Merge branch 'main' into bug6105

configuration/environments_scripts/repo/usr/local/bin/mountnvmeswap

@@ -15,6 +15,9 @@ if [[ -n "${EPHEMERAL_VOLUME_NAME}" ]]; then
         echo FSTYPE was empty, creating swap partition
         mkswap $EPHEMERAL_VOLUME
         swapon --priority 2 -a $EPHEMERAL_VOLUME
+    elif [ "$FSTYPE" = "swap" ]; then
+        # it already is formatted as swap, so we can just use it
+        swapon --priority 2 -a $EPHEMERAL_VOLUME
     else
         echo "FSTYPE was $FSTYPE, not touching"
     fi

configuration/environments_scripts/sailing_server/files/usr/local/bin/refreshInstance.sh

@@ -166,7 +166,7 @@ load_from_release_file ()
         # and then on like above...
     fi
     if [ -n "${BUILD_COMPLETE_NOTIFY}" ]; then
-      echo "Build/Deployment process has been started - it can take 5 to 20 minutes until your instance is ready. " | mail -s "Build or Deployment of $INSTANCE_ID to $SERVER_HOME for server $SERVER_NAME starting" ${BUILD_COMPLETE_NOTIFY}
+      echo "Build/Deployment process has been started - it can take 5 to 20 minutes until your instance is ready. " | mail -r noreply@sapsailing.com -s "Build or Deployment of $INSTANCE_ID to $SERVER_HOME for server $SERVER_NAME starting" ${BUILD_COMPLETE_NOTIFY}
     fi
     RELEASE_FILE_NAME=${INSTALL_FROM_RELEASE}.tar.gz
     cd ${SERVER_HOME}
@@ -227,7 +227,7 @@ build ()
     if [ $MEM_TOTAL -lt 924 ]; then
         echo "Could not start build process with less than 1GB of RAM!"
         if [ -n "${BUILD_COMPLETE_NOTIFY}" ]; then
-          echo "Not enough RAM for completing the build process! You need at least 1GB. Instance NOT started!" | mail -s "Build of $INSTANCE_ID failed" ${BUILD_COMPLETE_NOTIFY}
+          echo "Not enough RAM for completing the build process! You need at least 1GB. Instance NOT started!" | mail -r noreply@sapsailing.com -s "Build of $INSTANCE_ID failed" ${BUILD_COMPLETE_NOTIFY}
         fi
     else
         if [[ $BUILD_BEFORE_START == "True" ]]; then
@@ -266,12 +266,12 @@ deploy ()
     if [ $STATUS -eq 0 ]; then
         echo "Deployment Successful"
         if [ -n "${BUILD_COMPLETE_NOTIFY}" ]; then
-          echo "OK - check the attachment for more information." | mail $MAIL_ATTACH_OPTION $SERVER_HOME/last_automatic_build.txt -s "Build or Deployment of $INSTANCE_ID complete" ${BUILD_COMPLETE_NOTIFY}
+          echo "OK - check the attachment for more information." | mail -r noreply@sapsailing.com $MAIL_ATTACH_OPTION $SERVER_HOME/last_automatic_build.txt -s "Build or Deployment of $INSTANCE_ID complete" ${BUILD_COMPLETE_NOTIFY}
         fi
     else
         echo "Deployment Failed"
         if [ -n "${BUILD_COMPLETE_NOTIFY}" ]; then
-          echo "ERROR - check the attachment for more information." | mail $MAIL_ATTACH_OPTION $SERVER_HOME/last_automatic_build.txt -s "Build of $INSTANCE_ID failed" ${BUILD_COMPLETE_NOTIFY}
+          echo "ERROR - check the attachment for more information." | mail -r noreply@sapsailing.com $MAIL_ATTACH_OPTION $SERVER_HOME/last_automatic_build.txt -s "Build of $INSTANCE_ID failed" ${BUILD_COMPLETE_NOTIFY}
         fi
     fi 
 }

java/com.sap.sailing.landscape/src/com/sap/sailing/landscape/procedures/SailingAnalyticsApplicationConfiguration.java

