Merge pull request #154 from /issues/153-update-docker-images

Fix #153: Update resources, DDL, and configuration for 2022.12 release

arm64v8/docker-powerauth-data-adapter/Dockerfile

@@ -1,15 +1,15 @@
-FROM arm64v8/tomcat:9-jre11@sha256:cdf6a9ca2a039f9cfbf0c6546f77c0d6b3664dbdc49a4284a2dd6e84bed2defd
+FROM arm64v8/tomcat:9-jre11@sha256:0464902846f45cf1bbcfc52adc2be69cd53d3954569e3c709c346614f19ecad0
 LABEL maintainer="[email protected]"
 
 # Prepare environment variables
-ENV JAVA_HOME /usr/local/openjdk-11
+ENV JAVA_HOME /opt/java/openjdk
 ENV TOMCAT_HOME /usr/local/tomcat
 
 # Clear root context
 RUN rm -rf $TOMCAT_HOME/webapps/*
 
 # Copy libraries
-ADD ../deploy/lib/ojdbc6.jar $TOMCAT_HOME/lib/
+ADD ../deploy/lib/ojdbc8.jar $TOMCAT_HOME/lib/
 ADD ../deploy/lib/postgresql.jar $TOMCAT_HOME/lib/
 
 # Deploy and run applications

arm64v8/docker-powerauth-nextstep/Dockerfile

@@ -1,15 +1,15 @@
-FROM arm64v8/tomcat:9-jre11@sha256:cdf6a9ca2a039f9cfbf0c6546f77c0d6b3664dbdc49a4284a2dd6e84bed2defd
+FROM arm64v8/tomcat:9-jre11@sha256:0464902846f45cf1bbcfc52adc2be69cd53d3954569e3c709c346614f19ecad0
 LABEL maintainer="[email protected]"
 
 # Prepare environment variables
-ENV JAVA_HOME /usr/local/openjdk-11
+ENV JAVA_HOME /opt/java/openjdk
 ENV TOMCAT_HOME /usr/local/tomcat
 
 # Clear root context
 RUN rm -rf $TOMCAT_HOME/webapps/*
 
 # Copy libraries
-ADD ../deploy/lib/ojdbc6.jar $TOMCAT_HOME/lib/
+ADD ../deploy/lib/ojdbc8.jar $TOMCAT_HOME/lib/
 ADD ../deploy/lib/postgresql.jar $TOMCAT_HOME/lib/
 
 # Deploy and run applications

arm64v8/docker-powerauth-push-server/Dockerfile

@@ -1,15 +1,15 @@
-FROM arm64v8/tomcat:9-jre11@sha256:cdf6a9ca2a039f9cfbf0c6546f77c0d6b3664dbdc49a4284a2dd6e84bed2defd
+FROM arm64v8/tomcat:9-jre11@sha256:0464902846f45cf1bbcfc52adc2be69cd53d3954569e3c709c346614f19ecad0
 LABEL maintainer="[email protected]"
 
 # Prepare environment variables
-ENV JAVA_HOME /usr/local/openjdk-11
+ENV JAVA_HOME /opt/java/openjdk
 ENV TOMCAT_HOME /usr/local/tomcat
 
 # Clear root context
 RUN rm -rf $TOMCAT_HOME/webapps/*
 
 # Copy libraries
-ADD ../deploy/lib/ojdbc6.jar $TOMCAT_HOME/lib/
+ADD ../deploy/lib/ojdbc8.jar $TOMCAT_HOME/lib/
 ADD ../deploy/lib/postgresql.jar $TOMCAT_HOME/lib/
 
 # Deploy and run applications

arm64v8/docker-powerauth-server/Dockerfile

@@ -1,15 +1,15 @@
-FROM arm64v8/tomcat:9-jre11@sha256:cdf6a9ca2a039f9cfbf0c6546f77c0d6b3664dbdc49a4284a2dd6e84bed2defd
+FROM arm64v8/tomcat:9-jre11@sha256:0464902846f45cf1bbcfc52adc2be69cd53d3954569e3c709c346614f19ecad0
 LABEL maintainer="[email protected]"
 
