Merge branch 'develop' into feature/MARP-562-SAST-security-scanning-f…

…or-code

.github/workflows/docker-build.yml

@@ -36,6 +36,9 @@ jobs:
           SERVICE_PASSWORD: ${{ secrets.SERVICE_PASSWORD }}
           MONGODB_DATABASE: ${{ secrets.MONGODB_DATABASE }}
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          MARKET_GITHUB_OAUTH_APP_CLIENT_ID: ${{ secrets.MARKET_GITHUB_OAUTH_APP_CLIENT_ID }}
+          MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET: ${{ secrets.MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET }}
+          MARKET_JWT_SECRET_KEY: ${{ secrets.MARKET_JWT_SECRET_KEY }}
         run: |
             sed -i "s/^MONGODB_INITDB_ROOT_USERNAME=.*$/MONGODB_INITDB_ROOT_USERNAME=$ROOT_USERNAME/" $ENV_FILE
             sed -i "s/^MONGODB_INITDB_ROOT_PASSWORD=.*$/MONGODB_INITDB_ROOT_PASSWORD=$ROOT_PASSWORD/" $ENV_FILE
@@ -44,6 +47,9 @@ jobs:
             sed -i "s/^SERVICE_MONGODB_USER=.*$/SERVICE_MONGODB_USER=$SERVICE_USERNAME/" $ENV_FILE
             sed -i "s/^SERVICE_MONGODB_PASSWORD=.*$/SERVICE_MONGODB_PASSWORD=$SERVICE_PASSWORD/" $ENV_FILE
             sed -i "s/^MARKET_GITHUB_TOKEN=.*$/MARKET_GITHUB_TOKEN=$GH_TOKEN/" $ENV_FILE
+            sed -i "s/^MARKET_GITHUB_OAUTH_APP_CLIENT_ID=.*$/MARKET_GITHUB_OAUTH_APP_CLIENT_ID=$MARKET_GITHUB_OAUTH_APP_CLIENT_ID/" $ENV_FILE
+            sed -i "s/^MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET=.*$/MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET=$MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET/" $ENV_FILE
+            sed -i "s/^MARKET_JWT_SECRET_KEY=.*$/MARKET_JWT_SECRET_KEY=$MARKET_JWT_SECRET_KEY/" $ENV_FILE
 
       - name: Build and bring up containers without cache
         working-directory: ./marketplace-build

marketplace-build/.env

@@ -5,4 +5,7 @@ SERVICE_MONGODB_USER=
 SERVICE_MONGODB_PASSWORD=
 SERVICE_MONGODB_DATABASE=
 MARKET_GITHUB_TOKEN=
-MARKETPLACE_INSTALLATION_URL=
+MARKETPLACE_INSTALLATION_URL=
+MARKET_GITHUB_OAUTH_APP_CLIENT_ID=
+MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET=
+MARKET_JWT_SECRET_KEY=

marketplace-build/config/nginx/nginx.conf

@@ -1,16 +1,28 @@
-events{}
+events {}
 
 http {
-    # include the default mime.types to map file extensions to MIME types
     include /etc/nginx/mime.types;
 
     server {
-        root /usr/share/nginx/html;
+        listen 80;
+        server_name marketplace;
 
+        root /usr/share/nginx/html;
         index index.html;
 
         location / {
             try_files $uri $uri/ /index.html;
         }
+
+        location /marketplace-service {
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-NginX-Proxy true;
+            proxy_pass http://service:8080/marketplace-service;
+            proxy_ssl_session_reuse off;
+            proxy_set_header Host $http_host;
+            proxy_cache_bypass $http_upgrade;
+            proxy_redirect off;
+        }
     }
-}
+}

