Skip to content

Commit f77a30e

Browse files
lmajanolmajano
committed
more ci updates
1 parent 916dad6 commit f77a30e

6 files changed

Lines changed: 121 additions & 44 deletions

File tree

‎.github/copilot-instructions.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
### Quick orientation — cbsecurity (ColdBox module)
2+
3+
This repository is a ColdBox module that provides a request firewall, annotation-driven security, JWT handling, CSRF integration, and security headers.
4+
5+
Keep guidance short and actionable. Prefer small, verifiable edits and reference the real files below.
6+
7+
1) Big picture
8+
- ColdBox module: entrypoint and wiring in `ModuleConfig.cfc` and `models/CBSecurity.cfc`.
9+
- Runtime protection happens in the `cbsecurity.interceptors.Security` interceptor (`interceptors/Security.cfc`) which:
10+
- loads and normalizes rules via `helpers/RulesLoader` (see `models/util/RulesLoader.cfc`),
11+
- delegates validation to a Validator (default: `models/validators/AuthValidator.cfc`) via `ruleValidator()` and `annotationValidator()`,
12+
- processes rule actions (redirect/override/block) and emits interception events (`cbSecurity_onInvalidAuthentication`, etc.).
13+
14+
2) Where to make changes
15+
- Business logic & APIs: `models/` (e.g. `models/jwt/JwtService.cfc`, `models/CBSecurity.cfc`).
16+
- Request enforcement: `interceptors/Security.cfc` (rule matching, IP/HTTP method validation, event overrides).
17+
- Validation strategies: `models/validators/*` — to change how auth/authorization decisions are made.
18+
- Module defaults & wiring: `ModuleConfig.cfc` and `box.json` for dependencies and scripts.
19+
20+
3) Developer workflows (how to run, test, build)
21+
- Install deps and test harness: `box install` at repo root, then `cd test-harness && box install` (or use `box install` from root — `box.json` has `install:dependencies`).
22+
- Run local server for integration/test harness: `box server start server-lucee@5.json` (see `box.json` scripts `start:lucee` / `start:2023`).
23+
- Run tests: this repo uses TestBox. The package `box.json` test runner is configured to `http://localhost:60299/tests/runner.cfm` and `build/Build.cfc` calls `testbox run`. Start the server, then open that URL or run `box testbox run runner=http://localhost:60299/tests/runner.cfm`.
24+
- Useful npm-like tasks are defined in `box.json` under `scripts` (e.g. `box task run taskFile=build/Build.cfc` used by CI). In VSCode use the Task `Run CommandBox Task`.
25+
26+
4) Patterns & conventions to follow
27+
- Validators expose `ruleValidator(rule, controller)` and `annotationValidator(securedValue, controller)`. Return shape: { allow:boolean, type: "authentication"|"authorization", messages:[] }.
28+
- Rules normalized by `RulesLoader` and stored in `properties.firewall.rules.inline`. Rule keys often used: `securelist`, `whitelist`, `httpMethods`, `allowedIPs`, `action`, `redirect`, `overrideEvent`.
29+
- When modifying or adding handlers, prefer ColdBox handler metadata (annotations) for security: see `test-harness/handlers/*` and `handlers/Jwt.cfc` for examples.
30+
- JWT integration relies on `models/jwt/JwtService.cfc` + `models/jwt/storages/*` and `jwt-cfml` dependency; preserve token storage API when changing.
31+
32+
5) Events & integration points
33+
- Interceptor announces: `cbSecurity_onInvalidAuthentication`, `cbSecurity_onInvalidAuthorization`, `cbSecurity_onFirewallBlock` and many JWT lifecycle events (see `ModuleConfig.cfc` interceptorSettings).
34+
- Modules can register rules in their `ModuleConfig.cfc` and are merged into the global rules by `interceptors/Security.cfc` (see `registerModule()` / `postModuleLoad`).
35+
36+
6) Tests & test-harness specifics
37+
- Test harness lives in `test-harness/`. It contains a minimal ColdBox app and TestBox specs (`test-harness/tests/specs/*`). Use it to run integration specs locally.
38+
- Runner: `test-harness/tests/runner.cfm` expects a running CF server on port 60299. Start via `box server start` using one of `server-*.json` files.
39+
40+
7) Small, high-value tasks for AI agents
41+
- Add a focused unit test for a validator method in `test-harness/tests/specs/unit/`.
42+
- When changing behavior in `Security.cfc`, update `test-harness/tests/specs/integration/*` to cover rule matching and invalid action flows.
43+
- Preserve WireBox IDs and signatures when changing services (e.g. `authenticationService@cbauth`, `CacheStorage@cbstorages`).
44+
45+
8) Safety and CI
46+
- CI uses the `build/Build.cfc` and `box.json` scripts. Do not modify CI scripts without updating `box.json` and `build/Build.cfc`.
47+
48+
If anything above is unclear or missing (local server ports, preferred validator override patterns, or CI details), tell me which area to expand and I will iterate.