 # Prepare environment variables
-ENV JAVA_HOME /usr/local/openjdk-11
+ENV JAVA_HOME /opt/java/openjdk
 ENV TOMCAT_HOME /usr/local/tomcat
 
 # Clear root context
 RUN rm -rf $TOMCAT_HOME/webapps/*
 
 # Copy libraries
-ADD ../deploy/lib/ojdbc6.jar $TOMCAT_HOME/lib/
+ADD ../deploy/lib/ojdbc8.jar $TOMCAT_HOME/lib/
 ADD ../deploy/lib/postgresql.jar $TOMCAT_HOME/lib/
 
 # Deploy and run applications

arm64v8/docker-powerauth-tpp-engine/Dockerfile

@@ -1,15 +1,15 @@
-FROM arm64v8/tomcat:9-jre11@sha256:cdf6a9ca2a039f9cfbf0c6546f77c0d6b3664dbdc49a4284a2dd6e84bed2defd
+FROM arm64v8/tomcat:9-jre11@sha256:0464902846f45cf1bbcfc52adc2be69cd53d3954569e3c709c346614f19ecad0
 LABEL maintainer="[email protected]"
 
 # Prepare environment variables
-ENV JAVA_HOME /usr/local/openjdk-11
+ENV JAVA_HOME /opt/java/openjdk
 ENV TOMCAT_HOME /usr/local/tomcat
 
 # Clear root context
 RUN rm -rf $TOMCAT_HOME/webapps/*
 
 # Copy libraries
-ADD ../deploy/lib/ojdbc6.jar $TOMCAT_HOME/lib/
+ADD ../deploy/lib/ojdbc8.jar $TOMCAT_HOME/lib/
 ADD ../deploy/lib/postgresql.jar $TOMCAT_HOME/lib/
 
 # Deploy and run applications

arm64v8/docker-powerauth-webflow/Dockerfile

@@ -1,16 +1,16 @@
-FROM arm64v8/tomcat:9-jre11@sha256:cdf6a9ca2a039f9cfbf0c6546f77c0d6b3664dbdc49a4284a2dd6e84bed2defd
+FROM arm64v8/tomcat:9-jre11@sha256:0464902846f45cf1bbcfc52adc2be69cd53d3954569e3c709c346614f19ecad0
 LABEL maintainer="[email protected]"
 
 # Prepare environment variables
-ENV JAVA_HOME /usr/local/openjdk-11
+ENV JAVA_HOME /opt/java/openjdk
 ENV TOMCAT_HOME /usr/local/tomcat
 ENV WEBFLOW_RESOURCES /opt/ext-resources
 
 # Clear root context
 RUN rm -rf $TOMCAT_HOME/webapps/*
 
 # Copy libraries
-ADD ../deploy/lib/ojdbc6.jar $TOMCAT_HOME/lib/
+ADD ../deploy/lib/ojdbc8.jar $TOMCAT_HOME/lib/
 ADD ../deploy/lib/postgresql.jar $TOMCAT_HOME/lib/
 
 # Add valve for proxy with SSL termination

build-arm64v8.sh

@@ -9,7 +9,7 @@ fi
 
 # Prepare Build Number
 if [ -z ${TAG+x} ]; then
-    export PRODUCT_VERSION="2022.05"
+    export PRODUCT_VERSION="2022.12"
     if [ -z ${BUILD+x} ]; then
         export BUILD=$(date +%s)
     fi

build.sh

@@ -9,7 +9,7 @@ fi
 
 # Prepare Build Number
 if [ -z ${TAG+x} ]; then
-    export PRODUCT_VERSION="2022.05"
+    export PRODUCT_VERSION="2022.12"
     if [ -z ${BUILD+x} ]; then
         export BUILD=$(date +%s)
     fi