marketplace-build/docker-compose.yml

@@ -2,7 +2,7 @@ name: marketplace
 
 services:
   mongodb:
-    container_name: marketplace-mongodb-7.0.0
+    container_name: marketplace-mongodb
     build:
       context: ./config/mongodb
       dockerfile: Dockerfile
@@ -42,6 +42,9 @@ services:
       - MONGODB_USERNAME=${SERVICE_MONGODB_USER}
       - MONGODB_PASSWORD=${SERVICE_MONGODB_PASSWORD}
       - MARKET_GITHUB_TOKEN=${MARKET_GITHUB_TOKEN}
+      - MARKET_GITHUB_OAUTH_APP_CLIENT_ID=${MARKET_GITHUB_OAUTH_APP_CLIENT_ID}
+      - MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET=${MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET}
+      - MARKET_JWT_SECRET_KEY=${MARKET_JWT_SECRET_KEY}
     build:
       context: ../marketplace-service
       dockerfile: Dockerfile
@@ -51,4 +54,4 @@ services:
       - mongodb
 
 volumes:
-  mongodata:
+  mongodata:

marketplace-build/release/.env

@@ -5,4 +5,7 @@ SERVICE_MONGODB_USER=
 SERVICE_MONGODB_PASSWORD=
 SERVICE_MONGODB_DATABASE=
 MARKET_GITHUB_TOKEN=
-MARKETPLACE_INSTALLATION_URL=
+MARKETPLACE_INSTALLATION_URL=
+MARKET_GITHUB_OAUTH_APP_CLIENT_ID=
+MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET=
+MARKET_JWT_SECRET_KEY=

marketplace-build/release/docker-compose.yml

@@ -33,5 +33,8 @@ services:
       - MONGODB_USERNAME=${SERVICE_MONGODB_USER}
       - MONGODB_PASSWORD=${SERVICE_MONGODB_PASSWORD}
       - MARKET_GITHUB_TOKEN=${MARKET_GITHUB_TOKEN}
+      - MARKET_GITHUB_OAUTH_APP_CLIENT_ID=${MARKET_GITHUB_OAUTH_APP_CLIENT_ID}
+      - MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET=${MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET}
+      - MARKET_JWT_SECRET_KEY=${MARKET_JWT_SECRET_KEY}
 volumes:
   mongodata:

marketplace-build/release/sprint-compose.yml

@@ -33,6 +33,9 @@ services:
       - MONGODB_USERNAME=${SERVICE_MONGODB_USER}
       - MONGODB_PASSWORD=${SERVICE_MONGODB_PASSWORD}
       - MARKET_GITHUB_TOKEN=${MARKET_GITHUB_TOKEN}
+      - MARKET_GITHUB_OAUTH_APP_CLIENT_ID=${MARKET_GITHUB_OAUTH_APP_CLIENT_ID}
+      - MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET=${MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET}
+      - MARKET_JWT_SECRET_KEY=${MARKET_JWT_SECRET_KEY}
 volumes:
   mongodata:
 

marketplace-service/src/main/java/com/axonivy/market/controller/FeedbackController.java

@@ -16,6 +16,7 @@
 import org.springframework.hateoas.PagedModel;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -70,12 +71,13 @@ public ResponseEntity<FeedbackModel> findFeedback(@PathVariable("id") String id)
 
   @Operation(summary = "Find all feedbacks by user id and product id")
   @GetMapping()
-  public ResponseEntity<FeedbackModel> findFeedbackByUserIdAndProductId(@RequestParam String userId,
-      @RequestParam String productId) {
+  public ResponseEntity<FeedbackModel> findFeedbackByUserIdAndProductId(@RequestParam("userId") String userId,
+      @RequestParam("productId") String productId) {
     Feedback feedback = feedbackService.findFeedbackByUserIdAndProductId(userId, productId);
     return ResponseEntity.ok(feedbackModelAssembler.toModel(feedback));
   }
 
+  @CrossOrigin("*")
   @PostMapping
   public ResponseEntity<Void> createFeedback(@RequestBody @Valid FeedbackModel feedback,
       @RequestHeader(value = "Authorization", required = false) String authorizationHeader) {

marketplace-service/src/main/java/com/axonivy/market/controller/OAuth2Controller.java