@@ -201,6 +201,7 @@ extends AwsApplicationConfiguration<ShardingKey, SailingAnalyticsMetrics, Sailin
         protected Iterable<String> getAdditionalJavaArgs() {
             final List<String> result = new ArrayList<>();
             Util.addAll(getAdditionalJavaArgsForSharedSecurity(SharedLandscapeConstants.DEFAULT_DOMAIN_NAME, SharedLandscapeConstants.DEFAULT_SECURITY_SERVICE_REPLICA_SET_NAME), result);
+            // TODO check whether we're really running under the default sapsailing.com domain, before activating SAP branding...
             result.add("-D"+ClientConfigurationListener.DEBRANDING_PROPERTY_NAME+"=false"); // activate branding when running under default SAP domain
             return result;
         }

java/com.sap.sailing.www/release_notes_admin.html

@@ -33,6 +33,9 @@
                     corner of the image/video tile. When a logged-in user with a validated e-mail address clicks the
                     button, a popup dialog allows for additional input and submitting of the take-down request, which
                     will lead to an e-mail being sent to support@sapsailing.com.</li>
+                <li>Fixed parsing of X-Forwarded-For header, now reporting the correct client IP in case of multiple proxies along the way.</li>
+                <li>Improved logging in case operations received from replicas are being applied. The log entry now shows the name of the server
+                    where the operation originated from.</li>
           </ul>
           <h2 class="articleSubheadline">March 2025</h2>
           <ul class="bulletList">

java/com.sap.sse.gwt/src/com/sap/sse/gwt/client/celltable/SortedCellTable.java

@@ -53,7 +53,6 @@ public class SortedCellTable<T> extends BaseCelltable<T> {
         dataProvider = new ListDataProvider<T>();
         dataProvider.addDataDisplay(this);
         columnSortHandler = new ListHandler<T>(dataProvider.getList()) {
-
             @Override
             public void onColumnSort(ColumnSortEvent event) {
                 @SuppressWarnings("unchecked")
@@ -127,10 +126,6 @@ public class SortedCellTable<T> extends BaseCelltable<T> {
 
     /**
      * Adds a column to the table and sets its sortable state
-     * 
-     * @param column
-     * @param headerName
-     * @param sortable
      */
     public void addColumn(Column<T, ?> column, String headerName, InvertibleComparator<T> comparator, boolean ascendingSorting) {
         addColumn(column, headerName);
@@ -150,10 +145,6 @@ public class SortedCellTable<T> extends BaseCelltable<T> {
     
     /**
      * Adds a column to the table and sets its sortable state
-     * 
-     * @param column
-     * @param header
-     * @param sortable
      */
     public void addColumn(Column<T, ?> column, Header<?> header, InvertibleComparator<T> comparator, boolean ascendingSorting) {
         addColumn(column, header);

java/com.sap.sse.replication.interfaces/src/com/sap/sse/replication/OperationWithResult.java

@@ -3,6 +3,7 @@ package com.sap.sse.replication;
 import java.io.ObjectOutputStream;
 import java.io.Serializable;
 
+import com.sap.sse.ServerInfo;
 import com.sap.sse.operationaltransformation.Operation;
 
 /**
@@ -82,4 +83,12 @@ public interface OperationWithResult<S, R> extends Operation<S>, Serializable {
         }
     }
 
+    /**
+     * Returns {@code null} by default; however, operations that originated on a different server and were sent
+     * to their primary will return their {@link ServerInfo#getName() server name}. This can be used, e.g., for
+     * debug output.
+     */
+    default String getOriginServerName() {
+        return null;
+    }
 }

java/com.sap.sse.replication.interfaces/src/com/sap/sse/replication/OperationWithResultWithIdWrapper.java

@@ -3,6 +3,7 @@ package com.sap.sse.replication;
 import java.io.Serializable;
 import java.util.UUID;
 