deploy/data/ext-resources/messages_cs.properties

@@ -158,4 +158,15 @@ browser.close.warning=Opravdu si přejete zrušit tuto operaci?
 clientCertificate.login=Přihlásit se certifikátem
 clientCertificate.use=Vybrat certifikát
 clientCertificate.failed=Ověření klientského certifikátu selhalo.
-clientCertificate.approval=Pro ověření bude použit klientský certifikát.
+
+qualifiedCertificate.approve=Potvrdit certifikátem
+qualifiedCertificate.choose=Vybrat certifikát
+qualifiedCertificate.sign=Podepsat
+
+signer.error.init.notSupported=Potvrzení certifikátem není podporované.
+signer.error.init.extension.failed=Podpisový plug-in není nainstalovaný v prohlížeči.
+signer.error.init.host.failed=Selhala inicializace podpisové komponenty.
+signer.error.certificate.notFound=Nebyl nalezen žádný certifikát pro podpis.
+signer.error.unknown=Selhala příprava podpisu.
+signer.result.success=Data operace byla úspěšně podepsána.
+signer.result.failed=Selhal výpočet podpisu dat operace.

deploy/data/ext-resources/messages_en.properties

@@ -159,4 +159,15 @@ browser.close.warning=Are you sure you want to cancel current operation?
 clientCertificate.login=Login with Certificate
 clientCertificate.use=Choose Certificate
 clientCertificate.failed=Client certificate verification failed.
-clientCertificate.approval=Client certificate will be used for authorization.
+
+qualifiedCertificate.approve=Approve with Certificate
+qualifiedCertificate.choose=Choose Certificate
+qualifiedCertificate.sign=Sign
+
+signer.error.init.notSupported=Approval with certificate is not supported.
+signer.error.init.extension.failed=Browser extension for signing is not installed.
+signer.error.init.host.failed=Signer component initialization failed.
+signer.error.certificate.notFound=No certificate was found for signing.
+signer.error.unknown=Signature preparation failed.
+signer.result.success=Operation data was signed successfully.
+signer.result.failed=Data signature calculation failed.

deploy/data/postgresql/powerauth-push-server.sql

@@ -15,6 +15,7 @@ CREATE SEQUENCE push_device_registration_seq;
 CREATE SEQUENCE push_message_seq;
 CREATE SEQUENCE push_campaign_seq;
 CREATE SEQUENCE push_campaign_user_seq;
+CREATE SEQUENCE push_inbox_seq;
 
 ---
 --- DB Tables
@@ -23,7 +24,7 @@ CREATE SEQUENCE push_campaign_user_seq;
 -- Create table for application credentials used for APNS and FCM
 CREATE TABLE push_app_credentials (
 	id INTEGER NOT NULL CONSTRAINT push_app_credentials_pkey PRIMARY KEY,
-	app_id INTEGER NOT NULL,
+	app_id VARCHAR(255) NOT NULL,
 	ios_key_id VARCHAR(255),
 	ios_private_key BYTEA,
 	ios_team_id VARCHAR(255),
@@ -81,6 +82,25 @@ CREATE TABLE push_campaign_user (
 	timestamp_created TIMESTAMP(6) NOT NULL
 );
 
+-- Create table for message inbox
+CREATE TABLE push_inbox (
+    id INTEGER NOT NULL CONSTRAINT push_inbox_pk PRIMARY KEY,
+    inbox_id VARCHAR(37),
+    user_id VARCHAR(255) NOT NULL,
+    subject TEXT NOT NULL,
+    body TEXT NOT NULL,
+    read BOOLEAN DEFAULT false NOT NULL,
+    timestamp_created TIMESTAMP NOT NULL,
+    timestamp_read TIMESTAMP
+);
+
+-- Create table for assignment of inbox messages to apps
+CREATE TABLE push_inbox_app (
+    app_credentials_id INTEGER NOT NULL,
+    inbox_id           INTEGER NOT NULL,
+    CONSTRAINT push_inbox_app_pk PRIMARY KEY (inbox_id, app_credentials_id)
+);
+
 --
 -- DB Indexes (recommended for better performance)
 --
@@ -103,5 +123,6 @@ CREATE INDEX push_campaign_user_campaign ON push_campaign_user (campaign_id, use
 
 CREATE INDEX push_campaign_user_detail ON push_campaign_user (user_id);
 
-GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO powerauth;
-GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO powerauth;
+CREATE INDEX push_inbox_id ON push_inbox (inbox_id);
+CREATE INDEX push_inbox_user ON push_inbox (user_id);
+CREATE INDEX push_inbox_user_read ON push_inbox (user_id, read);

deploy/data/postgresql/powerauth-server.sql

@@ -231,7 +231,8 @@ CREATE TABLE pa_operation (
     max_failure_count     BIGINT NOT NULL,
     timestamp_created     TIMESTAMP NOT NULL,
     timestamp_expires     TIMESTAMP NOT NULL,
-    timestamp_finalized   TIMESTAMP
+    timestamp_finalized   TIMESTAMP,
+    risk_flags            VARCHAR(255)
 );
 
 --
@@ -244,7 +245,8 @@ CREATE TABLE pa_operation_template (
     data_template         VARCHAR(255) NOT NULL,
     signature_type        VARCHAR(255) NOT NULL,
     max_failure_count     BIGINT NOT NULL,
-    expiration            BIGINT NOT NULL
+    expiration            BIGINT NOT NULL,
+    risk_flags            VARCHAR(255)
 );
 
 --
@@ -259,7 +261,7 @@ CREATE TABLE pa_operation_application (
 --
 -- DDL for Table SHEDLOCK
 --
-CREATE TABLE shedlock (
+CREATE TABLE IF NOT EXISTS shedlock (
     name VARCHAR(64) NOT NULL PRIMARY KEY,
     lock_until TIMESTAMP NOT NULL,
     locked_at TIMESTAMP NOT NULL,
@@ -269,7 +271,7 @@ CREATE TABLE shedlock (
 --
 -- Create audit log table.
 --
-CREATE TABLE audit_log (
+CREATE TABLE IF NOT EXISTS audit_log (
     audit_log_id       VARCHAR(36) PRIMARY KEY,
     application_name   VARCHAR(256) NOT NULL,
     audit_level        VARCHAR(32) NOT NULL,
@@ -288,7 +290,7 @@ CREATE TABLE audit_log (
 --
 -- Create audit parameters table.
 --
-CREATE TABLE audit_param (
+CREATE TABLE IF NOT EXISTS audit_param (
     audit_log_id       VARCHAR(36),
     timestamp_created  TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
     param_key          VARCHAR(256),
@@ -347,8 +349,9 @@ ALTER TABLE pa_recovery_puk ADD CONSTRAINT recovery_puk_code_fk FOREIGN KEY (rec
 --
 ALTER TABLE pa_recovery_config ADD CONSTRAINT recovery_config_app_fk FOREIGN KEY (application_id) REFERENCES pa_application (id);
 
+
 ---
---- Indexes for better performance. PostgreSQL does not create indexes on foreign key automatically.
+--- Indexes for better performance. PostgreSQL does not CREATE INDEXes ON foreign key automatically.
 ---
 
 CREATE INDEX pa_activation_application ON pa_activation(application_id);
@@ -359,6 +362,8 @@ CREATE INDEX pa_activation_code ON pa_activation(activation_code);
 
 CREATE INDEX pa_activation_user_id ON pa_activation(user_id);
 
+CREATE INDEX pa_activation_expiration on pa_activation (activation_status, timestamp_activation_expire);
+
 CREATE INDEX pa_activation_history_act ON pa_activation_history(activation_id);
 
 CREATE INDEX pa_activation_history_created ON pa_activation_history(timestamp_created);
@@ -401,19 +406,20 @@ CREATE INDEX pa_operation_ts_created_idx ON pa_operation(timestamp_created);
 
 CREATE INDEX pa_operation_ts_expires_idx ON pa_operation(timestamp_expires);
 
+CREATE INDEX pa_operation_status_exp ON pa_operation(timestamp_expires, status);
+
 CREATE INDEX pa_operation_template_name_idx ON pa_operation_template(template_name);
 
