Merge pull request #458 from Resgrid/develop

RG-T117 API CORS fix

Author: ucswift

Core/Resgrid.Config/ApiConfig.cs

@@ -20,7 +20,8 @@ public static class ApiConfig
 		/// to the API and eventing hubs, on top of the configured base urls, their subdomains and
 		/// their shared parent domain (see Resgrid.Config.CorsHelper). Entries with a scheme match
 		/// the exact origin ("http://localhost:8081"); bare hosts match that host on any scheme and
-		/// port ("dispatch.example.com"). A single "*" allows every origin — intended only for
+		/// port ("dispatch.example.com"); wildcard hosts match the apex and every subdomain on any
+		/// scheme and port ("*.resgrid.com"). A single "*" allows every origin — intended only for
 		/// isolated on-prem or development installs.
 		/// </summary>
 		public static string CorsAllowedOrigins = "";

Core/Resgrid.Config/CorsHelper.cs

@@ -8,8 +8,11 @@ namespace Resgrid.Config
 	/// An origin is allowed when it matches any of:
 	/// 1. An entry in <see cref="ApiConfig.CorsAllowedOrigins"/>. Entries with a scheme
 	///    ("http://localhost:8081") must match the origin's scheme, host and port exactly; bare
-	///    hosts ("dispatch.example.com") match that host on any scheme/port. A single "*" entry
-	///    allows every origin and is intended only for isolated on-prem or development installs.
+	///    hosts ("dispatch.example.com") match that host on any scheme/port; wildcard hosts
+	///    ("*.resgrid.com") match the apex and every subdomain on any scheme/port. An entry equal
+	///    to the raw Origin header value also matches verbatim, which covers desktop-app origins
+	///    like Electron's "app://." that are not standard URIs. A single "*" entry allows every
+	///    origin and is intended only for isolated on-prem or development installs.
 	/// 2. The host of one of the configured base urls (ResgridBaseUrl, ResgridApiBaseUrl,
 	///    ResgridEventingBaseUrl), or any subdomain of one of those hosts.
 	/// 3. The widest safe parent domain of a base-url host, or any subdomain of it. This is what
@@ -82,7 +85,16 @@ public static class CorsHelper
 		/// </summary>
 		public static bool IsAllowedOrigin(string origin)
 		{
-			if (String.IsNullOrWhiteSpace(origin) || !Uri.TryCreate(origin, UriKind.Absolute, out var originUri) || String.IsNullOrWhiteSpace(originUri.Host))
+			if (String.IsNullOrWhiteSpace(origin))
+				return false;
+
+			// Verbatim config match before URI parsing: desktop-app origins such as
+			// Electron's custom-scheme "app://." are not reliably parseable as absolute
+			// URIs, so an exact entry must be honored without going through Uri.
+			if (MatchesConfiguredOriginVerbatim(origin))
+				return true;
+
+			if (!Uri.TryCreate(origin, UriKind.Absolute, out var originUri) || String.IsNullOrWhiteSpace(originUri.Host))
 				return false;
 
 			if (MatchesConfiguredOrigin(originUri))
@@ -109,6 +121,25 @@ public static bool IsAllowedOrigin(string origin)
 			return false;
 		}
 
+		private static bool MatchesConfiguredOriginVerbatim(string origin)
+		{
+			var configured = ApiConfig.CorsAllowedOrigins;
+			if (String.IsNullOrWhiteSpace(configured))
+				return false;
+
+			foreach (var rawEntry in configured.Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
+			{
+				var entry = rawEntry.Trim();
+				if (entry.Length == 0)
+					continue;
+
+				if (entry == "*" || String.Equals(entry, origin, StringComparison.OrdinalIgnoreCase))
+					return true;
+			}
+
+			return false;
+		}
+
 		private static bool MatchesConfiguredOrigin(Uri originUri)
 		{
 			var configured = ApiConfig.CorsAllowedOrigins;
@@ -124,6 +155,17 @@ private static bool MatchesConfiguredOrigin(Uri originUri)
 				if (entry == "*")
 					return true;
 
+				if (entry.StartsWith("*.", StringComparison.Ordinal))
+				{
+					// Wildcard host: "*.resgrid.com" allows the apex and every subdomain,
+					// on any scheme and port.
+					var suffix = entry.Substring(2);
+					if (suffix.Length > 0 && HostMatchesOrIsSubdomainOf(originUri.Host, suffix))
+						return true;
+
+					continue;
+				}
+
 				if (entry.Contains("://"))
 				{
 					if (Uri.TryCreate(entry, UriKind.Absolute, out var entryUri) &&

Core/Resgrid.Framework/Logging.cs

@@ -108,6 +108,16 @@ public static void LogError(string message)
 
