TECH_DEBT: Improvements (#1338)

* Moving most env variables from docker-compose.yml file to individual docker profiles within the services

* Hardening the UI service (Node/Express) so that it responds with 404 on common routes used for attacks

* Ensuring that indexes are auto-created in the report service's startup

* CodeRabbit fixes to remove excessive routing block, and make query-dispatch dependent on mssql instead of mongo

* Fixed issue with tenant service url being specified in the wrong location, and removed some defaults from the Docker.

* Removing issuer uri from .env and associated references in docker-compose. Adding comments to code about the necessity of the `Dummy` class.

Author: seanmcilvenna

DotNet/Report/Domain/MongoIndexCreationService.cs

@@ -7,7 +7,7 @@ public class MongoIndexCreationService : BackgroundService
     {
         private readonly ILogger<MongoIndexCreationService> _logger;
         private readonly IServiceScopeFactory _serviceScopeFactory;
-        public MongoIndexCreationService(ILogger<MongoIndexCreationService> logger, IServiceScopeFactory factory) 
+        public MongoIndexCreationService(ILogger<MongoIndexCreationService> logger, IServiceScopeFactory factory)
         {
             _logger = logger;
             _serviceScopeFactory = factory;

Java/measureeval/src/main/java/com/lantanagroup/link/measureeval/configs/SecurityConfig.java

@@ -3,6 +3,8 @@
 import com.lantanagroup.link.shared.auth.JwtAuthenticationEntryPoint;
 import com.lantanagroup.link.shared.auth.JwtAuthenticationFilter;
 import com.lantanagroup.link.shared.security.SecurityHelper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
@@ -39,10 +41,20 @@ public SecurityFilterChain securityFilterChain (HttpSecurity http) throws Except
     }
   }
 
+    /**
+     * This class is necessary to support @PreAuthorize and @PostAuthorize when
+     * anonymous mode is enabled. The condition causes the Dummy class to get registered
+     * and for the @EnableMethodSecurity to be applied, which affects all classes, enabling @PreAuthorize/@PostAuthorize
+     */
   @ConditionalOnProperty(prefix = "authentication",
-          name = "enableAnonymousAccess",
+          name = "anonymous",
           havingValue = "false")
   @EnableMethodSecurity(prePostEnabled = true)
   static class Dummy {
+      private static final Logger logger = LoggerFactory.getLogger(Dummy.class);
+
+      public Dummy() {
+          logger.info("Anonymous authentication disabled - @EnableMethodSecurity is being applied (authentication.anonymous=false)");
+      }
   }
 }

Java/validation/src/main/resources/application-docker.yml

@@ -28,7 +28,6 @@ spring:
       port: 6379
 
 authentication:
-  enableAnonymousAccess: true
   anonymous: true
 
 secret-management:

docker-compose.yml

@@ -473,7 +473,7 @@ services:
         condition: service_completed_successfully
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8062/health"]
-  
+
   census:
     image: link-census
     container_name: link-census
@@ -600,7 +600,6 @@ services:
     environment:
       SPRING_PROFILES_ACTIVE: docker
       spring.kafka.properties.sasl.jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="${KAFKA_SASL_CLIENT_USER}" password="${KAFKA_SASL_CLIENT_PASSWORD}";
-      spring.security.oauth2.resourceserver.jwt.issuer-uri: ${ISSUER_URI}
     ports:
       - "8067:8067"
     build:
@@ -796,7 +795,6 @@ services:
     container_name: link-validation
     environment:
       SPRING_PROFILES_ACTIVE: docker
-      spring.security.oauth2.resourceserver.jwt.issuer-uri: ${ISSUER_URI}
       spring.datasource.password: ${LINK_DB_PASS}
       spring.kafka.properties.sasl.jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="${KAFKA_SASL_CLIENT_USER}" password="${KAFKA_SASL_CLIENT_PASSWORD}";
       internal-blob-storage.connection-string: ${AZURITE_CONNECTION_STRING}