 --
--- Audit log indexes.
+-- Auditing indexes.
 --
-CREATE INDEX audit_log_timestamp ON audit_log (timestamp_created);
-CREATE INDEX audit_log_application ON audit_log (application_name);
-CREATE INDEX audit_log_level ON audit_log (audit_level);
-CREATE INDEX audit_log_type ON audit_log (audit_type);
-CREATE INDEX audit_param_log ON audit_param (audit_log_id);
-CREATE INDEX audit_param_timestamp ON audit_param (timestamp_created);
-CREATE INDEX audit_param_key ON audit_param (param_key);
-CREATE INDEX audit_param_value ON audit_param (param_value);
+CREATE INDEX IF NOT EXISTS audit_log_timestamp ON audit_log (timestamp_created);
+CREATE INDEX IF NOT EXISTS audit_log_application ON audit_log (application_name);
+CREATE INDEX IF NOT EXISTS audit_log_level ON audit_log (audit_level);
+CREATE INDEX IF NOT EXISTS audit_log_type ON audit_log (audit_type);
+CREATE INDEX IF NOT EXISTS audit_param_log ON audit_param (audit_log_id);
+CREATE INDEX IF NOT EXISTS audit_param_timestamp ON audit_param (timestamp_created);
+CREATE INDEX IF NOT EXISTS audit_param_key ON audit_param (param_key);
 
 GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO powerauth;
 GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO powerauth;

deploy/data/postgresql/powerauth-webflow.sql

@@ -573,7 +573,8 @@ CREATE TABLE tpp_detail (
   tpp_website           TEXT NULL,                                   -- TPP website, if available.
   tpp_phone             VARCHAR(256) NULL,                           -- TPP phone number, if available.
   tpp_email             VARCHAR(256) NULL,                           -- TPP e-mail, if available.
-  tpp_logo              TEXT NULL                                    -- TPP logo, if available.
+  tpp_logo              TEXT NULL,                                   -- TPP logo, if available.
+  tpp_blocked           BOOLEAN DEFAULT FALSE NOT NULL               -- Indication if this TPP provider is blocked or not.
 );
 
 CREATE TABLE tpp_app_detail (
@@ -588,7 +589,7 @@ CREATE TABLE tpp_app_detail (
 );
 
 -- Table audit_log stores auditing information
-CREATE TABLE audit_log (
+CREATE TABLE IF NOT EXISTS audit_log (
     audit_log_id       VARCHAR(36) PRIMARY KEY,
     application_name   VARCHAR(256) NOT NULL,
     audit_level        VARCHAR(32) NOT NULL,
@@ -605,7 +606,7 @@ CREATE TABLE audit_log (
 );
 
 -- Table audit_param stores auditing parameters
-CREATE TABLE audit_param (
+CREATE TABLE IF NOT EXISTS audit_param (
     audit_log_id       VARCHAR(36),
     timestamp_created  TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
     param_key          VARCHAR(256),
@@ -615,7 +616,7 @@ CREATE TABLE audit_param (
 CREATE INDEX wf_operation_hash ON wf_operation_session (operation_hash);
 CREATE INDEX wf_websocket_session ON wf_operation_session (websocket_session_id);
 CREATE INDEX ns_operation_pending ON ns_operation (user_id, result);
-CREATE UNIQUE INDEX ns_operation_afs_unique ON ns_operation_afs (operation_id, request_afs_action, request_step_index);
+CREATE UNIQUE INDEX ns_operation_afs_unique on ns_operation_afs (operation_id, request_afs_action, request_step_index);
 CREATE INDEX wf_certificate_operation ON wf_certificate_verification (operation_id);
 CREATE UNIQUE INDEX ns_application_name ON ns_application (name);
 CREATE UNIQUE INDEX ns_credential_policy_name ON ns_credential_policy (name);
@@ -647,14 +648,14 @@ CREATE INDEX ns_authentication_timestamp_created ON ns_authentication (timestamp
 CREATE UNIQUE INDEX ns_hashing_config_name ON ns_hashing_config (name);
 CREATE UNIQUE INDEX ns_user_alias_unique ON ns_user_alias (user_id, name);
 CREATE UNIQUE INDEX ns_user_role_unique ON ns_user_role (user_id, role_id);
-CREATE INDEX audit_log_timestamp ON audit_log (timestamp_created);
-CREATE INDEX audit_log_application ON audit_log (application_name);
-CREATE INDEX audit_log_level ON audit_log (audit_level);
-CREATE INDEX audit_log_type ON audit_log (audit_type);
-CREATE INDEX audit_param_log ON audit_param (audit_log_id);
-CREATE INDEX audit_param_timestamp ON audit_param (timestamp_created);
-CREATE INDEX audit_param_key ON audit_param (param_key);
-CREATE INDEX audit_param_value ON audit_param (param_value);
+CREATE INDEX IF NOT EXISTS audit_log_timestamp ON audit_log (timestamp_created);
+CREATE INDEX IF NOT EXISTS audit_log_application ON audit_log (application_name);
+CREATE INDEX IF NOT EXISTS audit_log_level ON audit_log (audit_level);
+CREATE INDEX IF NOT EXISTS audit_log_type ON audit_log (audit_type);
+CREATE INDEX IF NOT EXISTS audit_param_log ON audit_param (audit_log_id);
+CREATE INDEX IF NOT EXISTS audit_param_timestamp ON audit_param (timestamp_created);
+CREATE INDEX IF NOT EXISTS audit_param_key ON audit_param (param_key);
+CREATE INDEX IF NOT EXISTS audit_param_value ON audit_param (param_value);
 
 GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO powerauth;
 GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO powerauth;
@@ -687,10 +688,10 @@ INSERT INTO ns_auth_method (auth_method, order_number, check_user_prefs, user_pr
 VALUES ('OTP_CODE', 10, FALSE, NULL, NULL, TRUE, 3, TRUE, FALSE, 'method.otpCode');
 
 -- operation configuration
-INSERT INTO ns_operation_config (operation_name, template_version, template_id, mobile_token_enabled, mobile_token_mode) VALUES ('login', 'A', 2, TRUE, '{"type":"2FA","variants":["possession_knowledge","possession_biometry"]}');
-INSERT INTO ns_operation_config (operation_name, template_version, template_id, mobile_token_enabled, mobile_token_mode) VALUES ('login_sca', 'A', 2, TRUE, '{"type":"2FA","variants":["possession_knowledge","possession_biometry"]}');
-INSERT INTO ns_operation_config (operation_name, template_version, template_id, mobile_token_enabled, mobile_token_mode) VALUES ('authorize_payment', 'A', 1, TRUE, '{"type":"2FA","variants":["possession_knowledge","possession_biometry"]}');
-INSERT INTO ns_operation_config (operation_name, template_version, template_id, mobile_token_enabled, mobile_token_mode) VALUES ('authorize_payment_sca', 'A', 1, TRUE, '{"type":"2FA","variants":["possession_knowledge","possession_biometry"]}');
+INSERT INTO ns_operation_config (operation_name, template_version, template_id, mobile_token_enabled, mobile_token_mode) VALUES ('login', 'A', 2, FALSE, '{"type":"2FA","variants":["possession_knowledge","possession_biometry"]}');
+INSERT INTO ns_operation_config (operation_name, template_version, template_id, mobile_token_enabled, mobile_token_mode) VALUES ('login_sca', 'A', 2, FALSE, '{"type":"2FA","variants":["possession_knowledge","possession_biometry"]}');
+INSERT INTO ns_operation_config (operation_name, template_version, template_id, mobile_token_enabled, mobile_token_mode) VALUES ('authorize_payment', 'A', 1, FALSE, '{"type":"2FA","variants":["possession_knowledge","possession_biometry"]}');
+INSERT INTO ns_operation_config (operation_name, template_version, template_id, mobile_token_enabled, mobile_token_mode) VALUES ('authorize_payment_sca', 'A', 1, FALSE, '{"type":"2FA","variants":["possession_knowledge","possession_biometry"]}');
 
 -- organization configuration
 INSERT INTO ns_organization (organization_id, display_name_key, is_default, order_number, default_credential_name, default_otp_name) VALUES ('RETAIL', 'organization.retail', TRUE, 1, 'RETAIL_CREDENTIAL', 'RETAIL_OTP');