From f90afcbf524dbfde7ad1db926cbf4df44bb6542f Mon Sep 17 00:00:00 2001 From: gabdevele Date: Thu, 18 Jun 2026 18:05:41 +0200 Subject: [PATCH] refactor: remove legacy build probe and database URL normalization scripts; update Dockerfile and docker-compose for cleaner setup --- Dockerfile | 6 - README.md | 2 +- docker-compose.yml | 9 - entrypoint.sh | 10 - .../__pycache__/settingslocal.cpython-310.pyc | Bin 2207 -> 2879 bytes .../federation_authority/urls.py | 2 - provider/provider/urls.py | 3 - relying_party/relying_party/urls.py | 3 - scripts/build_probe.py | 57 ------ scripts/normalize_db_urls.py | 175 ------------------ 10 files changed, 1 insertion(+), 266 deletions(-) delete mode 100644 scripts/build_probe.py delete mode 100644 scripts/normalize_db_urls.py diff --git a/Dockerfile b/Dockerfile index 014939c..b53f43c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,9 +4,6 @@ ENV PYTHONDONTWRITEBYTECODE=1 ENV PYTHONUNBUFFERED=1 ENV PYTHONPATH=/app -ARG BUILD_ID=dev -ARG BUILD_TIME_UTC=unknown - RUN apt-get update \ && apt-get install -y --no-install-recommends build-essential git \ && rm -rf /var/lib/apt/lists/* @@ -26,9 +23,6 @@ COPY federation_authority /app/federation_authority COPY provider /app/provider COPY relying_party /app/relying_party -RUN sh -lc 'find /app/federation_authority /app/provider /app/relying_party /app/scripts -type f | sort | xargs sha256sum | sha256sum | awk "{print \$1}" > /app/__buildfingerprint__' -RUN printf '{\"build_id\":\"%s\",\"built_at_utc\":\"%s\",\"image_marker\":\"cie-auth-image\"}\n' \"$BUILD_ID\" \"$BUILD_TIME_UTC\" > /app/__buildinfo__.json - COPY entrypoint.sh /entrypoint.sh COPY scripts /app/scripts RUN chmod +x /entrypoint.sh diff --git a/README.md b/README.md index 80718cf..be227e6 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,7 @@ Tutti i commit presenti sono bug dovuti a svariate problematiche che abbiamo avu ## Note Setuppare questo progetto in locale è molto complesso, consiglio di testarlo direttamente in produzione con i vari domini impostati. +Lo script `scripts/legacy/normalize_db_urls.py` esiste solo per migrare manualmente vecchi volumi SQLite bootstrapati con URL legacy; non viene piu eseguito automaticamente a runtime. ## Dettagli Stack: @@ -22,4 +23,3 @@ Stack: Il RP Visione usa `/visione/start` per iniziare il flow e `/visione/complete` per chiuderlo verso backend Visione. Il replying party sarebbe dovuto essere unicamente il nostro backend ma certe feature sono molto complesse da implementare in C++,infatti non esiste una repo già pronta per questo linguaggio, per questo è stato scelto di fare un ponte tra il backend Visione e il RP Django, che si occupa di fare la parte più complessa del flow CIE. - diff --git a/docker-compose.yml b/docker-compose.yml index c54f781..f66293e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,9 +3,6 @@ services: build: context: . dockerfile: Dockerfile - args: - BUILD_ID: ${CIE_AUTH_BUILD_ID:-dev} - BUILD_TIME_UTC: ${CIE_AUTH_BUILD_TIME_UTC:-unknown} working_dir: /app/federation_authority command: ["/app/federation_authority", "8000"] environment: @@ -24,9 +21,6 @@ services: build: context: . dockerfile: Dockerfile - args: - BUILD_ID: ${CIE_AUTH_BUILD_ID:-dev} - BUILD_TIME_UTC: ${CIE_AUTH_BUILD_TIME_UTC:-unknown} working_dir: /app/provider command: ["/app/provider", "8002"] environment: @@ -48,9 +42,6 @@ services: build: context: . dockerfile: Dockerfile - args: - BUILD_ID: ${CIE_AUTH_BUILD_ID:-dev} - BUILD_TIME_UTC: ${CIE_AUTH_BUILD_TIME_UTC:-unknown} working_dir: /app/relying_party command: ["/app/relying_party", "8001"] environment: diff --git a/entrypoint.sh b/entrypoint.sh index cb5d998..c53f633 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -5,17 +5,11 @@ APP_DIR="$1" PORT="$2" DB_PATH="${DJANGO_DB_PATH:-$APP_DIR/db/db.sqlite3}" DUMP_SRC="$APP_DIR/dumps/example.json" -LEGACY_DB_PATH="$APP_DIR/db.sqlite3" cd "$APP_DIR" mkdir -p logs static "$(dirname "$DB_PATH")" -if [ ! -f "$DB_PATH" ] && [ -f "$LEGACY_DB_PATH" ]; then - mkdir -p "$(dirname "$DB_PATH")" - cp "$LEGACY_DB_PATH" "$DB_PATH" -fi - python manage.py migrate should_load_fixture=0 @@ -47,10 +41,6 @@ if [ "$should_load_fixture" = "1" ]; then rm -f "$TMP_DUMP" fi -python /app/scripts/normalize_db_urls.py "$DB_PATH" - -# With DEBUG disabled Django no longer serves app static assets implicitly. -# Collect them into STATIC_ROOT so the explicit /static/ URL can serve them. python manage.py collectstatic --noinput if grep -aEq '127\.0\.0\.1|provider:8002' "$DB_PATH" \ diff --git a/federation_authority/federation_authority/__pycache__/settingslocal.cpython-310.pyc b/federation_authority/federation_authority/__pycache__/settingslocal.cpython-310.pyc index a97ae7ef404b2700b621e44e79aacee68f0d3b75..f2ddbaac27588e5bf5b1f4efcd752a4556e861e6 100644 GIT binary patch delta 1293 zcmZuwO-vg{6rLIHu8pzz4qAu5qN(tB^-d$Zqs^WNLs0U!S&sZ<-=b(3Hehx=a(m|Z;i5JI3lr#x)YW&~8wT8wvCVF&|z#&{GW zyb~CYwX+=%#cbS)+mv@fC+~(B@39H*b%;YC-e9~Bx}e*k&|{Iqe&~h1Zzy{Gm>GZp zegQ7wFTX`4z;viZX?A4U+si%pmn?m<5Iy zb8y2sk^JV-S%5`YYJ{X`Q+N*#EH^^!{leM){RV@ThRTz0lh42hd={udk{|sgYn#pN zGilFO2(6TL6n_#`K$^5hTJ$NaF(6gqb=L6X8f)&d76E!p5Q$~i6g(>El3;FGgdSVI zPy(-NB|{kSg=SlURX!GK$^FvuFsPJ^N0tbKbx^F90-+ukOI7Pf;>8f<)yMVU!>dbp z-rRHDk|v2nP(^8kDl|sDE_qdN`qNbQPR=y+^}Jp%@9MktZ8|Y4VrTKRetYN66RikG zPI*D}pG6D#9iw2Tvg;eUeElnWKnwLhC_mY!2>Eu&YRK2LE0DmAO={$`=u=vwP0}JB zJGC#^BW9d3PEw)zf#+0`OtASyp*Vqc)PBpUiX(`Ku9h4>*msXAYg6d^@|pzk#?agn z184kFTU)vNdfME`83jYonOAfUF$Xsag>CbJnaSnvr}AmcZ|8G`oKPPILB)T$#(twK zp8PkS48viuY`gQYH@{ch|H3MRKkq*(A)jT@^|ms%&FxfSLonE@FDoro+015gb)jTN zmJvd9R6Ms*w2Og-H*2SO-gG^suJD^OA1=AJZF#;JId*)8a#A8CwOf7mM=pN z{9kh4_YMLVIVEW(IVZwJ$Cdm&+2H!O>fC6%v0hkS68*2OLT$J5<*({EO{;zdA0y)L z)@fkJ(BCPKET0%cjGeqLYxQ8)G>k2CLrJTO jwW7*gf}!riO@y(2_F7Yw*Gy$}u>N`EmZtr!BqH<;Hc3qp delta 579 zcmYjNJ8u&~5Z+zi+mHB>IF29jBMIObWI&=bh(~O&62$@=A-0K5%=vPb@f5`QGGYZ1=#YjaU$qIO-cg=`WxfV0khW3Jv#<&oiw@Y^+=->Y z+9`vq&ydJNju#-$*KwsHqJ$_zfmdK14L6_&GLDv@?9897V7&pGu;tHJs@N1RAb-&h zE$U1E>Z;FR+n4z!&@QRge$2mO|G4@dSl4`4*MXx{~d+yk@&8Zbg?fq7#$^r!j=E!!v zxR|In@`brd9lEw{d6Vi^pqh?*IGv6I=1v6DE++z`+r0Ov**n;6KJ_xFKHJqwG#0(H zx7T^n+&OsA>Grzflm5Bzk$7$77wLD~8TCE0{>-tin6v3&U0h?0Qsc;l+0eR0Q8syj lNh2D~Gl@xbal}_6mr}6P7)!BpMV8K)%xFaXF>W&B*I%Zkk97b5 diff --git a/federation_authority/federation_authority/urls.py b/federation_authority/federation_authority/urls.py index 691bff8..bd36692 100644 --- a/federation_authority/federation_authority/urls.py +++ b/federation_authority/federation_authority/urls.py @@ -18,7 +18,6 @@ from django.contrib import admin from django.urls import include, path, re_path from django.views.static import serve -from scripts.build_probe import build_probe_view from spid_cie_oidc.entity.urls import urlpatterns as entity_urlpatterns from spid_cie_oidc.authority.urls import urlpatterns as ta_urlpatterns from spid_cie_oidc.onboarding.urls import urlpatterns as onb_urlpatterns @@ -40,7 +39,6 @@ urlpatterns.extend(onb_urlpatterns) urlpatterns.extend( ( path(f"{ADMIN_PATH}", admin.site.urls), - path("__build", lambda request: build_probe_view("federation-authority"), name="build_probe"), re_path('^static/(?P.