+import com.sap.sse.ServerInfo;
 import com.sap.sse.common.WithID;
 
 /**
@@ -19,6 +20,7 @@ public class OperationWithResultWithIdWrapper<S, R> implements OperationWithResu
     private static final long serialVersionUID = -5435955633510008283L;
     private final Serializable id;
     private final OperationWithResult<S, R> delegate;
+    private final String originServerName;
 
     /**
      * Creates a new UUID for this wrapper operation
@@ -34,6 +36,7 @@ public class OperationWithResultWithIdWrapper<S, R> implements OperationWithResu
         super();
         this.id = id;
         this.delegate = delegate;
+        this.originServerName = delegate.getOriginServerName() == null ? ServerInfo.getName() : delegate.getOriginServerName();
     }
 
     /**
@@ -41,7 +44,7 @@ public class OperationWithResultWithIdWrapper<S, R> implements OperationWithResu
      */
     @Override
     public Class<?> getClassForLogging() {
-        return delegate.getClass();
+        return delegate.getClassForLogging();
     }
     
     @Override
@@ -94,8 +97,13 @@ public class OperationWithResultWithIdWrapper<S, R> implements OperationWithResu
         return id;
     }
     
+    @Override
+    public String getOriginServerName() {
+        return originServerName;
+    }
+
     @Override
     public String toString() {
-        return ""+delegate+" with ID "+getId();
+        return ""+delegate+" with ID "+getId()+(originServerName==null?"":(" from server \""+getOriginServerName()+"\""));
     }
 }

java/com.sap.sse.replication/src/com/sap/sse/replication/impl/ReplicationServlet.java

@@ -300,6 +300,7 @@ public class ReplicationServlet extends AbstractHttpServlet {
         }
         Thread.currentThread().setContextClassLoader(oldContextClassLoader);
         logger.info("Applying operation of type " + operation.getClassForLogging().getName()
+                + (operation.getOriginServerName() == null ? "" : (" originating from server \""+operation.getOriginServerName()+"\""))
                 + " received from replica to replicable " + replicable.toString());
         try {
             replicable.apply(operation);

java/com.sap.sse.security/src/com/sap/sse/security/UsernamePasswordRealm.java

@@ -1,5 +1,7 @@
 package com.sap.sse.security;
 
+import java.util.logging.Logger;
+
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
@@ -7,12 +9,14 @@ import org.apache.shiro.authc.LockedAccountException;
 import org.apache.shiro.authc.SaltedAuthenticationInfo;
 import org.apache.shiro.authc.UsernamePasswordToken;
 
-import com.sap.sse.security.shared.Account.AccountType;
-import com.sap.sse.security.shared.impl.User;
 import com.sap.sse.security.interfaces.SimpleSaltedAuthenticationInfo;
+import com.sap.sse.security.shared.Account.AccountType;
 import com.sap.sse.security.shared.UsernamePasswordAccount;
+import com.sap.sse.security.shared.impl.User;
 
 public class UsernamePasswordRealm extends AbstractCompositeAuthorizingRealm {
+    private static final Logger logger = Logger.getLogger(UsernamePasswordRealm.class.getName());
+
     public UsernamePasswordRealm() {
         super();
         setAuthenticationTokenClass(UsernamePasswordToken.class);
@@ -46,6 +50,7 @@ public class UsernamePasswordRealm extends AbstractCompositeAuthorizingRealm {
             return null;
         }
         if (user.getLockingAndBanning().isAuthenticationLocked()) {
+            logger.warning("Rejected attempt to authenticate user "+username+" because it is locked: "+user.getLockingAndBanning());
             throw new LockedAccountException("Password authentication for user "+username+" is currently locked");
         }
         final UsernamePasswordAccount upa = (UsernamePasswordAccount) user.getAccount(AccountType.USERNAME_PASSWORD);

