Dav: configuration of security for allowing dav endpoints

Reviewed-on: Chill-project/chill-skeleton-basic#2

.drone.yml

@@ -21,7 +21,7 @@ steps:
           registry: h3m6q87t.gra7.container-registry.ovh.net
           repo: h3m6q87t.gra7.container-registry.ovh.net/chillbasics/php-base
           tag: latest
-          target: chill_base_php
+          target: chill_base_php82
           pull_image: true
           cache_from:
               - h3m6q87t.gra7.container-registry.ovh.net/chillbasics/php-base:latest
@@ -79,3 +79,38 @@ steps:
           Dockerfile: docker/nginx/Dockerfile
       depends_on:
           - build-assets
+
+---
+
+kind: pipeline
+type: docker
+name: build-base-image-php82
+
+trigger:
+    event:
+        - cron
+        - push
+    cron:
+        - base-image-php82
+
+steps:
+    - name: build-base-image
+      image: plugins/docker
+      settings:
+          username:
+              from_secret: docker_username_gitea
+          password:
+              from_secret: docker_password_gitea
+          registry: gitea.champs-libres.be/chill-project/chill-skeleton-basic
+          repo: gitea.champs-libres.be/chill-project/chill-skeleton-basic/base-image
+          tag:
+            - php82
+            - latest
+          target: chill_base_php82
+          pull_image: true
+
+---
+kind: signature
+hmac: 707a5ef589fb6320f9e9e1dec7d8d4d11b477ba09e3b2b08d6f31f98d6d3f5d0
+
+...

.env.dev

@@ -11,3 +11,5 @@ MAILER_URL=smtp://smtp:1025
 PGADMIN_DEFAULT_EMAIL=admin@chill.social
 PGADMIN_DEFAULT_PASSWORD=password
 
+## Phpstorm IDE project path
+PROJECT_DIR=

.gitignore

@@ -9,6 +9,7 @@ config/secrets/
 
 ## env files
 .env.local
+.env.dev.local
 
 .composer/*
 composer.phar
@@ -49,17 +50,18 @@ phpunit.xml
 nbproject/*
 
 .idea
+.ignore
 
 ### template/api/specs.yaml should be compiled
 templates/api/specs.yaml
 
-
 ###> symfony/webpack-encore-bundle ###
 /node_modules/
 /public/build/
 npm-debug.log
 yarn-error.log
 ###< symfony/webpack-encore-bundle ###
+
 ###> symfony/phpunit-bridge ###
 .phpunit
 .phpunit.result.cache

Dockerfile

@@ -1,4 +1,4 @@
-FROM php:7.4-fpm-buster AS chill_base_php
+FROM php:8.2-fpm-alpine AS chill_base_php82
 
 ENV POSTGRES_VERSION 14
 
@@ -6,27 +6,31 @@ ENV POSTGRES_VERSION 14
 ARG UID=1000
 ARG GID=1000
 
-RUN apt update && apt -y --no-install-recommends install wget gnupg  \
-   && wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc |  apt-key add - \
-   && echo "deb http://apt.postgresql.org/pub/repos/apt/ buster-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
-   && apt update && apt -y --no-install-recommends install \
-      libicu-dev \
-      g++ \
-      postgresql-server-dev-$POSTGRES_VERSION \
-      libzip-dev libzip4 unzip \
-      libfreetype6-dev \
-      libonig-dev `# install oniguruma, required for mbstring` \
-      libpng-dev \
-      libjpeg62-turbo-dev \
-      git \
-   && docker-php-ext-configure gd --with-freetype --with-jpeg \
-   && docker-php-ext-install -j$(nproc) gd \
-   && docker-php-ext-install intl pdo_pgsql mbstring zip bcmath sockets exif \
+# install php extensions and deps
+RUN apk update && apk add --no-cache \
+    wget gnupg \
+    libpq-dev \
+    icu-dev icu-libs icu-data-full \
+    oniguruma-dev \
+    libzip libzip-dev \
+    linux-headers \
+    gcc g++ make autoconf \
+    bash git \
+    && docker-php-ext-install pdo_pgsql intl mbstring zip bcmath exif sockets \
+    && git clone https://github.com/nikic/php-ast.git \
+    && cd php-ast \
+    && phpize \
+    && ./configure \
+    && make install \
+    && echo 'extension=ast.so' > /usr/local/etc/php/php.ini \
+    && cd .. && rm -rf php-ast \
     && pecl install redis \
     && docker-php-ext-enable redis \
-   && apt remove -y wget libicu-dev g++ gnupg libzip-dev \
-   && apt autoremove -y \
-   && apt purge -y
+    && apk add libpng-dev libjpeg-turbo-dev freetype-dev \
+    && docker-php-ext-configure gd --with-freetype --with-jpeg \
+    && docker-php-ext-install -j$(nproc) gd \
+    && apk add postgresql${POSTGRES_VERSION}-client \
+    && apk del --purge wget gnupg libpq-dev icu-dev oniguruma-dev libzip-dev linux-headers gcc g++ make autoconf
 