*)$', serve, { 'document_root': settings.STATIC_ROOT, diff --git a/provider/provider/urls.py b/provider/provider/urls.py index 15b342f..09b9b96 100644 --- a/provider/provider/urls.py +++ b/provider/provider/urls.py @@ -19,7 +19,6 @@ from django.contrib import admin from django.views.static import serve from django.urls import include, path, re_path -from scripts.build_probe import build_probe_view, diag_view from spid_cie_oidc.entity.urls import urlpatterns as entity_urlpatterns admin.site.site_header = "OIDC Federation Provider Administration" @@ -30,8 +29,6 @@ ADMIN_PATH = getattr(settings, 'ADMIN_PATH', 'admin/') urlpatterns = [ path(f"{ADMIN_PATH}", admin.site.urls), - path("__build", lambda request: build_probe_view("provider"), name="build_probe"), - path("__diag", lambda request: diag_view("provider"), name="diag_probe"), re_path('^static/(?P.*)$', serve, { 'document_root': settings.STATIC_ROOT, diff --git a/relying_party/relying_party/urls.py b/relying_party/relying_party/urls.py index 5043015..af517e0 100644 --- a/relying_party/relying_party/urls.py +++ b/relying_party/relying_party/urls.py @@ -18,7 +18,6 @@ from django.contrib import admin from django.urls import include, path, re_path from django.views.static import serve -from scripts.build_probe import build_probe_view, diag_view from spid_cie_oidc.entity.urls import urlpatterns as ta_urlpatterns from .visione_views import VisioneCompleteView, VisioneStartView from .rp_overrides import VisioneRpBeginView, VisioneRpCallbackView @@ -31,8 +30,6 @@ ADMIN_PATH = getattr(settings, 'ADMIN_PATH', 'admin/') urlpatterns = [ path(f"{ADMIN_PATH}", admin.site.urls), - path("__build", lambda request: build_probe_view("relying-party"), name="build_probe"), - path("__diag", lambda request: diag_view("relying-party"), name="diag_probe"), path("visione/start", VisioneStartView.as_view(), name="visione_start"), path("visione/complete", VisioneCompleteView.as_view(), name="visione_complete"), re_path('^static/(?P.*)$', diff --git a/scripts/build_probe.py b/scripts/build_probe.py deleted file mode 100644 index 465944d..0000000 --- a/scripts/build_probe.py +++ /dev/null @@ -1,57 +0,0 @@ -import json -import os -from pathlib import Path - -from django.http import JsonResponse -from spid_cie_oidc.entity.models import FederationEntityConfiguration, TrustChain, FetchedEntityStatement - - -def build_probe_view(service: str): - info_path = Path("/app/__buildinfo__.json") - fingerprint_path = Path("/app/__buildfingerprint__") - info = {} - if info_path.exists(): - try: - info = json.loads(info_path.read_text()) - except Exception: - info = {} - fingerprint = "" - if fingerprint_path.exists(): - try: - fingerprint = fingerprint_path.read_text().strip() - except Exception: - fingerprint = "" - - return