Protect paging cookies

Runs the sample. Generated for this page; it reads the connection string from the environment and first remakes the sample database from sample-schema.json.

using ArxSamples.MongoDb;
using ArxSamples.MongoDb.Operations.RetrieveMultiple.AdvancedCases;

// The connection string comes from the environment, never from the code (see "Configure the connection").
var connectionString = Environment.GetEnvironmentVariable("ARX_SAMPLES_MONGODB")
    ?? throw new InvalidOperationException("Set the ARX_SAMPLES_MONGODB environment variable to your MongoDB connection string.");

var dbContext = new SampleContext(connectionString);

// Every run starts from the sample data: this deletes and makes again what sample-schema.json lists
// (save the file in the project folder, see Get started).
await dbContext.Direct.ResetAsync();

await new Advanced4_ProtectPagingCookies().RunAsync(dbContext);

The sample, as it is in the repository.

using System.Text;
using ARX.SDK;
using ARX.SDK.MongoDb.Services;
using ARX.SDK.Query;
using ARX.SDK.Services;

using static ArxSamples.MongoDb.SampleOutput;

namespace ArxSamples.MongoDb.Operations.RetrieveMultiple.AdvancedCases;

/// <summary>
/// Protect the paging cookies your API hands to clients, in three scenarios: sealed by default, one key shared by every
/// instance of the application, and plain cookies when you choose them.
/// </summary>
/// <remarks>
/// A paging cookie carries the values the page is ordered by, of its last document: here a contact's email. A client could
/// decode it, and change it to page from somewhere else. So ARX seals cookies by default (encrypted and authenticated,
/// AES-256-GCM): a client can neither read nor change one. Without a key from you, ARX seals with a random key of the
/// process, which every service in the process shares: right for one process. When several instances serve the same
/// clients, or cookies must survive a restart, give every instance the same <c>PagingCookieKey</c> (32 bytes or more,
/// from your configuration or secret store); otherwise a cookie that reaches another instance is ARX1001.
/// <c>PagingCookieProtection</c> can also be <c>Signed</c> (readable, not changeable) or <c>Plain</c>.
/// </remarks>
public sealed class Advanced4_ProtectPagingCookies : ISample
{
    public string Name => "retrieve-multiple-advanced-4-protect-paging-cookies";

    public string Title => "Protect paging cookies";

    public async Task RunAsync(SampleContext dbContext)
    {
        var contacts = new[] { "ana", "ben", "cy", "dee" }.Select(name =>
        {
            var contact = new ArxEntity("contact");
            contact["first_name"] = name;
            contact["last_name"] = "M991";
            contact["email"] = $"{name}[email protected]";
            return contact;
        }).ToList();
        await dbContext.Service.CreateMultipleAsync(contacts);

        await Scenario1_SealedByDefaultAsync(dbContext.Service);

        await Scenario2_ASharedKeyForEveryInstanceAsync(dbContext.ConnectionString);

        await Scenario3_PlainWhenYouChooseItAsync(dbContext.ConnectionString);
    }

    private static ArxQueryExpression Query(string? cookie = null)
    {
        var query = new ArxQueryExpression("contact");
        query.ColumnSet.AddColumns("email");
        query.Criteria.AddCondition("last_name", ArxConditionOperator.Equal, "M991");
        query.AddOrder("email", ArxOrderType.Ascending);
        query.PageInfo = new ArxPagingInfo { Count = 2, PagingCookie = cookie };
        return query;
    }

    // What a client could read from a cookie: its bytes as text.
    private static string Readable(string cookie)
    {
        var base64 = cookie.Replace('-', '+').Replace('_', '/');
        return Encoding.UTF8.GetString(Convert.FromBase64String(base64.PadRight(base64.Length + (4 - base64.Length % 4) % 4, '=')));
    }

    /// <summary>1. The default: the cookie hides the email it pages by, and the next page reads it.</summary>
    private static async Task Scenario1_SealedByDefaultAsync(ArxMongoDbService service)
    {
        Step("1. Sealed by default");

        var first = await service.RetrieveMultipleAsync(Query());
        Show($"protection {service.PagingCookieProtection}; the cookie shows the email: {Readable(first.PagingCookie).Contains("[email protected]")}");

        var second = await service.RetrieveMultipleAsync(Query(first.PagingCookie));
        Show($"next page: {string.Join(", ", second.Entities.Select(x => x["email"]))}");