@@ -8,6 +8,7 @@
 import com.axonivy.market.service.JwtService;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -34,6 +35,7 @@ public OAuth2Controller(GitHubService gitHubService, JwtService jwtService) {
     this.jwtService = jwtService;
   }
 
+  @CrossOrigin("*")
   @PostMapping("/github/login")
   public ResponseEntity<Object> gitHubLogin(@RequestBody Oauth2AuthorizationCode oauth2AuthorizationCode) {
     GitHubAccessTokenResponse tokenResponse = gitHubService.getAccessToken(oauth2AuthorizationCode.getCode(), clientId,

marketplace-service/src/main/resources/application.properties

@@ -11,7 +11,7 @@ market.cors.allowed.origin.maxAge=3600
 synchronized.installation.counts.path=/home/data/market-installation.json
 market.github.token=${MARKET_GITHUB_TOKEN}
 logging.level.org.springframework.security=DEBUG
-spring.security.oauth2.client.registration.github.client-id=<replace-with-your-client-id>
-spring.security.oauth2.client.registration.github.client-secret=<replace-with-your-client-secret>
-jwt.secret=<replace-with-jwt-secret>
+spring.security.oauth2.client.registration.github.client-id=${MARKET_GITHUB_OAUTH_APP_CLIENT_ID}
+spring.security.oauth2.client.registration.github.client-secret=${MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET}
+jwt.secret=${MARKET_JWT_SECRET_KEY}
 jwt.expiration=365

marketplace-service/src/test/java/com/axonivy/market/service/SchedulingTasksTest.java

@@ -10,8 +10,10 @@
 import static org.mockito.Mockito.atLeast;
 import static org.mockito.Mockito.verify;
 
-@SpringBootTest(properties = { "MONGODB_USERNAME=user", "MONGODB_PASSWORD=password", "MONGODB_HOST=mongoHost",
-    "MONGODB_DATABASE=product" })
+@SpringBootTest(properties = { "MONGODB_USERNAME=user",
+    "MONGODB_PASSWORD=password", "MONGODB_HOST=mongoHost", "MONGODB_DATABASE=product",
+    "MARKET_GITHUB_OAUTH_APP_CLIENT_ID=clientId", "MARKET_GITHUB_OAUTH_APP_CLIENT_SECRET=clientSecret",
+    "MARKET_JWT_SECRET_KEY=jwtSecret" })
 class SchedulingTasksTest {
 
   @SpyBean

marketplace-ui/Dockerfile

@@ -6,6 +6,6 @@ RUN npm install
 RUN npm run build --prod
 
 # Stage 2: Serve Angular app using Nginx
-FROM nginx:alpine
+FROM nginx
 COPY --from=build-angular /app/dist/browser /usr/share/nginx/html
 COPY --from=assets config/nginx/nginx.conf /etc/nginx/nginx.conf

marketplace-ui/src/app/auth/auth.service.ts

@@ -28,7 +28,7 @@ export class AuthService {
   private readonly BASE_URL = environment.apiUrl;
   private readonly TOKEN_KEY = 'token';
   private readonly githubAuthUrl = 'https://github.com/login/oauth/authorize';
-  private readonly githubAuthCallbackUrl = environment.githubAuthCallbackUrl;
+  private readonly githubAuthCallbackUrl = window.location.origin + environment.githubAuthCallbackPath;
 
   constructor(
     private readonly http: HttpClient,

marketplace-ui/src/app/core/interceptors/api.interceptor.ts

@@ -24,7 +24,7 @@ export const apiInterceptor: HttpInterceptorFn = (req, next) => {
   }
   let requestURL = req.url;
   const apiURL = environment.apiUrl;
-  if (!requestURL.startsWith(apiURL)) {
+  if (!requestURL.includes(apiURL)) {
     requestURL = `${apiURL}/${req.url}`;
   }
 

marketplace-ui/src/app/modules/product/product-detail/product-detail-feedback/product-detail-feedback.component.spec.ts