JsonResponse( - { - "ok": True, - "service": service, - "build_id": info.get("build_id", ""), - "built_at_utc": info.get("built_at_utc", ""), - "image_marker": info.get("image_marker", ""), - "fingerprint": fingerprint, - "hostname": os.getenv("HOSTNAME", ""), - } - ) - - -def diag_view(service: str): - configs = FederationEntityConfiguration.objects.all() - active = FederationEntityConfiguration.objects.filter(is_active=True) - first = configs.order_by("id").first() - first_active = active.order_by("id").first() - - return JsonResponse( - { - "ok": True, - "service": service, - "config_count": configs.count(), - "active_config_count": active.count(), - "first_sub": getattr(first, "sub", None), - "first_entity_type": getattr(first, "entity_type", None), - "first_active_sub": getattr(first_active, "sub", None), - "first_active_entity_type": getattr(first_active, "entity_type", None), - "trust_chain_count": TrustChain.objects.count(), - "fetched_statement_count": FetchedEntityStatement.objects.count(), - } - ) diff --git a/scripts/normalize_db_urls.py b/scripts/normalize_db_urls.py deleted file mode 100644 index 31a7a20..0000000 --- a/scripts/normalize_db_urls.py +++ /dev/null @@ -1,175 +0,0 @@ -#!/usr/bin/env python3 -import json -import os -import sqlite3 -import sys -from typing import Iterable - - -def env(name: str, default: str = "") -> str: - return os.getenv(name, default).strip().rstrip("/") - - -def infer_base_url(kind: str) -> str: - hosts = env("DJANGO_ALLOWED_HOSTS") or env("CIE_AUTH_ALLOWED_HOSTS") - items = [host.strip() for host in hosts.split(",") if host.strip() and host.strip() != "*"] - for host in items: - if kind in host: - return f"https://{host}" - defaults = { - "fa": "http://federation-authority:8000", - "provider": "http://provider:8002", - "rp": "http://relying-party:8001", - } - return defaults[kind] - - -TA = env("DJANGO_TRUST_ANCHOR") or infer_base_url("fa") -PROVIDER_ISSUER = env("DJANGO_PROVIDER_ISSUER") or f"{infer_base_url('provider')}/oidc/op" -RP_BASE = env("DJANGO_RP_BASE_URL") or infer_base_url("rp") -RP_ISSUER = f"{RP_BASE}/oidc/rp" -PROVIDER_BASE = PROVIDER_ISSUER.removesuffix("/oidc/op") - - -def rewrite_string(value: str) -> str: - return ( - value.replace("http://127.0.0.1:8000/oidc/op", TA + "/oidc/op") - .replace("http://127.0.0.1:8001/oidc/rp", RP_ISSUER) - .replace("http://127.0.0.1:8002/oidc/op", PROVIDER_ISSUER) - .replace("http://127.0.0.1:8000", TA) - .replace("http://127.0.0.1:8001", RP_BASE) - .replace("http://127.0.0.1:8002", PROVIDER_BASE) - .replace("http://provider:8002/oidc/op", PROVIDER_ISSUER) - .replace("http://provider:8002", PROVIDER_BASE) - .replace("http://relying-party:8001/oidc/rp", RP_ISSUER) - .replace("http://relying-party:8001", RP_BASE) - .replace("http://federation-authority:8000/oidc/op", TA + "/oidc/op") - .replace("http://federation-authority:8000", TA) - ) - - -REPLACEMENTS = [ - ("http://127.0.0.1:8000/oidc/op", TA + "/oidc/op"), - ("http://127.0.0.1:8001/oidc/rp", RP_ISSUER), - ("http://127.0.0.1:8002/oidc/op", PROVIDER_ISSUER), - ("http://127.0.0.1:8000", TA), - ("http://127.0.0.1:8001", RP_BASE), - ("http://127.0.0.1:8002", PROVIDER_BASE), - ("http://provider:8002/oidc/op", PROVIDER_ISSUER), - ("http://provider:8002", PROVIDER_BASE), - ("http://relying-party:8001/oidc/rp", RP_ISSUER), - ("http://relying-party:8001", RP_BASE), - ("http://federation-authority:8000/oidc/op", TA + "/oidc/op"), - ("http://federation-authority:8000", TA), -] - - -def deep_replace(value): - if isinstance(value, dict): - return {k: deep_replace(v) for k, v in value.items()} - if isinstance(value, list): - return [deep_replace(v) for v in value] - if isinstance(value, str): - return rewrite_string(value) - return value - - -def replace_in_all_text_columns(cur, table: str): - cols = cur.execute(f"PRAGMA table_info({table})").fetchall() - text_cols = [c[1] for c in cols if c[2] and c[2].upper() in {"TEXT", "VARCHAR(255)", "VARCHAR(2048)", "VARCHAR(64)", "VARCHAR(33)", "JSON"}] - for column in text_cols: - for old, new in REPLACEMENTS: - cur.execute( - f"UPDATE {table} SET {column} = REPLACE({column}, ?, ?) WHERE {column} LIKE ?", - (old, new, f"%{old}%"), - ) - - -def update_json_column(cur, table, pk, column): - rows = cur.execute(f"SELECT id, {column} FROM {table}").fetchall() - for row_id, raw in rows: - if not raw: - continue - try: - data = json.loads(raw) - except Exception: - continue - updated = deep_replace(data) - if updated != data: - cur.execute( - f"UPDATE {table} SET {column} = ? WHERE {pk} = ?", - (json.dumps(updated, ensure_ascii=False), row_id), - ) - - -def update_text_url_column(cur, table, pk, column): - rows = cur.execute(f"SELECT {pk}, {column} FROM {table}").fetchall() - for row_id, raw in rows: - if not raw: - continue - updated = rewrite_string(raw) - if updated != raw: - cur.execute( - f"UPDATE {table} SET {column} = ? WHERE {pk} = ?", - (updated, row_id), - ) - - -def main(): - if len(sys.argv) != 2: - raise SystemExit("usage: normalize_db_urls.py ") - - db_path = sys.argv[1] - if not os.path.exists(db_path): - raise SystemExit(0) - - conn = sqlite3.connect(db_path) - try: - cur = conn.cursor() - - tables = [ - row[0] - for row in cur.execute( - "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'" - ).fetchall() - ] - - for table in tables: - replace_in_all_text_columns(cur, table) - - for table in ( - "spid_cie_oidc_entity_federationentityconfiguration", - "spid_cie_oidc_entity_fetchedentitystatement", - "spid_cie_oidc_entity_trustchain", - ): - if table not in tables: - continue - - if table == "spid_cie_oidc_entity_federationentityconfiguration": - update_text_url_column(cur, table, "id", "sub") - update_json_column(cur, table, "id", "metadata") - update_json_column(cur, table, "id", "authority_hints") - update_json_column(cur, table, "id", "trust_marks") - update_json_column(cur, table, "id", "trust_mark_issuers") - update_json_column(cur, table, "id", "jwks_fed") - update_json_column(cur, table, "id", "jwks_core") - elif table == "spid_cie_oidc_entity_fetchedentitystatement": - update_text_url_column(cur, table, "id", "sub") - update_text_url_column(cur, table, "id", "iss") - update_json_column(cur, table, "id", "statement") - update_text_url_column(cur, table, "id", "jwt") - elif table == "spid_cie_oidc_entity_trustchain": - update_text_url_column(cur, table, "id", "sub") - update_json_column(cur, table, "id", "chain") - update_json_column(cur, table, "id", "metadata") - update_json_column(cur, table, "id", "jwks") - update_json_column(cur, table, "id", "parties_involved") - update_json_column(cur, table, "id", "trust_marks") - - conn.commit() - finally: - conn.close() - - -if __name__ == "__main__": - main()