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * db.contact.find({ last_name: "M991" }, { email: 1 }).sort({ email: 1 })
         * -- Expect: 4 documents; the second page holds [email protected] and [email protected].
         * ===========================================================
         */
    }

    /// <summary>2. Two instances of the application: with one shared key, either reads the other's cookies; with their own, it is ARX1001.</summary>
    private static async Task Scenario2_ASharedKeyForEveryInstanceAsync(string connectionString)
    {
        Step("2. One key for every instance");

        // In production the key comes from configuration or a secret store, the same on every instance.
        var sharedKey = ArxPagingCookie.NewKey();
        var instanceA = new ArxMongoDbService(connectionString, SampleCatalog.Build()) { PagingCookieKey = sharedKey };
        var instanceB = new ArxMongoDbService(connectionString, SampleCatalog.Build()) { PagingCookieKey = sharedKey };

        var first = await instanceA.RetrieveMultipleAsync(Query());
        var second = await instanceB.RetrieveMultipleAsync(Query(first.PagingCookie));
        Show($"instance B continued: {string.Join(", ", second.Entities.Select(x => x["email"]))}");

        var withItsOwnKey = new ArxMongoDbService(connectionString, SampleCatalog.Build()) { PagingCookieKey = ArxPagingCookie.NewKey() };

        try
        {
            await withItsOwnKey.RetrieveMultipleAsync(Query(first.PagingCookie));
        }
        catch (ArxValidationException exception)
        {
            ShowError(exception);
        }

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * db.contact.countDocuments({ last_name: "M991" })
         * -- Expect: 4 (nothing is written: the check is in the cookie).
         * ===========================================================
         */
    }

    /// <summary>3. Plain cookies: readable and changeable by clients, so only where their values aren't sensitive.</summary>
    private static async Task Scenario3_PlainWhenYouChooseItAsync(string connectionString)
    {
        Step("3. Plain, when you choose it");

        var service = new ArxMongoDbService(connectionString, SampleCatalog.Build()) { PagingCookieProtection = ArxPagingCookieProtection.Plain };
        var first = await service.RetrieveMultipleAsync(Query());
        Show($"the cookie shows the email: {Readable(first.PagingCookie).Contains("[email protected]")}");

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * db.contact.countDocuments({ last_name: "M991" })
         * -- Expect: 4.
         * ===========================================================
         */
    }
}

What every sample is given: the connection string (and the ISample interface the samples implement).

namespace ArxSamples.MongoDb;

/// <summary>One documentation sample: a scenario a real application has, shown end to end.</summary>
public interface ISample
{
    /// <summary>The name to run it alone: <c>dotnet run -- &lt;name&gt;</c>.</summary>
    string Name { get; }

    /// <summary>One line on what it shows.</summary>
    string Title { get; }

    Task RunAsync(SampleContext dbContext);
}

/// <summary>
/// What a sample is given. Every sample gets the connection string; the application's service and catalog
/// (SampleContext.Application.cs) and the plain MongoDB driver read-back helper (SampleContext.Direct.cs) live in their own
/// files, so a sample needs only the files it uses.
/// </summary>
public sealed partial class SampleContext
{
    public SampleContext(string connectionString)
    {
        ConnectionString = connectionString;
    }

    public string ConnectionString { get; }
}

How the samples print: Step for each scenario, Show for what it did, ShowError for an error caught on purpose.

using ARX.SDK;

namespace ArxSamples.MongoDb;

/// <summary>How the samples print: a numbered step for each scenario, then what it did.</summary>
public static class SampleOutput
{
    /// <summary>The start of a scenario: <c>Step("1. By the id Create returned")</c>.</summary>
    public static void Step(string text) => Console.WriteLine($"  > {text}");

    /// <summary>What the scenario did.</summary>
    public static void Show(string text) => Console.WriteLine($"      {text}");

    /// <summary>An ARX error the scenario caught on purpose.</summary>
    public static void ShowError(ArxException exception)
        => Console.WriteLine($"      caught {exception.GetType().Name}: {exception.Message}");
}

The application's ARX service and its schema catalog, created once and shared by the samples.

using ARX.SDK.MongoDb.Services;
using ARX.SDK.Services;

namespace ArxSamples.MongoDb;

