Update Logto to 1.41 and fix local Admin Console connectivity

examples/logto/CommunityToolkit.Aspire.Logto.ClientJWT/Program.cs

@@ -4,7 +4,7 @@
 
 var builder = WebApplication.CreateBuilder(args);
 builder.AddServiceDefaults();
-const string apiAudience = "http://localhost:5072/";
+const string apiAudience = "http://127.0.0.1:9234/";
 builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
     .AddLogtoJwtBearer("logto", appIdentification: apiAudience,
         configureOptions: opt =>

src/CommunityToolkit.Aspire.Hosting.Logto/CommunityToolkit.Aspire.Hosting.Logto.csproj

@@ -4,6 +4,7 @@
   <PropertyGroup>
     <Description>.NET Aspire hosting extensions for Logto (includes PostgreSQL and Redis integration).</Description>
     <AdditionalPackageTags>logto redis postgres hosting extensions</AdditionalPackageTags>
+    <EnableAspireIntegrationAnalyzers>true</EnableAspireIntegrationAnalyzers>
   </PropertyGroup>
 
     <ItemGroup>

src/CommunityToolkit.Aspire.Hosting.Logto/LogtoBuilderExtensions.cs

@@ -1,5 +1,6 @@
 using Aspire.Hosting.ApplicationModel;
 using Microsoft.Extensions.DependencyInjection;
+using System.ComponentModel;
 
 #pragma warning disable ASPIREATS001 // AspireExport is experimental
 
@@ -25,7 +26,7 @@ public static class LogtoBuilderExtensions
     [AspireExport]
     public static IResourceBuilder<LogtoResource> AddLogto(
         this IDistributedApplicationBuilder builder,
-        string name,
+        [ResourceName] string name,
         IResourceBuilder<PostgresServerResource> postgres,
         string databaseName = "logto_db",
         int? port = null,
@@ -44,12 +45,52 @@ public static IResourceBuilder<LogtoResource> AddLogto(
             .WithImageRegistry(LogtoContainerImageTags.Registry);
 
         builderWithResource.WithResourcePort(port, adminPort);
+        builderWithResource.WithEnvironment(context =>
+        {
+            // Logto uses these public URLs for browser redirects and Admin Console API calls.
+            // They are only concrete after Aspire allocates the run-mode host ports.
+            if (resource.PrimaryEndpoint.IsAllocated)
+            {
+                context.EnvironmentVariables.TryAdd("ENDPOINT", resource.PrimaryEndpoint.Url);
+            }
+
+            if (resource.AdminEndpointUrl is not null)
+            {
+                context.EnvironmentVariables.TryAdd("ADMIN_ENDPOINT", resource.AdminEndpointUrl);
+            }
+            else
+            {
+                var adminEndpoint = resource.GetEndpoint(LogtoResource.AdminEndpointName);
+                if (adminEndpoint.IsAllocated)
+                {
+                    context.EnvironmentVariables.TryAdd("ADMIN_ENDPOINT", GetCorsSafeLocalAdminUrl(adminEndpoint.Url));
+                }
+            }
+        });
+        if (builder.ExecutionContext.IsRunMode)
+        {
+            builderWithResource.WithUrlForEndpoint(LogtoResource.AdminEndpointName, url =>
+                url.Url = resource.AdminEndpointUrl ?? GetCorsSafeLocalAdminUrl(url.Url));
+        }
         builderWithResource.WithDatabase(postgres, databaseName);
         SetHealthCheck(builder, builderWithResource, name);
 
