Harden and modernize SmartBot release - #71
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Hardening and release-modernization pass for SmartBot’s ASP.NET Core 8 / Blazor solution: tightens SignalR access by separating operator vs robot callers, stabilizes telemetry persistence under concurrency, and updates build/release tooling (locked restores, CI quality gates, container hardening, and licensing docs).
Changes:
- Add role-aware SignalR authentication (robot API key vs short-lived operator token) and enforce operator/robot-only hub methods.
- Replace process-wide telemetry throttling with a per-robot, concurrency-safe throttle and add tests around it.
- Modernize dependencies, lockfiles, CI checks (format/vuln audit/coverage), container build, and documentation/licensing artifacts.
Reviewed changes
Copilot reviewed 38 out of 44 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| THIRD_PARTY_NOTICES.md | Updates dependency/license inventory and removes references to no-longer-loaded assets. |
| src/server/SmartBotBlazorApp/SmartBotBlazorApp.csproj | Updates server package references and suppresses existing migration warning. |
| src/server/SmartBotBlazorApp/Security/SignalHubTokenService.cs | Adds data-protected, time-limited operator token service for hub access. |
| src/server/SmartBotBlazorApp/Security/SignalHubAccess.cs | Adds explicit operator/robot detection and robot principal creation. |
| src/server/SmartBotBlazorApp/Program.cs | Reworks SignalR access guard middleware; removes permissive CORS setup. |
| src/server/SmartBotBlazorApp/packages.lock.json | Adds server NuGet lockfile for deterministic restores. |
| src/server/SmartBotBlazorApp/ImageProcessor.cs | Formatting-only cleanup. |
| src/server/SmartBotBlazorApp/Hubs/SignalHub.cs | Enforces operator-only and robot-only hub methods. |
| src/server/SmartBotBlazorApp/Hubs/RobotMessageValidator.cs | Tightens robot ID length validation and error message. |
| src/server/SmartBotBlazorApp/Dockerfile | Moves to locked restore, newer SDK for build, and non-root runtime intent. |
| src/server/SmartBotBlazorApp/Data/RobotMeasurementThrottle.cs | Adds per-robot, synchronized in-process throttle. |
| src/server/SmartBotBlazorApp/Data/MeasurementService.cs | Switches to per-robot throttle, adds basic input validation, uses no-tracking queries. |
| src/server/SmartBotBlazorApp/Data/Measurement.cs | Formatting-only cleanup (attributes spacing). |
| src/server/SmartBotBlazorApp/Components/RobotMovementInput/keyboardInputHandler.cs | Formatting/indentation cleanup. |
| src/server/SmartBotBlazorApp/Components/RobotMovementInput/JoystickInputHandler.cs | Formatting/whitespace cleanup. |
| src/server/SmartBotBlazorApp/Components/Pages/MatrixReceiver_server.razor | Uses operator token for server-side hub connection; fixes markup/accessibility. |
| src/server/SmartBotBlazorApp/Components/Pages/ImageReceiver_server.razor | Uses operator token for server-side hub connection; fixes markup/accessibility. |
| src/server/SmartBotBlazorApp/Components/Layout/MainLayout.razor | Hardens external links and removes Font Awesome usage. |
| src/server/SmartBotBlazorApp/Components/App.razor | Removes Font Awesome CDN stylesheet. |
| src/server/SmartBotBlazorApp/Components/Account/Pages/RegisterConfirmation.razor | Reduces account enumeration signals; gates self-confirmation link behind config. |
| src/server/SmartBotBlazorApp/Components/Account/Pages/Register.razor | Disables public registration outside Development via options. |
| src/server/SmartBotBlazorApp/appsettings.json | Adds AccountAccess defaults and tweaks LocalDB connection string. |
| src/server/SmartBotBlazorApp/appsettings.Development.json | Enables AccountAccess options for Development. |
| src/server/SmartBotBlazorApp/AccountAccessOptions.cs | Adds options model for registration/self-confirmation configuration. |
| src/server/SmartBotBlazorApp.Tests/SmartBotBlazorApp.Tests.csproj | Updates test SDK and migrates to xUnit v3. |
| src/server/SmartBotBlazorApp.Tests/SignalHubAccessTests.cs | Adds tests for operator/robot separation and operator token behavior. |
| src/server/SmartBotBlazorApp.Tests/RobotMessageValidatorTests.cs | Adds test ensuring robot identifier max length matches DB constraint. |