 RUN { \
     echo ""; \
@@ -41,15 +45,31 @@ RUN { \
     echo ""; \
     } >> /usr/local/etc/php/conf.d/date.ini
 
+# temporary fix, while php-cs-fixer has conflict dependencies
+# with chill
+RUN curl -o /usr/local/bin/php-cs-fixer https://cs.symfony.com/download/php-cs-fixer-v3.phar \
+    && chmod +x /usr/local/bin/php-cs-fixer
+# to make php-cs-fixer works with php 8.2
+ENV PHP_CS_FIXER_IGNORE_ENV=1
+
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 ENV COMPOSER_ALLOW_SUPERUSER=1
 ENV COMPOSER_MEMORY_LIMIT=-1
 
+# shell bash preference
+RUN sed -i " \
+    s|root:x:0:0:root:/root:/bin/ash|root:x:0:0:root:/root:/bin/bash|g; \
+    s|postgres:x:70:70:PostgreSQL user:/var/lib/postgresql:/bin/sh|postgres:x:70:70:PostgreSQL user:/var/lib/postgresql:/bin/bash|g" \
+    /etc/passwd
+
+# chmod on redis.so
+RUN chmod 755 -R /usr/local/lib/php/extensions/
+
 WORKDIR /var/www/app
 
 CMD ["php-fpm"]
 
-FROM chill_base_php AS chill_php
+FROM chill_base_php82 AS chill_php82
 
 # copy directories
 

Makefile

@@ -2,12 +2,12 @@ THIS_FILE := $(lastword $(MAKEFILE_LIST))
 PWD:=$(shell echo ${PWD})
 UID:=$(shell id -u)
 GID:=$(shell id -g)
-BASE_TAG=chill_base_php
+BASE_TAG=chill_base_php82
 DOCKERNODE_CMD=docker run --rm --user ${UID}:${GID} -v ${PWD}:/app --workdir /app -e YARN_CACHE_FOLDER=/app/.yarncache node:16
 DOCKER_COMPOSE_PHP_EXEC_CMD=docker-compose run --rm --user $(UID):$(GID) -e CLEAR_CACHE=false -e COMPOSER_HOME=/var/www/app/.composer --entrypoint /usr/bin/env php
 DOCKER_PHP_EXEC_CMD_BASE=docker run --rm --user $(UID):$(GID) -v ${PWD}:/var/www/app -e CLEAR_CACHE=false -e COMPOSER_HOME=/var/www/app/.composer --entrypoint /usr/bin/env $(BASE_TAG)
-PHP_BASE_IMAGE=php:7.4-fpm-buster
-PHP_BASE_IMAGE_CHILL=chill_base_php
+PHP_BASE_IMAGE=php:8.2-fpm-alpine
+PHP_BASE_IMAGE_CHILL=chill_php82
 NGINX_BASE_IMAGE=nginx
 CALVER=$(shell date "+v%Y%m%d%H%M")-${CALVERSION}
 ifneq (,$(wildcard ./.env))
@@ -39,7 +39,7 @@ build-assets:
 	$(DOCKERNODE_CMD) yarn run encore production
 
 init:
-	docker build --target chill_base_php -t $(BASE_TAG) .
+	docker build --target $(PHP_BASE_IMAGE_CHILL) -t $(BASE_TAG) .
 	$(DOCKER_PHP_EXEC_CMD_BASE) composer update --no-scripts --no-interaction
 	@$(MAKE) -f $(THIS_FILE) build-assets
 	@$(MAKE) -f $(THIS_FILE) post-install

composer.json

@@ -15,7 +15,7 @@
     },
     "require": {
         "ext-redis": "*",
-        "chill-project/chill-bundles": "dev-43-wopi-use-access-token@dev",
+        "chill-project/chill-bundles": "dev-master#00e62442ccd3695f3a418d192977672166f85427",
         "symfony/flex": "^1.9",
         "symfony/http-client": "^4.4 || ^5",
         "nelmio/alice": "^3.8",
@@ -23,8 +23,7 @@
         "phpstan/phpstan": "^1.0",
         "spomky-labs/base64url": "^2.0",
         "twig/string-extra": "^3.3",
-        "symfony/mailer": "^5.4",
-        "symfony/dependency-injection": "5.4.16"
+        "symfony/mailer": "^5.4"
     },
     "require-dev": {
         "fakerphp/faker": "^1.13",
@@ -37,8 +36,7 @@
         "symfony/web-profiler-bundle": "^5.0",
         "symfony/var-dumper": "4.*",
         "symfony/phpunit-bridge": "^5.2",
-        "symfony/debug-bundle": "^5.1",
-        "box/spout": "^3.3"
+        "symfony/debug-bundle": "^5.1"
     },
     "minimum-stability": "dev",
     "prefer-stable": true,

