Sarand/BusinessMgr-2019
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Upgrade BusinessMgr identity cryptography

Browse Source
This commit is contained in:
Andy Howard
2026-09-13 17:58:25 +01:00
parent 9ccc287654
commit 820c56f146
6 changed files with 87 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/component-reviews.md
+4 -3
View File
@@ -7,9 +7,10 @@ table td {
}
</style>
Last updated: 2026-09-12
Last updated: 2026-09-13
| Component | Scope | Status | Date reviewed | Next steps | Notes |
|---|---|---|---|---|---|
| `BusinessMgr.sln` | .NET 10 restore, Debug build, and tests | Migrated; passing with warnings and toolchain requirement | 2026-09-10 | Review vulnerable and framework-specific packages, perform application smoke tests, then release-validate before removing Common's temporary .NET 8 targets. | All eight projects target `net10.0`. The complete solution builds with Visual Studio 18 MSBuild; the .NET CLI cannot build `SaBusMgrTest_Portal` because its SSDT SQL unit-testing targets are Visual Studio-specific (`MSB4278`). Control tests pass 8 of 8 and Portal tests pass 13 of 13. |
| `eng/validate.ps1` | Repository validation | Complete; passing | 2026-09-12 | Use as the standard validation entry point and extend it when repository-wide checks change. | Locates Visual Studio MSBuild for the SSDT project, builds serially, runs 8 Control and 13 Portal tests, and verifies changed-file line endings and diffs. |
| `BusinessMgr.sln` | .NET 10 restore, Debug build, and tests | Migrated; passing with warnings and toolchain requirement | 2026-09-13 | Review remaining framework-specific packages, perform application smoke tests, then release-validate. | All eight projects target `net10.0`. The complete solution builds with Visual Studio 18 MSBuild; the .NET CLI cannot build `SaBusMgrTest_Portal` because its SSDT SQL unit-testing targets are Visual Studio-specific (`MSB4278`). Control tests pass 11 of 11 and Portal tests pass 13 of 13. The Identity-related `NU1903` warnings have been removed. |
| `SaBusMgrStandardBase/Base/Helpers/SbmPasswordHelper.cs` and `SaBusinessMgrCoreWebControl/Control/Helpers/SbmcPasswordHelper.cs` | Password hashing | Dependency upgrade complete; legacy hashes compatible | 2026-09-13 | Preserve the compatibility tests when password-hashing defaults or account migration behavior changes. | Both helpers use `PasswordHasher<TUser>` from `Microsoft.Extensions.Identity.Core` 10.0.12. Current hashes round-trip, wrong passwords fail, and legacy Identity V3 hashes remain valid while being identified for rehash. |
| `eng/validate.ps1` | Repository validation | Complete; passing | 2026-09-13 | Use as the standard validation entry point and extend it when repository-wide checks change. | Locates Visual Studio MSBuild for the SSDT project, builds serially, runs 11 Control and 13 Portal tests, audits the Identity-package-owning project, and verifies changed-file line endings and diffs. |
docs/topics.md
+3 -3
View File
@@ -7,14 +7,13 @@ table td {
}
</style>
Last updated: 2026-09-12
Last updated: 2026-09-13
## Prioritised Topics to Be Actioned
| Priority | Topic | Date noted | Next step | Notes |
|---|---|---|---|---|
| P1 | Remove vulnerable transitive `System.Security.Cryptography.Xml` 8.0.2 dependency | 2026-09-10 | Upgrade or replace the legacy ASP.NET Core Identity 2.3.1 dependency, then confirm restore is clean. | The Common NPOI path is complete: NPOI 2.7.6 plus an explicit `System.Security.Cryptography.Xml` 10.0.12 reference passes the spreadsheet, Common, and BusinessMgr suites. BusinessMgr still resolves version 8.0.2 independently through `Microsoft.AspNetCore.DataProtection` 2.3.0 from ASP.NET Core Identity 2.3.1, producing the remaining `NU1903` advisories. |
| P2 | Review framework-specific package versions after .NET 10 retargeting | 2026-09-10 | Review ASP.NET Core Identity and Razor runtime compilation, ODBC, and System.Drawing packages for supported .NET 10 versions and behavior before release validation. | Existing package versions compile and all tests pass, but several remain on 2.x or 6.x generations and should not be assumed to be fully supported merely because compilation succeeds. |
| P2 | Review framework-specific package versions after .NET 10 retargeting | 2026-09-10 | Review Razor runtime compilation, ODBC, and System.Drawing packages for supported .NET 10 versions and behavior before release validation. | The legacy ASP.NET Core Identity package has been replaced with the .NET 10 Identity Core package. Other package versions compile and all tests pass, but several remain on 6.x generations and should not be assumed to be fully supported merely because compilation succeeds. |
## .NET 10 Dependencies and Sequence
@@ -39,3 +38,4 @@ Last updated: 2026-09-12
| Pin the BusinessMgr .NET 10 SDK | 2026-09-10 | 2026-09-10 | 2026-09-10 | Added `global.json` for SDK 10.0.401 with `latestPatch` roll-forward and prerelease SDKs disabled. Visual Studio MSBuild remains required for the SSDT-dependent Portal test project. |
| Migrate BusinessMgr to .NET 10 against compatible Common targets | 2026-09-10 | 2026-09-10 | 2026-09-10 | All eight BusinessMgr projects now target `net10.0`. Visual Studio 18 MSBuild restored and built the complete solution successfully with no compilation errors. Control tests passed 8 of 8 and Portal tests passed 13 of 13 on .NET 10. Package vulnerability and framework-specific package reviews are tracked separately. |
| Automate BusinessMgr validation | 2026-09-12 | 2026-09-12 | 2026-09-12 | Added `eng/validate.ps1` to locate Visual Studio MSBuild, build the SSDT-dependent solution serially, run both test assemblies, and verify diffs and changed-file line endings. The script passes with 8 of 8 Control and 13 of 13 Portal tests. |
| Remove vulnerable transitive `System.Security.Cryptography.Xml` 8.0.2 dependency | 2026-09-10 | 2026-09-13 | 2026-09-13 | Replaced the broad legacy `Microsoft.AspNetCore.Identity` 2.3.1 reference with `Microsoft.Extensions.Identity.Core` 10.0.12, matching the only used API, `PasswordHasher<TUser>`. Three focused tests cover both password helpers, wrong-password rejection, current hash round trips, legacy Identity V3 verification, and rehash detection. Restore and build no longer report `NU1903`; 11 Control and 13 Portal tests pass, and the package audit reports no vulnerable packages for `SaBusMgrStandardBase`. |