         return builderWithResource;
     }
 
+    private static string GetCorsSafeLocalAdminUrl(string url)
+    {
+        var uri = new Uri(url);
+
+        if (!uri.Host.Equals("localhost", StringComparison.OrdinalIgnoreCase))
+        {
+            return url;
+        }
+
+        var builder = new UriBuilder(uri) { Host = "127.0.0.1" };
+        return builder.Uri.GetLeftPart(UriPartial.Authority);
+    }
+
     /// <summary>
     /// Enables Node.js deprecation tracing for the Logto by setting the
     /// NODE_OPTIONS environment variable to '--trace-deprecation'.
@@ -131,7 +172,8 @@ public static IResourceBuilder<LogtoResource> WithResourcePort(
             .WithHttpEndpoint(
                 port: adminPort,
                 targetPort: LogtoResource.DefaultHttpAdminPort,
-                name: LogtoResource.AdminEndpointName);
+                name: LogtoResource.AdminEndpointName)
+            .WithEndpoint(LogtoResource.AdminEndpointName, endpoint => endpoint.ExcludeReferenceEndpoint = true);
     }
 
     /// <summary>
@@ -147,7 +189,9 @@ public static IResourceBuilder<LogtoResource> WithAdminEndpoint(this IResourceBu
         ArgumentNullException.ThrowIfNull(builder);
         ArgumentException.ThrowIfNullOrEmpty(url);
 
-        return builder.WithEnvironment("ADMIN_ENDPOINT", url);
+        builder.Resource.AdminEndpointUrl = url;
+
+        return builder;
     }
 
     /// <summary>
@@ -184,7 +228,9 @@ public static IResourceBuilder<LogtoResource> WithTrustProxyHeader(this IResourc
     /// <param name="builder">The resource builder for the Logto resource to configure.</param>
     /// <param name="sensitiveUsername">A value indicating whether usernames should be treated as case-sensitive.</param>
     /// <returns>The updated resource builder with the configured case-sensitivity setting.</returns>
-    [AspireExport]
+    [AspireExportIgnore(Reason = "CASE_SENSITIVE_USERNAME was removed in Logto 1.41 and is retained only for source compatibility.")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [Obsolete("CASE_SENSITIVE_USERNAME is deprecated in Logto 1.41. Configure username case sensitivity per tenant in the Logto Console instead.")]
     public static IResourceBuilder<LogtoResource> WithSensitiveUsername(this IResourceBuilder<LogtoResource> builder, bool sensitiveUsername)
     {
         ArgumentNullException.ThrowIfNull(builder);
@@ -259,23 +305,58 @@ public static IResourceBuilder<LogtoResource> WithDatabase(
         dbUrlBuilder.Append($"{postgres.Resource.UriExpression}/{databaseName}");
         var dbUrl = dbUrlBuilder.Build();
 
+        builder.Resource.DatabaseUrl = dbUrl;
+        builder.Resource.PostgresResource = postgres.Resource;
+
         return builder.WithEnvironment("DB_URL", dbUrl)
             .WaitFor(postgres);
     }
 
     /// <summary>
-    /// Starts Logto by running the database seed command before the application process.
+    /// Seeds and upgrades the Logto database in a one-shot setup container before Logto starts.
     /// </summary>
     /// <param name="builder">The resource builder for the Logto resource to configure.</param>
+    /// <param name="disableAdminPwnedPasswordCheck">
+    /// Disables the Have I Been Pwned check for the initial admin password. Use this only in air-gapped environments.
+    /// </param>
     /// <returns>The resource builder for the configured Logto resource.</returns>
     [AspireExport]
-    public static IResourceBuilder<LogtoResource> WithDatabaseSeeding(this IResourceBuilder<LogtoResource> builder)
+    public static IResourceBuilder<LogtoResource> WithDatabaseSeeding(
+        this IResourceBuilder<LogtoResource> builder,
+        bool disableAdminPwnedPasswordCheck = false)
     {
         ArgumentNullException.ThrowIfNull(builder);
 