‎.github/workflows/tests.yml‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,29 +18,27 @@ jobs:
1818
strategy:
1919
fail-fast: false
2020
matrix:
21-
cfengine: [ "boxlang-cfml@1", "lucee@5", "lucee@6", "adobe@2021", "adobe@2023" ]
22-
coldboxVersion: [ "^7.0.0" ]
21+
cfengine: [ "boxlang-cfml@1", "lucee@5", "lucee@6", "adobe@2023", "adobe@2025" ]
22+
coldboxVersion: [ "^7.0.0", "^8.0.0" ]
2323
experimental: [ false ]
2424
# Experimental: ColdBox BE vs All Engines
2525
include:
26-
- coldboxVersion: "be"
27-
cfengine: "lucee@5"
28-
experimental: true
2926
- coldboxVersion: "be"
3027
cfengine: "lucee@6"
3128
experimental: true
32-
- coldboxVersion: "be"
33-
cfengine: "adobe@2021"
34-
experimental: true
3529
- coldboxVersion: "be"
3630
cfengine: "adobe@2023"
3731
experimental: true
3832
- coldboxVersion: "be"
3933
cfengine: "boxlang-cfml@1"
4034
experimental: true
35+
# BoxLang PRIME with ColdBox 8
36+
- coldboxVersion: "8"
37+
cfengine: "boxlang-cfml@1"
38+
experimental: true
4139
steps:
4240
- name: Checkout Repository
43-
uses: actions/checkout@v4
41+
uses: actions/checkout@v5
4442

4543
- name: Setup Database and Fixtures
4644
run: |
@@ -51,7 +49,7 @@ jobs:
5149
mysql -u${{ env.DB_USER }} -p${{ env.DB_PASSWORD }} < test-harness/tests/resources/cbsecurity.sql
5250
5351
- name: Setup Java
54-
uses: actions/setup-java@v4
52+
uses: actions/setup-java@v5
5553
with:
5654
distribution: "temurin"
5755
java-version: "21"

‎server-adobe@2021.json‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎server-adobe@2025.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"name":"cbsecurity-adobe@2025",
3+
"app":{
4+
"serverHomeDirectory":".engine/adobe2025",
5+
"cfengine":"adobe@2025"
6+
},
7+
"web":{
8+
"http":{
9+
"port":"60299"
10+
},
11+
"rewrites":{
12+
"enable":"true"
13+
},
14+
"webroot": "test-harness",
15+
"aliases":{
16+
"/moduleroot/cbsecurity":"../"
17+
}
18+
},
19+
"jvm":{
20+
"heapSize":"1024"
21+
},
22+
"openBrowser":"false",
23+
"cfconfig": {
24+
"file" : ".cfconfig.json"
25+
},
26+
"scripts" : {
27+
"onServerInstall":"cfpm install zip,debugger,mysql"
28+
}
29+
}

‎server-boxlang-cfml@1.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
22
"name":"cbsecurity-boxlang-cfml@1",
33
"app":{
4-
"serverHomeDirectory":".engine/boxlang",
5-
"cfengine":"boxlang@be"
4+
"serverHomeDirectory":".engine/boxlang-cfml",
5+
"cfengine":"boxlang@1"
66
},
77
"web":{
88
"http":{
99
"port":"60299"
1010
},
1111
"rewrites":{
12-
"enable":"true"
12+
"enable":true
1313
},
1414
"webroot":"test-harness",
1515
"aliases":{
@@ -21,7 +21,7 @@
2121
"javaVersion":"openjdk21_jre",
2222
"args":"-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8888"
2323
},
24-
"openBrowser":"false",
24+
"openBrowser": false,
2525
"cfconfig":{
2626
"file":".cfconfig.json"
2727
},

‎server-boxlang@1.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"name":"cbsecurity-boxlang@1",
3+
"app":{
4+
"serverHomeDirectory":".engine/boxlang",
5+
"cfengine":"boxlang@1"
6+
},
7+
"web":{
8+
"http":{
9+
"port":"60299"
10+
},
11+
"rewrites":{
12+
"enable":true
13+
},
14+
"webroot":"test-harness",
15+
"aliases":{
16+
"/moduleroot/cbsecurity":"../"
17+
}
18+
},
19+
"JVM":{
20+
"heapSize":"1024",
21+
"javaVersion":"openjdk21_jre",
22+
"args":"-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8888"
23+
},
24+
"openBrowser": false,
25+
"cfconfig":{
26+
"file":".cfconfig.json"
27+
},
28+
"env":{},
29+
"scripts":{
30+
"onServerInitialInstall":"install bx-esapi,bx-mysql --noSave"
31+
}
32+
}

0 commit comments

Comments
 (0)