 		}
 
+		public static void LogWarning(string message)
+		{
+			Initialize(null);
+
+
+			if (_logger != null)
+				_logger.Warning(message);
+
+		}
+
 		public static void LogDebug(string message)
 		{
 			Initialize(null);

Core/Resgrid.Localization/Areas/User/Account/DeleteAccount.ar.resx

@@ -135,6 +135,9 @@
   <data name="DeleteAreYouSure3" xml:space="preserve">
     <value>يُرجى ملاحظة أن البيانات المقدمة إلى Resgrid لقسم ما تخص ذلك القسم وقد تخضع لسياسات الاحتفاظ بالبيانات والقوانين السارية في نطاق القسم. سيؤدي حذف حسابك إلى مسح معلوماتك الشخصية (PII) وحذف بيانات تسجيل الدخول، لكنه لن يمسح جميع البيانات. ستحتاج إلى تقديم طلب إلى القسم الذي كنت منتمياً إليه إذا كنت تريد مسح جميع البيانات.</value>
   </data>
+  <data name="DeleteAreYouSure4" xml:space="preserve">
+    <value>سيؤدي حذف حسابك إلى إلغاء تنشيطه في جميع الأقسام التي أنت عضو فيها، وليس فقط القسم الحالي. ستتم إزالة جميع الأتمتة المجدولة الخاصة بك (تسليم التقارير، وتغييرات الحالة المجدولة، وتغييرات التوظيف المجدولة)، وستتوقف عن تلقي الإشعارات والمراسلات من جميع الأقسام.</value>
+  </data>
   <data name="DepartmentOwnerError" xml:space="preserve">
     <value>لا يمكنك حذف حسابك لأنك مالك قسم. إذا كنت ترغب في حذف القسم، ستحتاج إلى الوصول إليه عبر صفحة إعدادات القسم. إذا كنت تريد الاحتفاظ بالقسم، فاختر شخصاً آخر ليكون مالكاً للقسم ثم حاول حذف حسابك مرة أخرى.</value>
   </data>

Core/Resgrid.Localization/Areas/User/Account/DeleteAccount.de.resx

@@ -86,6 +86,9 @@
   <data name="DeleteAreYouSure3" xml:space="preserve">
     <value>Please note, data supplied to Resgrid for a department is owned by that department and could be subject to data retention policies and laws governing the jurisdiction of the department. Deleting your account here will clear your PII (Personally Identifiable Information) and delete your login but won’t clear all data. You will need to make a request to the department you were apart of for additional if you want all data cleared.</value>
   </data>
+  <data name="DeleteAreYouSure4" xml:space="preserve">
+    <value>Wenn Sie Ihr Konto löschen, wird es in JEDER Abteilung deaktiviert, in der Sie Mitglied sind - nicht nur in Ihrer aktuellen. Alle Ihre geplanten Automatisierungen (Berichtszustellungen, geplante Statusänderungen und geplante Besetzungsänderungen) werden entfernt, und Sie erhalten keine Benachrichtigungen und Mitteilungen mehr von allen Abteilungen.</value>
+  </data>
   <data name="DepartmentOwnerError" xml:space="preserve">
     <value>You are unable to delete your account because you are a Department Owner in a department. If you wish to delete the department you will need to access that though the Department Settings page. If you want to retain the department please choose another person as the Department Owner and then try and delete your account again.</value>
   </data>

Core/Resgrid.Localization/Areas/User/Account/DeleteAccount.en.resx

@@ -135,6 +135,9 @@
   <data name="DeleteAreYouSure3" xml:space="preserve">
     <value>Please note, data supplied to Resgrid for a department is owned by that department and could be subject to data retention policies and laws governing the jurisdiction of the department. Deleting your account here will clear your PII (Personally Identifiable Information) and delete your login but won’t clear all data. You will need to make a request to the department you were apart of for additional if you want all data cleared.</value>
   </data>
+  <data name="DeleteAreYouSure4" xml:space="preserve">
+    <value>Deleting your account will deactivate it in EVERY department you are a member of, not just your current one. All of your scheduled automations (report deliveries, scheduled status changes and scheduled staffing changes) will be removed, and you will stop receiving notifications and communications from all departments.</value>
+  </data>
   <data name="DepartmentOwnerError" xml:space="preserve">
     <value>You are unable to delete your account because you are a Department Owner in a department. If you wish to delete the department you will need to access that though the Department Settings page. If you want to retain the department please choose another person as the Department Owner and then try and delete your account again.</value>
   </data>