| src/server/SmartBotBlazorApp.Tests/RobotMeasurementThrottleTests.cs | Adds unit tests for per-robot and concurrent throttling behavior. |
| src/server/SmartBotBlazorApp.Tests/packages.lock.json | Adds test project lockfile for deterministic restores. |
| src/server/SmartBotBlazorApp.Client/SmartBotBlazorApp.Client.csproj | Updates client package references. |
| src/server/SmartBotBlazorApp.Client/Pages/Chat.razor | Switches render mode to explicit WASM non-prerendering. |
| src/server/SmartBotBlazorApp.Client/packages.lock.json | Adds client project lockfile for deterministic restores. |
| src/server/Dockerfile | Deletes legacy server Dockerfile (now using app-scoped Dockerfile). |
| README.pl.md | Updates prerequisites, deployment/CI description, and container/registration notes (PL). |
| README.md | Updates prerequisites, deployment/CI description, and container/registration notes (EN). |
| global.json | Pins SDK used by tooling/build to a specific version. |
| docs/server.md | Updates server/security/ports/pipeline documentation to match new behavior. |
| docs/getting-started.md | Updates prerequisites, docker ports, and registration notes. |
| docs/architecture.md | Documents operator token exchange and role-aware hub access model. |
| Directory.Build.props | Enables lockfile-based restores repo-wide. |
| .github/workflows/smartbotweb.yml | Adds locked restore, format verification, vuln audit, coverage collection, and container build. |
| .gitattributes | Enforces LF line endings for key source/doc formats and marks binaries. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
23
to
27
| FROM base AS final | ||
| WORKDIR /app | ||
| COPY --from=publish /app/publish . | ||
| USER $APP_UID | ||
| ENTRYPOINT ["dotnet", "SmartBotBlazorApp.dll"] |
Comment on lines
+359
to
+363
| var authenticationState = await AuthenticationStateProvider.GetAuthenticationStateAsync(); | ||
| var operatorToken = SignalHubTokens.CreateOperatorToken(authenticationState.User); | ||
|
|
||
| _hubConnection = new HubConnectionBuilder() | ||
| .WithUrl(Navigation.ToAbsoluteUri("/signalhub")) | ||
| .Build(); | ||
| .WithUrl( |
Comment on lines
+344
to
+348
| var authenticationState = await AuthenticationStateProvider.GetAuthenticationStateAsync(); | ||
| var operatorToken = SignalHubTokens.CreateOperatorToken(authenticationState.User); | ||
|
|
||
| _hubConnection = new HubConnectionBuilder() | ||
| .WithUrl(Navigation.ToAbsoluteUri("/signalhub")) | ||
| .WithUrl( |
Comment on lines
+25
to
30
| ArgumentNullException.ThrowIfNull(measurements); | ||
|
|
||
| if ((currentTime - _lastSaveTime) >= SaveThrottleDuration) | ||
| if (measurements.Length < 7) | ||
| { | ||
| var newMeasurement = new Measurement | ||
| { | ||
| RobotId = robotId, | ||
| AccelerationX = measurements[0], | ||
| AccelerationY = measurements[1], | ||
| AccelerationZ = measurements[2], | ||
| RotationX = measurements[3], | ||
| RotationY = measurements[4], | ||
| RotationZ = measurements[5], | ||
| TemperatureC = measurements[6], | ||
| AvgDistance = distance, | ||
| Timestamp = currentTime | ||
| }; | ||
|
|
||
| _lastSaveTime = currentTime; | ||
| await AddMeasurementAsync(newMeasurement); | ||
| throw new ArgumentException("Seven measurement values are required.", nameof(measurements)); | ||
| } |
Comment on lines
+44
to
+46
| NuGet packages retain their upstream license files and metadata. The direct | ||
| dependencies declared by the server, client, and test projects, together with | ||
| the transitive dependency carrying nonstandard Microsoft terms, are: | ||
| the transitive dependencies carrying nonstandard Microsoft terms, are: |
Kamilr616
force-pushed
the
agent/harden-smartbot-release
branch
from
July 15, 2026 00:03
624b674 to
912a0a0
Compare
Kamilr616
force-pushed
the
agent/harden-smartbot-release
branch
from
July 15, 2026 00:05
912a0a0 to
fcb8187
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Why
These changes disable production self-registration by default, tighten CORS and role boundaries, make concurrent telemetry processing predictable, remove deprecated dependencies, and prepare the repository for a repeatable release.
Configuration impact
Validation