config/bundles.php

@@ -13,7 +13,6 @@ return [
     Doctrine\Bundle\FixturesBundle\DoctrineFixturesBundle::class => ['dev' => true, 'test' => true],
     Symfony\Bundle\WebProfilerBundle\WebProfilerBundle::class => ['dev' => true, 'test' => true],
     Symfony\Bundle\DebugBundle\DebugBundle::class => ['dev' => true, 'test' => true],
-    Symfony\Bundle\SwiftmailerBundle\SwiftmailerBundle::class => ['all' => true],
     Knp\Bundle\MenuBundle\KnpMenuBundle::class => ['all' => true],
     Knp\Bundle\TimeBundle\KnpTimeBundle::class => ['all' => true],
     ChampsLibres\AsyncUploaderBundle\ChampsLibresAsyncUploaderBundle::class => ['all' => true],

config/packages/chill_budget.yaml

@@ -56,7 +56,6 @@ chill_budget:
             - { key: mutuelle, labels: [{lang: fr, label: "Mutuelle"}]}
             - { key: transport, labels: [{lang: fr, label: "Frais de transport"}]}
             - { key: decouvbank, labels: [{lang: fr, label: "Découvert bancaire utilisé"}]}
-            - { key: credit, labels: [{lang: fr, label: "Procédure de saisie"}]}
             - { key: procsaisie, labels: [{lang: fr, label: "Procédure de saisie"}]}
             - { key: indus, labels: [{lang: fr, label: "Indus"}]}
             - { key: apurement, labels: [{lang: fr, label: "Plan d'apurement"}]}
@@ -82,6 +81,5 @@ chill_budget:
             - { key: debt_bank, labels: [{lang: fr, label: "Dette de découvert bancaire utilisé"}]}
             - { key: debt_garbage, labels: [{lang: fr, label: "Dette de taxe d’ordures ménagère"}]}
             - { key: debt_other, labels: [{lang: fr, label: "Dette autre"}]}
-            - { key: credit, labels: [{lang: fr, label: "Crédit"}]}
             - { key: autre, labels: [{lang: fr, label: "Autre"}]}
 

config/packages/dev/framework.yaml

@@ -3,3 +3,10 @@ framework:
         # allow to debug from ngrok, useful for webhooks coming from outside:
         - '^(.+\.)?ngrok\.io$'
         - 'nginx'
+
+    ## Open files in phpstorm IDE from profiler links
+    # ref: https://symfony.com/doc/current/reference/configuration/framework.html#ide
+    # need: https://github.com/sanduhrs/phpstorm-url-handler/blob/master/phpstorm-url-handler
+    # set var in file .env.dev.local (PROJECT_DIR=<relative path from home folder>)
+    ide: 'phpstorm://open?file=%%f&line=%%l&/var/www/app/>%env(resolve:PROJECT_DIR)%'
+

config/packages/dev/swiftmailer.yaml

@@ -1,4 +0,0 @@
-# See https://symfony.com/doc/current/email/dev_environment.html
-swiftmailer:
-    # send all emails to a specific address
-    #delivery_addresses: ['me@example.com']

config/packages/messenger.yaml

@@ -9,6 +9,8 @@ framework:
         transports:
             # https://symfony.com/doc/current/messenger.html#transport-configuration
             async: '%env(MESSENGER_TRANSPORT_DSN)%'
+            priority:
+                dsn: '%env(MESSENGER_TRANSPORT_DSN)%'
             failed: 'doctrine://default?queue_name=failed'
             # sync: 'sync://'
 
@@ -22,3 +24,4 @@ framework:
             'Chill\CalendarBundle\Messenger\Message\InviteUpdateMessage': async
             'Chill\CalendarBundle\Messenger\Message\MSGraphChangeNotificationMessage': async
             'Chill\MainBundle\Service\ShortMessage\ShortMessage': async
+            'Chill\DocGeneratorBundle\Service\Messenger\RequestGenerationMessage': priority

config/packages/prod/lexik_jwt_authentication.yaml

@@ -7,4 +7,3 @@ lexik_jwt_authentication:
     # then copy past the printed string into the dedicated environment variable
     secret_key: '%env(base64:resolve:JWT_SECRET_KEY)%'
     public_key: '%env(base64:resolve:JWT_PUBLIC_KEY)%'
-    pass_phrase: '%env(JWT_PASSPHRASE)%'

config/packages/security.yaml

@@ -29,6 +29,14 @@ security:
             pattern: ^/(_(profiler|wdt)|css|images|js)/
             security: false
 