Core/Resgrid.Localization/Areas/User/Account/DeleteAccount.es.resx

@@ -86,6 +86,9 @@
   <data name="DeleteAreYouSure3" xml:space="preserve">
     <value>Ten en cuenta que los datos suministrados a Resgrid para un departamento son propiedad de ese departamento y pueden estar sujetos a políticas de retención de datos. Eliminar tu cuenta aquí borrará tu información personal (PII) y tu acceso, pero no todos los datos.</value>
   </data>
+  <data name="DeleteAreYouSure4" xml:space="preserve">
+    <value>Eliminar su cuenta la desactivará en TODOS los departamentos de los que sea miembro, no solo en el actual. Todas sus automatizaciones programadas (entregas de informes, cambios de estado programados y cambios de personal programados) serán eliminadas, y dejará de recibir notificaciones y comunicaciones de todos los departamentos.</value>
+  </data>
   <data name="DepartmentOwnerError" xml:space="preserve">
     <value>No puedes eliminar tu cuenta porque eres propietario de un departamento. Si deseas eliminar el departamento, debes acceder a eso a través de la página de configuración del departamento. Si deseas conservar el departamento, elige a otra persona como propietario del departamento y luego intenta eliminar tu cuenta.</value>
   </data>

Core/Resgrid.Localization/Areas/User/Account/DeleteAccount.fr.resx

@@ -86,6 +86,9 @@
   <data name="DeleteAreYouSure3" xml:space="preserve">
     <value>Please note, data supplied to Resgrid for a department is owned by that department and could be subject to data retention policies and laws governing the jurisdiction of the department. Deleting your account here will clear your PII (Personally Identifiable Information) and delete your login but won’t clear all data. You will need to make a request to the department you were apart of for additional if you want all data cleared.</value>
   </data>
+  <data name="DeleteAreYouSure4" xml:space="preserve">
+    <value>La suppression de votre compte le désactivera dans TOUS les départements dont vous êtes membre, pas seulement dans votre département actuel. Toutes vos automatisations planifiées (envois de rapports, changements de statut planifiés et changements d'effectifs planifiés) seront supprimées, et vous ne recevrez plus de notifications ni de communications d'aucun département.</value>
+  </data>
   <data name="DepartmentOwnerError" xml:space="preserve">
     <value>You are unable to delete your account because you are a Department Owner in a department. If you wish to delete the department you will need to access that though the Department Settings page. If you want to retain the department please choose another person as the Department Owner and then try and delete your account again.</value>
   </data>

Core/Resgrid.Localization/Areas/User/Account/DeleteAccount.it.resx

@@ -86,6 +86,9 @@
   <data name="DeleteAreYouSure3" xml:space="preserve">
     <value>Please note, data supplied to Resgrid for a department is owned by that department and could be subject to data retention policies and laws governing the jurisdiction of the department. Deleting your account here will clear your PII (Personally Identifiable Information) and delete your login but won’t clear all data. You will need to make a request to the department you were apart of for additional if you want all data cleared.</value>
   </data>
+  <data name="DeleteAreYouSure4" xml:space="preserve">
+    <value>L'eliminazione del tuo account lo disattiverà in TUTTI i dipartimenti di cui sei membro, non solo in quello corrente. Tutte le tue automazioni pianificate (invii di report, cambi di stato pianificati e modifiche pianificate del personale) verranno rimosse e smetterai di ricevere notifiche e comunicazioni da tutti i dipartimenti.</value>
+  </data>
   <data name="DepartmentOwnerError" xml:space="preserve">
     <value>You are unable to delete your account because you are a Department Owner in a department. If you wish to delete the department you will need to access that though the Department Settings page. If you want to retain the department please choose another person as the Department Owner and then try and delete your account again.</value>
   </data>

Core/Resgrid.Localization/Areas/User/Account/DeleteAccount.pl.resx

@@ -86,6 +86,9 @@
   <data name="DeleteAreYouSure3" xml:space="preserve">
     <value>Please note, data supplied to Resgrid for a department is owned by that department and could be subject to data retention policies and laws governing the jurisdiction of the department. Deleting your account here will clear your PII (Personally Identifiable Information) and delete your login but won’t clear all data. You will need to make a request to the department you were apart of for additional if you want all data cleared.</value>
   </data>
+  <data name="DeleteAreYouSure4" xml:space="preserve">
+    <value>Usunięcie konta spowoduje jego dezaktywację w KAŻDYM dziale, którego jesteś członkiem, nie tylko w bieżącym. Wszystkie zaplanowane automatyzacje (dostarczanie raportów, zaplanowane zmiany statusu i zaplanowane zmiany obsady) zostaną usunięte, a Ty przestaniesz otrzymywać powiadomienia i komunikaty ze wszystkich działów.</value>
+  </data>
   <data name="DepartmentOwnerError" xml:space="preserve">
     <value>You are unable to delete your account because you are a Department Owner in a department. If you wish to delete the department you will need to access that though the Department Settings page. If you want to retain the department please choose another person as the Department Owner and then try and delete your account again.</value>
   </data>