java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java

@@ -1292,6 +1292,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
             lockingAndBanning = user.getLockingAndBanning();
             lockingAndBanning.failedPasswordAuthentication();
             store.updateUser(user);
+            logger.info("failed password authentication for user "+username+"; locking: "+lockingAndBanning);
         } else {
             lockingAndBanning = null;
         }
@@ -1330,6 +1331,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
     public LockingAndBanning internalFailedBearerTokenAuthentication(String clientIP) {
         final LockingAndBanning lockingAndBanning = clientIPBasedLockingAndBanningForBearerTokenAuthentication.computeIfAbsent(escapeNullClientIP(clientIP), key->new LockingAndBanningImpl());
         lockingAndBanning.failedPasswordAuthentication();
+        logger.info("failed bearer token authentication from client IP "+clientIP+"; locking: "+lockingAndBanning);
         scheduleCleanUpTask(clientIP, lockingAndBanning, clientIPBasedLockingAndBanningForBearerTokenAuthentication,
                 "client IPs locked for bearer token authentication");
         return lockingAndBanning;

java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java

@@ -110,7 +110,7 @@ public class SecurityResource extends AbstractSecurityResource {
                     usernames.add(userWithPermission.getName());
                 }
             }
-            logger.info("Request for users with permission took "+start.until(TimePoint.now()));
+            logger.fine(()->"Request for users with permission took "+start.until(TimePoint.now()));
             return Response.status(Status.OK).entity(streamingOutput(usernames)).build();
         } catch (Exception e) {
             return Response.status(Status.PRECONDITION_FAILED).entity(e.getMessage()).build();

java/com.sap.sse/src/com/sap/sse/util/HttpRequestUtils.java

@@ -30,7 +30,7 @@ public abstract class HttpRequestUtils {
         final String result;
         if (Util.hasLength(xForwardedFor)) {
             final String[] ips = xForwardedFor.split(", *");
-            result = ips[ips.length-1];
+            result = ips[0];
         } else {
             result = req.getRemoteAddr();
         }

wiki/howto/onboarding.md

@@ -44,25 +44,24 @@ For a Gollum Wiki account send a request to Axel Uhl or Simon Marcel Pamies that
 