/// <summary>The application's ARX service and its schema catalog, shared by the real and advanced samples.</summary>
public sealed partial class SampleContext
{
    private ArxSchemaCatalog? _catalog;
    private ArxMongoDbService? _service;

    /// <summary>The application's schema catalog: collection ids, keys, lookups and selection sets (SampleCatalog.cs).</summary>
    public ArxSchemaCatalog Catalog => _catalog ??= SampleCatalog.Build();

    /// <summary>
    /// One service for the whole application. It shares one MongoDB client per connection string (a client is a
    /// connection pool), so make it once and keep it.
    /// </summary>
    public ArxMongoDbService Service => _service ??= new ArxMongoDbService(ConnectionString, Catalog);
}

The application's schema catalog: every table's id column and keys, and its selection sets.

using ARX.SDK.Services;

namespace ArxSamples.MongoDb;

/// <summary>An account's industry. Stored in account.industry as the enum's number.</summary>
public enum Industry
{
    Retail = 1,
    Manufacturing = 2,
    Healthcare = 3,
    Finance = 4,
    Technology = 5
}

/// <summary>
/// The application's schema catalog: every collection's id and keys, the lookups between collections, and every
/// picklist (selection set), defined once.
/// </summary>
/// <remarks>
/// <para>
/// <b>Ids.</b> On MongoDB the declared id is the document's <c>_id</c>, named in your code by the column you declare
/// (<c>account["account_id"]</c>). A generated string id is an ObjectId ARX makes before the insert and gives back as its
/// 24-character text; a generated Guid is one ARX makes; a supplied id is yours (a country code, a SKU). MongoDB has no
/// sequences, so a generated number isn't offered, and every document has an <c>_id</c>, so there is no NoIdColumn.
/// </para>
/// <para>
/// <b>Keys.</b> Business keys (an account number; a region and a SKU together) let Update, Delete and Retrieve find
/// documents by them. MongoDB enforces them with unique indexes: the sample database has one for each.
/// </para>
/// <para>
/// <b>Lookups.</b> MongoDB has no foreign keys, so the catalog says which field refers to which collection
/// (<c>.Lookup("contact", "account_id", "account")</c>). ARX stores the referenced id as it is stored there (an ObjectId)
/// and reads the field back as an <see cref="ArxEntityReference"/> with the referenced record's display name.
/// </para>
/// <para>
/// <b>Selection sets.</b> A field that only accepts a fixed list of codes: an account's status, a contact's preferred
/// channels (several codes, stored as an array). ARX checks every <see cref="ArxSelectionSetValue"/> against the catalog
/// before anything is sent and stores the codes themselves.
/// </para>
/// </remarks>
public static class SampleCatalog
{
    public static ArxSchemaCatalog Build() => ArxSchemaCatalog.Create()
        .Table("account", ArxIdColumn.Generated<string>("account_id"))
        .Key("account", "account_number")
        .DisplayName("account", "name")
        .Table("contact", ArxIdColumn.Generated<string>("contact_id"))
        .Key("contact", "email")
        .Lookup("contact", "account_id", "account")
        .DisplayName("contact", new[] { "first_name", "last_name" }, " ")
        .Table("country", ArxIdColumn.Supplied<string>("code"))
        .DisplayName("country", "name")
        .Table("product", ArxIdColumn.Supplied<string>("sku"))
        .DisplayName("product", "name")
        .Table("price_list", ArxIdColumn.Generated<string>("price_id"))
        .Key("price_list", "region", "sku")
        .Lookup("price_list", "region", "country")
        .Table("sales_order", ArxIdColumn.Generated<Guid>("order_id"))
        .Key("sales_order", "order_number")
        .Lookup("sales_order", "account_id", "account")
        .Table("activity_log", ArxIdColumn.Generated<string>("log_id"))
        .AddEnum<Industry>("Industry")
        .Add("AccountStatus", ArxSelectionSetKind.String, ("ACTIVE", "Active"), ("ON_HOLD", "On hold"), ("CLOSED", "Closed"))
        .Add("ContactChannels", ArxSelectionSetKind.String, ArxSelectionSetMultiplicity.Array, ("E", "Email"), ("P", "Phone"), ("S", "SMS"))
        .Build();
}

The plain MongoDB.Driver read-back helper, for the samples that show what MongoDB stored.

namespace ArxSamples.MongoDb;