-        return builder
+        if (builder.ApplicationBuilder.ExecutionContext.IsPublishMode)
+        {
+            return builder;
+        }
+
+        var databaseUrl = builder.Resource.DatabaseUrl
+            ?? throw new InvalidOperationException("Configure the Logto database before enabling database seeding.");
+        var postgres = builder.Resource.PostgresResource
+            ?? throw new InvalidOperationException("Configure the Logto PostgreSQL resource before enabling database seeding.");
+        var setupName = $"{builder.Resource.Name}-database-setup";
+        if (builder.ApplicationBuilder.TryCreateResourceBuilder<LogtoDatabaseSetupResource>(setupName, out _))
+        {
+            return builder;
+        }
+
+        var seedArguments = disableAdminPwnedPasswordCheck ? "--swe --dapc" : "--swe";
+
+        var setup = builder.ApplicationBuilder
+            .AddResource(new LogtoDatabaseSetupResource(setupName))
+            .WithImage(LogtoContainerImageTags.Image, LogtoContainerImageTags.Tag)
+            .WithImageRegistry(LogtoContainerImageTags.Registry)
             .WithEntrypoint("sh")
-            .WithArgs("-c", "npm run cli db seed -- --swe && npm start");
+            .WithArgs("-c", $"npm run cli db seed -- {seedArguments} && npm run alteration deploy latest")
+            .WithEnvironment("DB_URL", databaseUrl)
+            .WithEnvironment("CI", "true")
+            .WithParentRelationship(builder.Resource)
+            .ExcludeFromManifest()
+            .WaitFor(builder.ApplicationBuilder.CreateResourceBuilder(postgres));
+
+        return builder.WaitForCompletion(setup);
     }
 }
 

src/CommunityToolkit.Aspire.Hosting.Logto/LogtoResource.cs

@@ -21,6 +21,12 @@ public sealed class LogtoResource(string name)
 
     private EndpointReference? _primaryEndpointReference;
 
+    internal ReferenceExpression? DatabaseUrl { get; set; }
+
+    internal PostgresServerResource? PostgresResource { get; set; }
+
+    internal string? AdminEndpointUrl { get; set; }
+
     /// Gets the primary endpoint associated with the container resource.
     /// This property provides a reference to the primary HTTP endpoint for the resource,
     /// facilitating network communication and identifying the primary access point.
@@ -72,4 +78,6 @@ IEnumerable<KeyValuePair<string, ReferenceExpression>> IResourceWithConnectionSt
     }
 }
 
+internal sealed class LogtoDatabaseSetupResource(string name) : ContainerResource(name);
+
 #pragma warning restore ASPIREATS001

src/CommunityToolkit.Aspire.Hosting.Logto/LogtoTags.cs

@@ -11,6 +11,6 @@ internal sealed class LogtoContainerImageTags
     /// <summary>svhd/logto</summary>
     public const string Image = "svhd/logto";
 
-    /// <summary>1.39</summary>
-    public const string Tag = "1.39";
+    /// <summary>1.41</summary>
+    public const string Tag = "1.41";
 }

src/CommunityToolkit.Aspire.Hosting.Logto/README.md

@@ -1,67 +1,82 @@
-# Logto Hosting Extensions for .NET Aspire
+# Logto hosting integration
 
-## Overview
+Use this integration to model, configure, and orchestrate a [Logto](https://logto.io/) identity service in an Aspire distributed application. It connects Logto to PostgreSQL, optionally connects Redis, exposes the public and Admin Console endpoints, and provides a one-shot database setup command for local runs.
 
-This package provides **.NET Aspire hosting extensions** for integrating **Logto** with your AppHost.
-It includes helpers for wiring Logto to **PostgreSQL** (via `Aspire.Hosting.Postgres.AddPostgres()`) and optional **Redis** caching, and exposes fluent APIs to configure the required environment variables for Logto database connectivity, initialization, and caching.
-
----
+## Getting started
 
-## Features
+Install the hosting integration in the AppHost directory:
 