 ### Installations
 
-1. JDK >= 11. No longer required by Eclipse because new Eclipse releases bring their own JDK bundled with the installer. Still, if you want to use Java 11 or Java 17, install any such JDK and set the `JAVA_HOME` variable to it.
-2. Eclipse IDE for Eclipse Committers, version ["2025-03"](https://www.eclipse.org/downloads/packages/release/2025-03/r/eclipse-ide-eclipse-committers) 
-3. JDK 1.8 (Java SE 8), ideal is the SAPJVM 1.8: Go to [https://tools.eu1.hana.ondemand.com/#cloud](https://tools.eu1.hana.ondemand.com/#cloud), scroll down to `SAP JVM` select your operating System, extract the downloaded .zip into desired location (e.g. Windows `C:\Program Files\Java`. If you want to make this your default JDK, set the `JAVA_HOME` variable to it. In any case, set the `JAVA8_HOME` variable to it which is required by a few build scripts where certain steps currently are not yet compatible with newer JDK releases, such as our Android build process, keeping us on Gradle 6.0.1 for the time being which isn't Java 17-compatible.
-4. Git (e.g. Git for Windows v2.18), [http://git-scm.com](http://git-scm.com) / [https://git-for-windows.github.io](https://git-for-windows.github.io)still
-5. Configure git (see [Git repository configuration essentials](#onboarding-information_sap-sailing-analytics-development-setup_git-repository-configuration-essentials))
-6. MongoDB (at least Release 6.0), download: [https://www.mongodb.com/](https://www.mongodb.com/). You may need to choose the community edition. In addition, install `mongosh`.
-7. RabbitMQ, download from [http://www.rabbitmq.com](http://www.rabbitmq.com). Requires Erlang to be installed. RabbitMQ installer will assist in installing Erlang. Some sources report that there may be trouble with the latest versions of RabbitMQ. In some cases, McAffee seems to block the installation of the latest version on SAP hardware; in other cases connection problems to the newest versions have been reported. We know that version 3.6.8 works well. [https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_8](https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_8)
-8.  Maven 3.1.1 (or higher), [http://maven.apache.org](http://maven.apache.org)
+1. Eclipse IDE for Eclipse Committers, version ["2025-03"](https://www.eclipse.org/downloads/packages/release/2025-03/r/eclipse-ide-eclipse-committers) 
+2. JDK 1.8 (Java SE 8), ideal is the SAPJVM 1.8: Go to [https://tools.eu1.hana.ondemand.com/#cloud](https://tools.eu1.hana.ondemand.com/#cloud), scroll down to `SAP JVM` select your operating System, extract the downloaded .zip into desired location (e.g. Windows `C:\Program Files\Java`. If you want to make this your default JDK, set the `JAVA_HOME` variable to it. In any case, set the `JAVA8_HOME` variable to it which is required by a few build scripts where certain steps currently are not yet compatible with newer JDK releases, such as our Android build process, keeping us on Gradle 6.0.1 for the time being which isn't Java 17-compatible.
+3. Git (e.g. Git for Windows v2.18), [http://git-scm.com](http://git-scm.com) / [https://git-for-windows.github.io](https://git-for-windows.github.io)still
+4. Configure git (see [Git repository configuration essentials](#onboarding-information_sap-sailing-analytics-development-setup_git-repository-configuration-essentials))
+5. MongoDB (at least Release 6.0), download: [https://www.mongodb.com/](https://www.mongodb.com/). You may need to choose the community edition. In addition, install `mongosh`.
+6. RabbitMQ, download from [http://www.rabbitmq.com](http://www.rabbitmq.com). Requires Erlang to be installed. RabbitMQ installer will assist in installing Erlang. Some sources report that there may be trouble with the latest versions of RabbitMQ. In some cases, McAffee seems to block the installation of the latest version on SAP hardware; in other cases connection problems to the newest versions have been reported. We know that version 3.6.8 works well. [https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_8](https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_8)
+7.  Maven 3.1.1 (or higher), [http://maven.apache.org](http://maven.apache.org)
     A setup guide for windows can be found on this webpage: [https://maven.apache.org/guides/getting-started/windows-prerequisites.html](https://maven.apache.org/guides/getting-started/windows-prerequisites.html)
-9.  Forked GWT SDK 2.11.0 release candidate ([https://static.sapsailing.com/gwt-2.11.0.zip](https://static.sapsailing.com/gwt-2.11.0.zip)). The official releases can be found at [http://www.gwtproject.org/download.html](http://www.gwtproject.org/download.html)
+8.  Forked GWT SDK 2.11.0 release candidate ([https://static.sapsailing.com/gwt-2.11.0.zip](https://static.sapsailing.com/gwt-2.11.0.zip)). The official releases can be found at [http://www.gwtproject.org/download.html](http://www.gwtproject.org/download.html)
     but shouldn't be used unless we roll back the changes of branch ``bug5077`` or GWT has merged and released the [pull request 9779](https://github.com/gwtproject/gwt/pull/9779).
     Download the GWT DSK and extract it to a location of your preference (e.g. `C:\Program Files\gwt` on Windows or `/opt/gwt` on Linux or MacOS/X).
     You will see in section [Tuning the Eclipse Installation](#onboarding-information_sap-sailing-analytics-development-setup_tuning-the-eclipse-installation)
     below how you announce this GWT SDK to your Eclipse installation.
-10. Standalone Android SDK (see section "Additional steps required for Android projects"). OPTIONALLY: You may additionally install Android Studio ([https://developer.android.com/tools/studio/index.html](https://developer.android.com/tools/studio/index.html)) or IntelliJ IDEA ([https://www.jetbrains.com/idea/download/](https://www.jetbrains.com/idea/download/)).
+9. Standalone Android SDK (see section "Additional steps required for Android projects"). OPTIONALLY: You may additionally install Android Studio ([https://developer.android.com/tools/studio/index.html](https://developer.android.com/tools/studio/index.html)) or IntelliJ IDEA ([https://www.jetbrains.com/idea/download/](https://www.jetbrains.com/idea/download/)).
     Make sure that the environment variable `ANDROID_HOME` is set (e.g. Windows C:\Users\\**'user'**\AppData\Local\Android\Sdk )
-11. Get the content of the git repository
+10. Get the content of the git repository
     Clone the repository to your local file system from `ssh://[SAP-User]@git.wdf.sap.corp:29418/SAPSail/sapsailingcapture.git` or `ssh://trac@sapsailing.com/home/trac/git` User "trac" has all public ssh keys.
-12. Install the eclipse plugins (see [Automatic Eclipse plugin installation](#onboarding-information_sap-sailing-analytics-development-setup_automatic-eclipse-plugin-installation))
+11. Install the eclipse plugins (see [Automatic Eclipse plugin installation](#onboarding-information_sap-sailing-analytics-development-setup_automatic-eclipse-plugin-installation))
 12. Configure Eclipse (see [Tuning the Eclipse Installation](#onboarding-information_sap-sailing-analytics-development-setup_tuning-the-eclipse-installation))
 13. Configure Maven to use the correct JRE by following the instructions in the paragraph [maven-setup](#onboarding-information_sap-sailing-analytics-development-setup_maven-setup)
 14. Follow the instructions in the [development setup](#onboarding-information_sap-sailing-analytics-development-setup_sap-sailing-analytics-development-setup) to build the project.