@@ -95,13 +95,6 @@ describe('ProductDetailFeedbackComponent', () => {
     expect(component).toBeTruthy();
   });
 
-  it('should initialize feedbacks and star ratings on ngOnInit', () => {
-    expect(
-      mockProductFeedbackService.findProductFeedbackOfUser
-    ).toHaveBeenCalled();
-    expect(mockProductStarRatingService.fetchData).toHaveBeenCalled();
-  });
-
   it('should render ProductStarRatingPanelComponent and ProductFeedbacksPanelComponent', () => {
     const starRatingPanel = fixture.debugElement.query(
       By.directive(ProductStarRatingPanelComponent)

marketplace-ui/src/app/modules/product/product-detail/product-detail-feedback/product-detail-feedback.component.ts

@@ -1,21 +1,16 @@
 import {
-  AfterViewInit,
   Component,
   computed,
   inject,
   input,
-  OnInit,
   Signal
 } from '@angular/core';
 import { ProductStarRatingPanelComponent } from './product-star-rating-panel/product-star-rating-panel.component';
 import { ShowFeedbacksDialogComponent } from './show-feedbacks-dialog/show-feedbacks-dialog.component';
 import { ProductFeedbacksPanelComponent } from './product-feedbacks-panel/product-feedbacks-panel.component';
 import { AppModalService } from '../../../../shared/services/app-modal.service';
-import { ActivatedRoute, Router } from '@angular/router';
 import { ProductFeedbackService } from './product-feedbacks-panel/product-feedback.service';
-import { AuthService } from '../../../../auth/auth.service';
 import { TranslateModule } from '@ngx-translate/core';
-import { ProductStarRatingService } from './product-star-rating-panel/product-star-rating.service';
 
 const MAX_ELEMENTS = 6;
 
@@ -31,7 +26,7 @@ const MAX_ELEMENTS = 6;
   templateUrl: './product-detail-feedback.component.html',
   styleUrls: ['./product-detail-feedback.component.scss']
 })
-export class ProductDetailFeedbackComponent implements OnInit, AfterViewInit {
+export class ProductDetailFeedbackComponent {
   isMobileMode = input<boolean>();
   isShowBtnMore: Signal<boolean> = computed(() => {
     if (
@@ -46,42 +41,14 @@ export class ProductDetailFeedbackComponent implements OnInit, AfterViewInit {
 
   productFeedbackService = inject(ProductFeedbackService);
   appModalService = inject(AppModalService);
-  private readonly productStarRatingService = inject(ProductStarRatingService);
-  private readonly authService = inject(AuthService);
-  private readonly route = inject(ActivatedRoute);
-  private readonly router = inject(Router);
 
   showPopup!: boolean;
 
-  ngOnInit(): void {
-    this.productFeedbackService.findProductFeedbackOfUser();
-    this.productStarRatingService.fetchData();
-  }
-
-  ngAfterViewInit(): void {
-    this.route.queryParams.subscribe(params => {
-      this.showPopup = params['showPopup'] === 'true';
-      if (this.showPopup && this.authService.getToken()) {
-        this.appModalService.openAddFeedbackDialog().then(
-          () => this.removeQueryParam(),
-          () => this.removeQueryParam()
-        );
-      }
-    });
-  }
-
   openShowFeedbacksDialog(): void {
     if (this.isMobileMode()) {
       this.productFeedbackService.loadMoreFeedbacks();
     } else {
       this.appModalService.openShowFeedbacksDialog();
     }
   }
-
-  private removeQueryParam(): void {
-    this.router.navigate([], {
-      queryParams: { showPopup: null },
-      queryParamsHandling: 'merge'
-    });
-  }
 }

marketplace-ui/src/app/modules/product/product-detail/product-detail-feedback/product-feedbacks-panel/product-feedback.service.spec.ts