+        dav:
+            pattern: ^/dav
+            provider: chain_provider
+            stateless: true
+            guard:
+                authenticators:
+                    - Chill\DocStoreBundle\Security\Guard\JWTOnDavUrlAuthenticator
+
         wopi:
             pattern: ^/wopi
             provider: chain_provider

config/packages/swiftmailer.yaml

@@ -1,3 +0,0 @@
-swiftmailer:
-    url: '%env(MAILER_URL)%'
-    spool: { type: 'memory' }

config/packages/test/swiftmailer.yaml

@@ -1,2 +0,0 @@
-swiftmailer:
-    disable_delivery: true

config/packages/wopi.yaml

@@ -1,2 +1,3 @@
 wopi:
   server: "%env(resolve:WOPI_SERVER)%"
+  enable_lock: false

docker-compose.dev.yml

@@ -8,7 +8,7 @@ services:
       args:
         UID: ${PHP_FPM_USER:-1000}
     # uncomment and set your own image if needed
-    image: ${IMAGE_PHP-chill_php}:${VERSION:-latest}
+    image: ${IMAGE_PHP-chill_php82}:${VERSION:-latest}
     volumes:
       - .:/var/www/app
     environment:

docker-compose.prod.yml

@@ -10,7 +10,7 @@ services:
       args:
         UID: ${PHP_FPM_USER:-1000}
     # uncomment and set your own image if needed
-    image: ${IMAGE_PHP-chill_php}:${VERSION:-latest}
+    image: ${IMAGE_PHP-chill_php82}:${VERSION:-latest}
     #
     # normally, you should not mount any volume and use your own image
     #

docker-compose.yml

@@ -8,7 +8,7 @@ services:
       args:
         UID: ${PHP_FPM_USER:-1000}
     # uncomment and set your own image if needed
-    image: ${IMAGE_PHP:-chill_php}:${VERSION:-latest}
+    image: ${IMAGE_PHP:-chill_php82}:${VERSION:-latest}
     volumes:
       - .:/var/www/app
     environment:

symfony.lock

@@ -1,7 +1,4 @@
 {
-    "box/spout": {
-        "version": "v3.3.0"
-    },
     "brick/math": {
         "version": "0.9.3"
     },
@@ -358,9 +355,6 @@
     "psr/http-message": {
         "version": "1.0.1"
     },
-    "psr/link": {
-        "version": "1.0.0"
-    },
     "psr/log": {
         "version": "1.1.3"
     },
@@ -454,9 +448,6 @@
     "spomky-labs/base64url": {
         "version": "v2.0.4"
     },
-    "swiftmailer/swiftmailer": {
-        "version": "v6.2.5"
-    },
     "symfony/asset": {
         "version": "v4.4.11"
     },
@@ -662,9 +653,6 @@
     "symfony/polyfill-ctype": {
         "version": "v1.18.0"
     },
-    "symfony/polyfill-iconv": {
-        "version": "v1.22.0"
-    },
     "symfony/polyfill-intl-grapheme": {
         "version": "v1.18.0"
     },
@@ -751,20 +739,6 @@
     "symfony/string": {
         "version": "v5.1.3"
     },
-    "symfony/swiftmailer-bundle": {
-        "version": "2.5",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "master",
-            "version": "2.5",
-            "ref": "ae4d22af30bbd484506bc1817c5a3ef72c855b93"
-        },
-        "files": [
-            "config/packages/dev/swiftmailer.yaml",
-            "config/packages/swiftmailer.yaml",
-            "config/packages/test/swiftmailer.yaml"
-        ]
-    },
     "symfony/templating": {
         "version": "v4.4.11"
     },
@@ -820,9 +794,6 @@
     "symfony/var-exporter": {
         "version": "v5.1.3"
     },
-    "symfony/web-link": {
-        "version": "v5.2.12"
-    },
     "symfony/web-profiler-bundle": {
         "version": "3.3",
         "recipe": {

translations/messages.fr.yaml

@@ -14,13 +14,6 @@ Save activity: Sauver l'échange
 'The form is not valid. The activity has not been created !': Le formulaire est invalide. L'échange n'a pas été créé.
 'Success : activity updated!': L'échange a été mis à jour.
 'The form is not valid. The activity has not been updated !': Le formulaire est invalide. L'échange n'a pas été mis à jour.
-CHILL_ACTIVITY_CREATE: Créer un échange
-CHILL_ACTIVITY_UPDATE: Modifier un échange
-CHILL_ACTIVITY_SEE: Voir un échange
-CHILL_ACTIVITY_SEE_DETAILS: Voir le détail des échanges
-CHILL_ACTIVITY_DELETE: Supprimer un échange
-CHILL_ACTIVITY_STATS: Statistique des échanges
-CHILL_ACTIVITY_LIST: Liste des échanges
 Activity configuration: Configuration des échanges
 Activity configuration menu: Configuration des échanges
 Activity Types: Types d'échange