wiki/planning/domain-switchover.md

@@ -19,7 +19,7 @@
 
 - The ``refreshInstance.sh`` script contains around eight references to ``releases.sapsailing.com``. Some of these are about where to download releases from and shall be replaced by logic that obtains those releases from Github. The others are concerned with environments, as referenced by the ``USE_ENVIRONMENT`` variable and are currently expected to be found under ``https://releases.sapsailing.com/environments`` which is just a static share on our central reverse proxy. If that is configured for a different domain then so has the refreshInstance.sh script.
 
-- Igtimi Authentication: the Igtimi REST API and authentication scheme uses a callback URL that we have configured on the igtimi.com web site, pointing to sapsailing.com.
+- Igtimi Riot Server: we run the Riot server environment as an application replica set named ``wind`` under ``wind.sapsailing.com`` which is then used as a default for new servers in landscape automation
 
 - Google Maps API is SAP provided in our current production environment, and a different API token/key is required once SAP stops its support.
 
@@ -29,4 +29,6 @@
 
 - MongoDB references and rabbit references, or any other private IP references in route53. Such references can in particular be found in the ``environments/`` folder on ``releases.sapsailing.com`` for the default parameterization of certain application process types, such as ``security-service-master`` or ``archive-server``.
 
-- branch.io is used for "deep linking" for the apps. We have an integration with our Route53 hosted zone "sapsailing.com" for the specific domain names, allowing smart payload transfer through from-scratch installations, e.g., from a QR code. The branch.io account would need to be transferred and would need to have the configuration changed; or a new account would be required. The apps' deep linking capabilities are expressed in their manifests, and hence the apps would need to be adjusted to work with a different domain.
+- branch.io is used for "deep linking" for the apps. We have an integration with our Route53 hosted zone "sapsailing.com" for the specific domain names, allowing smart payload transfer through from-scratch installations, e.g., from a QR code. The branch.io account would need to be transferred and would need to have the configuration changed; or a new account would be required. The apps' deep linking capabilities are expressed in their manifests, and hence the apps would need to be adjusted to work with a different domain.
+
+- App hosting, at least for Race Manager and Buoy Pinger apps, currently runs through the SAP SE PlayStore account. If someone else was to build and deploy these apps under their own Google PlayStore account, this would affect the deep linking and QR code generation, see above on the branch.io ramifications.