@@ -112,22 +112,4 @@ describe('ProductFeedbackService', () => {
 
     expect(service.feedbacks()).toEqual([{ content: 'Sorting test', rating: 3, productId: '123' }]);
   });
-
-  it('should find product feedback of user', () => {
-    const mockFeedback: Feedback = {
-      content: 'User feedback',
-      rating: 5,
-      productId: '123'
-    };
-
-    authService.getUserId.and.returnValue('user123');
-    productDetailService.productId.and.returnValue('123');
-
-    service.findProductFeedbackOfUser();
-    const req = httpMock.expectOne('api/feedback?productId=123&userId=user123');
-    expect(req.request.method).toBe('GET');
-    req.flush(mockFeedback);
-
-    expect(service.userFeedback()).toEqual(mockFeedback);
-  });
 });

marketplace-ui/src/app/modules/product/product-detail/product-detail-feedback/product-feedbacks-panel/product-feedback.service.ts

@@ -58,7 +58,7 @@ export class ProductFeedbackService {
       .pipe(
         tap(() => {
           this.initFeedbacks();
-          this.findProductFeedbackOfUser();
+          this.findProductFeedbackOfUser().subscribe();
           this.productStarRatingService.fetchData();
         })
       );
@@ -96,13 +96,13 @@ export class ProductFeedbackService {
 
   findProductFeedbackOfUser(
     productId: string = this.productDetailService.productId()
-  ): void {
+  ): Observable<Feedback> {
     const params = new HttpParams()
       .set('productId', productId)
       .set('userId', this.authService.getUserId() ?? '');
     const requestURL = FEEDBACK_API_URL;
 
-    this.http
+    return this.http
       .get<Feedback>(requestURL, {
         params,
         context: new HttpContext().set(SkipLoading, true)
@@ -120,8 +120,7 @@ export class ProductFeedbackService {
           this.userFeedback.set(feedback);
           return of(feedback);
         })
-      )
-      .subscribe();
+      );
   }
 
   initFeedbacks(): void {

marketplace-ui/src/app/modules/product/product-detail/product-detail-feedback/product-star-rating-panel/add-feedback-dialog/add-feedback-dialog.component.html

@@ -27,7 +27,7 @@ <h5 class="text-secondary">
       <p class="text-secondary mb-2">
         {{ 'common.feedback.starRatingTitle' | translate }}
       </p>
-      <app-star-rating [rate]="feedback.rating" (rateChange)="onRateChange($event)" [starClass]="'adding-feedback-star'" />
+      <app-star-rating [rate]="feedback.rating" (rateChange)="onRateChange($event)" [starClass]="'adding-feedback-star'" [ratingStarsClass]="'rating-stars'" />
       <p class="text-secondary mb-2 mt-3">
         {{ 'common.feedback.commentLabel' | translate }}
       </p>

marketplace-ui/src/app/modules/product/product-detail/product-detail-feedback/product-star-rating-panel/product-star-rating.service.ts

@@ -1,4 +1,4 @@
-import { HttpClient } from '@angular/common/http';
+import { HttpClient, HttpContext } from '@angular/common/http';
 import {
   computed,
   inject,
@@ -10,6 +10,7 @@ import {
 import { tap } from 'rxjs';
 import { StarRatingCounting } from '../../../../../shared/models/star-rating-counting.model';
 import { ProductDetailService } from '../../product-detail.service';
+import { SkipLoading } from '../../../../../core/interceptors/api.interceptor';
 
 @Injectable({
   providedIn: 'root'
@@ -29,7 +30,7 @@ export class ProductStarRatingService {
   fetchData(productId: string = this.productDetailService.productId()): void {
     const requestURL = `api/feedback/product/${productId}/rating`;
     this.http
-      .get<StarRatingCounting[]>(requestURL)
+      .get<StarRatingCounting[]>(requestURL, {context: new HttpContext().set(SkipLoading, true)})
       .pipe(
         tap(data => {
           this.sortByStar(data);