespaces and modern C#; these fire on deliberate style choices.
|
|
dotnet_diagnostic.CA1812.severity = none # internal types instantiated by DI
|
|
dotnet_diagnostic.CA1849.severity = warning # sync call in async method
|
|
|
|
[tests/**/*.cs]
|
|
# Test classes are instantiated by xunit, and test data is often public static.
|
|
dotnet_diagnostic.CA1812.severity = none
|
|
dotnet_diagnostic.CA1034.severity = none
|
|
|
|
[src/DodoSSH.Infrastructure/Migrations/*.cs]
|
|
# EF Core generates these; do not lint or format them.
|
|
generated_code = true
|
|
dotnet_analyzer_diagnostic.severity = none
|
|
dotnet_diagnostic.IDE0055.severity = none
|
|
|
|
[*.{g,g.i,generated,designer}.cs]
|
|
# Source-generator output. In particular the System.Text.Json generator emits a public
|
|
# JsonTypeInfo member per serialisable type, which PublicApiAnalyzers would otherwise demand
|
|
# be tracked in PublicAPI.txt — hundreds of entries derived mechanically from the
|
|
# [JsonSerializable] list, drowning the entries that describe the actual wire contract.
|
|
generated_code = true
|
|
dotnet_analyzer_diagnostic.severity = none
|
|
dotnet_diagnostic.RS0016.severity = none
|
|
dotnet_diagnostic.RS0017.severity = none
|
|
dotnet_diagnostic.RS0041.severity = none
|
|
dotnet_diagnostic.IDE0055.severity = none
|