-- Configure **Logto** to use **PostgreSQL** via `AddLogto(...)`.
-- Optional **Redis** integration for caching via `.WithRedis(...)`.
-- Fluent helpers to set environment variables:
-  - `DB_URL` (Postgres connection string)
-  - `REDIS_URL`
-  - `NODE_ENV`
-  - `ADMIN_ENDPOINT`
-- Data persistence via:
-  - `.WithDataVolume()` (managed Docker volume)
-  - `.WithDataBindMount()` (host bind mount).
-- Configurable **Admin Console** access and **proxy header** trust (`TRUST_PROXY_HEADER`).
-- Built-in health check for `/api/status`.
-
----
+```console
+aspire add CommunityToolkit.Aspire.Hosting.Logto
+```
 
-## Usage (AppHost)
+## Usage example
 
 ```csharp
-using Aspire.Hosting;
-using Aspire.Hosting.Postgres;
+var builder = DistributedApplication.CreateBuilder(args);
+
 var postgres = builder.AddPostgres("postgres");
+var redis = builder.AddRedis("redis");
 
-// Basic setup connecting to Postgres
-var logto = builder
-    .AddLogto("logto", postgres)
+var logto = builder.AddLogto("logto", postgres)
+    .WithRedis(redis)
     .WithDatabaseSeeding();
 
-// Advanced setup with Redis and specific configurations
-var redis = builder.AddRedis("redis");
+builder.AddProject<Projects.MyApi>("api")
+    .WithReference(logto)
+    .WaitFor(logto);
 
-var logtoSecure = builder
-    .AddLogto("logto-secure", postgres, databaseName: "logto_secure_db")
-    .WithRedis(redis)
-    .WithAdminEndpoint("https://admin.example.com")
-    .WithDisableAdminConsole(false)
-    .WithTrustProxyHeader(true)      // optional override, default is already true
-    .WithSensitiveUsername(true)
-    .WithNodeEnv("production");
+builder.Build().Run();
+```
+
+The same integration is exported to a TypeScript AppHost:
+
+```typescript
+const postgres = await builder.addPostgres("postgres");
+const redis = await builder.addRedis("redis");
+const logto = await builder.addLogto("logto", postgres);
+const api = await builder.addProject("api", "../MyApi/MyApi.csproj");
+
+await logto.withRedis(redis);
+await logto.withDatabaseSeeding();
+await api.withReference(logto);
+await api.waitFor(logto);
 ```
 
-Logto will be configured with:
+`AddLogto` configures `DB_URL`, `ENDPOINT`, `ADMIN_ENDPOINT`, the `/api/status` health check, and the dependency on PostgreSQL. `WithRedis` adds `REDIS_URL` and the Redis dependency.
+
+### Database setup
+
+Call `WithDatabaseSeeding()` to seed the database and deploy required schema alterations in a one-shot setup container before Logto starts. The helper is run-only and is excluded from published manifests. Repeated calls do not create duplicate setup resources.
+
+For an air-gapped environment, use `WithDatabaseSeeding(disableAdminPwnedPasswordCheck: true)` to pass Logto's `--dapc` option during initial administrator creation.
+
+### Local Admin Console and CORS
+
+Logto's API and Admin Console use separate endpoints. During local Aspire runs, the integration sets `ENDPOINT` to the allocated API URL and normalizes the Admin Console URL to `127.0.0.1`. This is required by Logto 1.41's production CORS behavior.
+
+Open the exact `admin` URL shown in the Aspire Dashboard. Replacing `127.0.0.1` with `localhost` can cause requests such as `/api/resources` to fail CORS preflight checks and prevent Applications from being created. `WithAdminEndpoint("https://admin.example.com")` updates both Logto's `ADMIN_ENDPOINT` and the Dashboard URL.
+
+When TLS terminates at a reverse proxy, configure `WithTrustProxyHeader(true)` and ensure that the proxy sends `X-Forwarded-Proto`.
+
+## Connection properties
+
+When another resource uses `WithReference(logto)`, Aspire injects the connection string in the standard `ConnectionStrings__{resourceName}` environment variable. The connection string has the form `Endpoint={Uri}`.
+
+| Property | Description | Example |
+| --- | --- | --- |
+| `Host` | Host name of the public Logto endpoint. | `localhost` |
+| `Port` | Allocated port of the public Logto endpoint. | `10611` |
+| `Uri` | Complete public Logto endpoint URL. | `http://localhost:10611` |
+
+The Admin Console endpoint is intentionally excluded from service-reference endpoint expansion; consumers receive the public Logto endpoint only.
 