/// <summary>The plain MongoDB driver outside the SDK, for the samples that show what MongoDB stored.</summary>
public sealed partial class SampleContext
{
    private MongoDirectHelper? _direct;

    /// <summary>The plain MongoDB driver outside the SDK, used only to reset the database and to show what was stored.</summary>
    public MongoDirectHelper Direct => _direct ??= new MongoDirectHelper(ConnectionString);
}

Plain MongoDB.Driver, not part of ARX: reads rows back so a sample can show what MongoDB stored.

using MongoDB.Bson;
using MongoDB.Driver;

namespace ArxSamples.MongoDb;

/// <summary>
/// The plain MongoDB driver, outside the SDK: it resets the sample database from Schema/sample-schema.json and shows
/// what was stored. Samples never write through it.
/// </summary>
public sealed class MongoDirectHelper
{
    private readonly IMongoDatabase _database;

    public MongoDirectHelper(string connectionString)
    {
        var url = MongoUrl.Create(connectionString);
        _database = new MongoClient(url).GetDatabase(url.DatabaseName ?? "arx_samples");
    }

    /// <summary>
    /// The sample schema: Schema/sample-schema.json next to the program (the samples' own project), or sample-schema.json
    /// in the project folder (a sample copied from its page, as Get started says).
    /// </summary>
    private static string SchemaPath()
    {
        var candidates = new[]
        {
            Path.Combine(AppContext.BaseDirectory, "Schema", "sample-schema.json"),
            Path.Combine(Directory.GetCurrentDirectory(), "sample-schema.json"),
            Path.Combine(Directory.GetCurrentDirectory(), "Schema", "sample-schema.json")
        };

        return candidates.FirstOrDefault(File.Exists)
            ?? throw new FileNotFoundException("sample-schema.json isn't in the project folder: download it from the Get started page and save it next to Program.cs.");
    }

    /// <summary>Drops the sample database and makes its collections, indexes and validators again.</summary>
    public async Task ResetAsync()
    {
        var schema = BsonDocument.Parse(await File.ReadAllTextAsync(SchemaPath()));

        foreach (var collection in schema["collections"].AsBsonArray.Select(x => x.AsBsonDocument))
        {
            var name = collection["name"].AsString;

            // Only the collections the schema lists are dropped and made again: anything else in the database is left alone.
            await _database.DropCollectionAsync(name);
            var options = new CreateCollectionOptions<BsonDocument>();

            if (collection.TryGetValue("validator", out var validator))
            {
                options.Validator = validator.AsBsonDocument;
            }

            await _database.CreateCollectionAsync(name, options);

            foreach (var index in collection.GetValue("indexes", new BsonArray()).AsBsonArray.Select(x => x.AsBsonDocument))
            {
                var keys = index["keys"].AsBsonDocument;
                var indexOptions = new CreateIndexOptions<BsonDocument> { Unique = index.GetValue("unique", false).AsBoolean };

                if (index.GetValue("partial", false).AsBoolean)
                {
                    indexOptions.PartialFilterExpression = new BsonDocument(keys.Names.Select(x => new BsonElement(x, new BsonDocument("$exists", true))));
                }

                await _database.GetCollection<BsonDocument>(name).Indexes.CreateOneAsync(new CreateIndexModel<BsonDocument>(keys, indexOptions));
            }
        }
    }

    /// <summary>The stored documents a filter finds, as MongoDB's JSON, one line each.</summary>
    public async Task<IReadOnlyList<string>> FindAsync(string collection, string filterJson)
    {
        var documents = await _database.GetCollection<BsonDocument>(collection).Find(BsonDocument.Parse(filterJson)).ToListAsync();
        return documents.Select(x => x.ToJson()).ToList();
    }
}

  > 1. Sealed by default
      protection Sealed; the cookie shows the email: False
      next page: [email protected], [email protected]
  > 2. One key for every instance
      instance B continued: [email protected], [email protected]
      caught ArxValidationException: ARX1001 InvalidArgument: PageInfo.PagingCookie isn't a cookie MongoDb wrote for this query: it was changed, or sealed with another key: another instance of the application, or one before a restart. Give every instance the same PagingCookieKey to page across them. Pass the PagingCookie of the previous page unchanged, or null for the first page.
  > 3. Plain, when you choose it
      the cookie shows the email: True