Skip to content

Save password parameter default values to user secrets#4507

Merged
DamianEdwards merged 17 commits intomainfrom
damianedwards/save-default-passwords-in-user-secrets
Jun 19, 2024
Merged

Save password parameter default values to user secrets#4507
DamianEdwards merged 17 commits intomainfrom
damianedwards/save-default-passwords-in-user-secrets

Conversation

@DamianEdwards
Copy link
Copy Markdown
Member

@DamianEdwards DamianEdwards commented Jun 14, 2024

Adds UserSecretsParameterDefault which wraps a ParameterDefault and saves the value returned by its GetDefaultValue method to the AppHost user secrets.

Updated all resources that use GeneratedParameterDefault to generate a default password/apikey to wrap it in UserSecretsParameterDefault so that the default value is saved to user secrets.

Fixes #1151

Microsoft Reviewers: Open in CodeFlow

@DamianEdwards DamianEdwards requested a review from eerhardt June 14, 2024 01:32
@ghost ghost added the area-app-model Issues pertaining to the APIs in Aspire.Hosting, e.g. DistributedApplication label Jun 14, 2024
@davidfowl
Copy link
Copy Markdown
Contributor

This feels like an opportunity to design a better API for parameter defaults.

@DamianEdwards
Copy link
Copy Markdown
Member Author

What did you have in mind?

@DamianEdwards DamianEdwards marked this pull request as ready for review June 14, 2024 20:54
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is no longer needed as it previously contained the hacked workaround for the lack of this feature.

if (!TrySetUserSecret(applicationName, configurationKey, value))
{
throw new DistributedApplicationException($"Failed to set value for parameter '{parameterName}' in application '{applicationName}' to user secrets.");
Debug.WriteLine($"Failed to set value for parameter '{parameterName}' in application '{applicationName}' to user secrets.");
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why?

Copy link
Copy Markdown
Member Author

@DamianEdwards DamianEdwards Jun 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To make it a bit easier to see if it's doesn't succeed during dev. There's no logging at this stage and swallowing blindly just seems bad mmm'k

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be possible for us to get the ability to log here? (obviously not in this PR) It seems like a big hole that we aren't able to log things until the app is built. Especially as we add more functionality earlier in the app. Our only options are throw or eat...

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another cause for this to not succeed is if appHostAssembly is null. Do we need to support that scenario? It feels odd that we would Debug.WriteLine if someone passed null (which we claim to support). We basically wouldn't do anything.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Logged #4597 to track enabling logging pre-host build.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another cause for this to not succeed is if appHostAssembly is null. Do we need to support that scenario?

@eerhardt I made it non-nullable and don't call in now if the appHostAssembly is null for some reason.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that it's internal, it is less of a concern. But this sounds good.

@mitchdenny
Copy link
Copy Markdown
Member

mitchdenny commented Jun 16, 2024

Couple of things playing around with this locally.

  1. Seems to have broken pgadmin ... is it working for you?
  2. CatalogDbApp is crashing with an error saying it can't authenticate.

PEBCAK

Comment thread src/Aspire.Hosting.MySql/MySqlBuilderExtensions.cs Outdated
@mitchdenny
Copy link
Copy Markdown
Member

This feels like an opportunity to design a better API for parameter defaults.

Are you talking about supporting binding to KeyVault etc?

@mitchdenny
Copy link
Copy Markdown
Member

mitchdenny commented Jun 17, 2024

@DamianEdwards I'm pretty happy with this. I made a minor change so that the secrets file is formatted when we save it. I'm not sure I like the IsDevelopment() checks .. so if you could explain your thinking there that would be good.

@davidfowl
Copy link
Copy Markdown
Contributor

@eerhardt can you review please

Comment thread playground/TestShop/AppHost/ParameterExtensions.cs
Comment thread src/Aspire.Hosting.MySql/MySqlBuilderExtensions.cs Outdated
if (!TrySetUserSecret(applicationName, configurationKey, value))
{
throw new DistributedApplicationException($"Failed to set value for parameter '{parameterName}' in application '{applicationName}' to user secrets.");
Debug.WriteLine($"Failed to set value for parameter '{parameterName}' in application '{applicationName}' to user secrets.");
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be possible for us to get the ability to log here? (obviously not in this PR) It seems like a big hole that we aren't able to log things until the app is built. Especially as we add more functionality earlier in the app. Our only options are throw or eat...

Comment thread src/Aspire.Hosting/ApplicationModel/UserSecretsParameterDefault.cs Outdated
Comment thread src/Aspire.Hosting/ApplicationModel/UserSecretsParameterDefault.cs Outdated
if (!TrySetUserSecret(applicationName, configurationKey, value))
{
throw new DistributedApplicationException($"Failed to set value for parameter '{parameterName}' in application '{applicationName}' to user secrets.");
Debug.WriteLine($"Failed to set value for parameter '{parameterName}' in application '{applicationName}' to user secrets.");
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another cause for this to not succeed is if appHostAssembly is null. Do we need to support that scenario? It feels odd that we would Debug.WriteLine if someone passed null (which we claim to support). We basically wouldn't do anything.

Comment thread src/Shared/SecretsStore.cs
Comment thread src/Shared/SecretsStore.cs Outdated
Comment thread src/Shared/SecretsStore.cs
Comment thread tests/Aspire.Hosting.Tests/AddParameterTests.cs Outdated
@DamianEdwards DamianEdwards requested a review from eerhardt June 19, 2024 01:07
Comment thread src/Aspire.Hosting.MySql/MySqlBuilderExtensions.cs Outdated
Comment thread src/Aspire.Hosting/DistributedApplicationBuilder.cs Outdated
Comment thread tests/Aspire.Hosting.Tests/RabbitMQ/AddRabbitMQTests.cs Outdated
Comment thread src/Aspire.Hosting/ParameterResourceBuilderExtensions.cs Outdated
Copy link
Copy Markdown
Member

@eerhardt eerhardt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Nice work! This is going to solve a lot of problems with container persistence.

@DamianEdwards DamianEdwards merged commit 4e06e32 into main Jun 19, 2024
@DamianEdwards DamianEdwards deleted the damianedwards/save-default-passwords-in-user-secrets branch June 19, 2024 20:22
/// <summary>
/// The assembly of the app host.
/// </summary>
Assembly? AppHostAssembly { get; }
Copy link
Copy Markdown
Contributor

@davidfowl davidfowl Jun 20, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this new public API?

public string AppHostDirectory { get; }

/// <inheritdoc />
public Assembly? AppHostAssembly => _options.Assembly;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really need to expose this as public API?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can revert but it's kinda useful to have. I think originally it was required when the user secrets stuff was public and each resource extension method was doing the logic to add the user secrets parameter default, but it could all be internal now.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Logged #4612

@github-actions github-actions Bot locked and limited conversation to collaborators Jul 21, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

area-app-model Issues pertaining to the APIs in Aspire.Hosting, e.g. DistributedApplication

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Automatically persist generated password for all containers with user names and passwords

4 participants