-* `DB_URL=postgresql://.../logto_db` (constructed from the Postgres resource)
-* `REDIS_URL=...` (when Redis is attached with `.WithRedis(...)`)
-* `ADMIN_ENDPOINT=...` (when configured with `.WithAdminEndpoint(...)`)
-* `NODE_ENV=production` (when configured with `.WithNodeEnv(...)`)
-* Auto-configured health checks on `/api/status`.
+## Additional documentation
 
----
+- [Logto documentation](https://docs.logto.io/)
+- [Logto configuration](https://docs.logto.io/logto-oss/using-cli/logto-config)
+- [Aspire service discovery](https://learn.microsoft.com/dotnet/aspire/service-discovery/overview)
 
-## Notes
+## Feedback & contributing
 
-* Extension methods are in the `Aspire.Hosting` namespace.
-* Call `.WithDatabaseSeeding()` to run the database seeding command
-  `npm run cli db seed -- --swe && npm start` on startup.
-* Container ports are **3001** (HTTP) and **3002** (Admin). Host ports are random by default unless explicitly configured.
+Report bugs and request features in the [CommunityToolkit/Aspire issue tracker](https://github.com/CommunityToolkit/Aspire/issues). Contributions are welcome; see the repository's [contributing guide](https://github.com/CommunityToolkit/Aspire/blob/main/CONTRIBUTING.md).

src/CommunityToolkit.Aspire.Logto.Client/LogtoClientBuilder.cs

@@ -1,8 +1,8 @@
-using Logto.AspNetCore.Authentication;
+using CommunityToolkit.Aspire.Logto.Client;
+using Logto.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
-using CommunityToolkit.Aspire.Logto.Client;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
@@ -60,6 +60,13 @@ public static IServiceCollection AddLogtoOIDC(this IHostApplicationBuilder build
             opt.Endpoint = options.Endpoint;
             opt.AppId = options.AppId;
             opt.AppSecret = options.AppSecret;
+            opt.Scopes = options.Scopes;
+            opt.Resource = options.Resource;
+            opt.Prompt = options.Prompt;
+            opt.CallbackPath = options.CallbackPath;
+            opt.SignedOutCallbackPath = options.SignedOutCallbackPath;
+            opt.GetClaimsFromUserInfoEndpoint = options.GetClaimsFromUserInfoEndpoint;
+            opt.CookieDomain = options.CookieDomain;
         });
         builder.Services.Configure<OpenIdConnectOptions>(authenticationScheme, opt =>
         {
@@ -183,6 +190,8 @@ private static LogtoOptions GetValidatedOptions(
             throw new InvalidOperationException("Logto Endpoint must be configured.");
         }
 
+        ValidateEndpoint(options.Endpoint);
+
         if (string.IsNullOrWhiteSpace(options.AppId))
         {
             throw new InvalidOperationException("Logto AppId must be configured.");
@@ -225,6 +234,16 @@ private static LogtoOptions GetEndpoint(IConfiguration configuration, string? co
                 $"Logto Endpoint must be configured in configuration section '{configurationSectionName ?? DefaultConfigSectionName}' or in connection string '{connectionName}'.");
         }
 
+        ValidateEndpoint(options.Endpoint);
+
         return options;
     }
-}
+
+    private static void ValidateEndpoint(string endpoint)
+    {
+        if (!LogtoConnectionStringHelper.TryCreateHttpUri(endpoint, out _))
+        {
+            throw new InvalidOperationException("Logto Endpoint must be an absolute HTTP or HTTPS URI.");
+        }
+    }
+}