New Webserver and WebApp (#942)

* Replace the WCF webserver with an ASP.NET Core webserver (VocaluxeWeb)

- New project VocaluxeWeb: ASP.NET Core 2.3 (Kestrel) on .NET Framework 4.8.1, HTTP or HTTPS
  with a self-signed certificate, REST API (/api/v1) with Swagger, live events (Server-Sent Events)
- Access to the game only through IVocaluxeRemote; requests run on the main thread once per frame
- Sessions with roles (guest, player, admin) and configurable permissions, PINs hashed with PBKDF2
- Queue as a playlist with requesters and singers, fair order (one song per person and round)
- Admin: settings, server status, logged-in devices, activate/deactivate and delete profiles
- Profile pictures: own photo or one of the Vocaluxe avatars
- Game: WebApp queue screen (song options, playlist group) to start the next song with the chosen
  singers, return to it after singing, warning when the webserver is off, remote keyboard
- Old WCF server, WebserverInitalConfig and URL reservations removed; libraries moved to libs/managed
- Unit tests for PIN hashing, settings and permissions, queue order and device names
- AppVeyor: Visual Studio 2022 image and Node.js 24 (the build compiles the WebApp)
- Documentation in VocaluxeWeb/README.md

* New WebApp (Vue 3, TypeScript, Vite) replacing the old jQuery Mobile website

- Login with profile and PIN, create profiles
- Songs with search, filters, sorting and 30 second previews
- Queue: add songs with game mode, audio and singers, edit, reorder, start in the game
- Playlists: create, edit, add to the queue
- Now playing with live updates, remote control and keyboard
- Players: own profile with picture (photo or Vocaluxe avatar), roles for admins
- Admin settings: permissions, server status, devices, profiles
- Help page, responsive layout for phones, tablets and desktops, light and dark mode
- Texts in WebApp/src/locales/en.json, translated with Transifex
- Old website and PhoneGap config removed

---------

Co-authored-by: Florian Ostertag <flokuep@users.noreply.github.com>

VocaluxeWeb/Hosting/CCertificateProvider.cs

@@ -0,0 +1,96 @@
+#region license
+// This file is part of Vocaluxe.
+//
+// Vocaluxe is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Vocaluxe is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
+#endregion
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+
+namespace VocaluxeWeb.Hosting
+{
+    /// Self-signed certificate for the optional HTTPS mode. Stored as PFX file, no certificate store or admin rights needed.
+    /// A new one is created when the file is missing, expired or does not cover the current addresses.
+    static class CCertificateProvider
+    {
+        private const string _SubjectAlternativeNameOid = "2.5.29.17";
+
+        public static X509Certificate2 GetOrCreate(string path, string hostName, IList<IPAddress> addresses)
+        {
+            if (File.Exists(path))
+            {
+                try
+                {
+                    var existing = new X509Certificate2(File.ReadAllBytes(path), (string)null, X509KeyStorageFlags.UserKeySet);
+                    if (existing.NotAfter > DateTime.Now.AddDays(7) && _Covers(existing, hostName, addresses))
+                    {
+                        return existing;
+                    }
+                }
+                catch (CryptographicException)
+                {
+                    //Broken file, a new certificate is created below
+                }
+            }
+
+            var pfx = _Create(hostName, addresses);
+            var directory = Path.GetDirectoryName(path);
+            if (!string.IsNullOrEmpty(directory))
+            {
+                Directory.CreateDirectory(directory);
+            }
+
+            File.WriteAllBytes(path, pfx);
+            return new X509Certificate2(pfx, (string)null, X509KeyStorageFlags.UserKeySet);
+        }
+
+        private static bool _Covers(X509Certificate2 cert, string hostName, IEnumerable<IPAddress> addresses)
+        {
+            var san = cert.Extensions[_SubjectAlternativeNameOid]?.Format(false) ?? "";
+            return san.Contains(hostName) && addresses.All(a => san.Contains(a.ToString()));
+        }
+
+        private static byte[] _Create(string hostName, IEnumerable<IPAddress> addresses)
+        {
+            using (var rsa = RSA.Create(2048))
+            {
+                var request = new CertificateRequest("CN=Vocaluxe (" + hostName + ")", rsa, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+
+                var san = new SubjectAlternativeNameBuilder();
+                san.AddDnsName(hostName);
+                san.AddDnsName("localhost");
+                san.AddIpAddress(IPAddress.Loopback);
+                foreach (var address in addresses)
+                {
+                    san.AddIpAddress(address);
+                }
+
+                request.CertificateExtensions.Add(san.Build());
+                request.CertificateExtensions.Add(new X509BasicConstraintsExtension(false, false, 0, false));
+                request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment, false));
+                request.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(new OidCollection { new Oid("1.3.6.1.5.5.7.3.1") }, false)); //Server authentication
+
+                using (var cert = request.CreateSelfSigned(DateTimeOffset.Now.AddDays(-1), DateTimeOffset.Now.AddYears(2)))
+                {
+                    return cert.Export(X509ContentType.Pfx);
+                }
+            }
+        }
+    }
+}

VocaluxeWeb/Hosting/CNetworkAddress.cs

@@ -0,0 +1,44 @@
+#region license
+// This file is part of Vocaluxe.
+//
+// Vocaluxe is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Vocaluxe is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
+#endregion
+
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.NetworkInformation;
+using System.Net.Sockets;
+
+namespace VocaluxeWeb.Hosting
+{
+    static class CNetworkAddress
+    {
+        /// IPv4 addresses of this machine in the local network, best candidate first.
+        /// Interfaces with a default gateway (the "real" network) are preferred over virtual adapters.
+        public static IList<IPAddress> GetLanAddresses()
+        {
+            return (from nic in NetworkInterface.GetAllNetworkInterfaces()
+                    where nic.OperationalStatus == OperationalStatus.Up
+                          && nic.NetworkInterfaceType != NetworkInterfaceType.Loopback
+                          && nic.NetworkInterfaceType != NetworkInterfaceType.Tunnel
+                    let props = nic.GetIPProperties()
+                    let hasGateway = props.GatewayAddresses.Any(g => g.Address.AddressFamily == AddressFamily.InterNetwork && !g.Address.Equals(IPAddress.Any))
+                    from address in props.UnicastAddresses
+                    where address.Address.AddressFamily == AddressFamily.InterNetwork
+                    orderby hasGateway descending
+                    select address.Address).ToList();
+        }
+    }
+}

VocaluxeWeb/Hosting/CStartup.cs

@@ -0,0 +1,146 @@
+#region license
+// This file is part of Vocaluxe.
+//
+// Vocaluxe is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Vocaluxe is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
+#endregion
+
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.ResponseCompression;
+using Microsoft.AspNetCore.StaticFiles;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.FileProviders;
+using Microsoft.OpenApi.Models;
+using Newtonsoft.Json.Converters;
+using VocaluxeWeb.Api;
+using VocaluxeWeb.Dispatching;
+using VocaluxeWeb.Services;
+
+namespace VocaluxeWeb.Hosting
+{
+    static class CStartup
+    {
+        private const string _IndexFile = "index.html";
+
+        public static void ConfigureServices(IServiceCollection services, CWebHost host, IVocaluxeRemote remote, CMainThreadDispatcher dispatcher, CWebSettingsStore settings,
+            CWebServerOptions options)
+        {
+            services.AddSingleton(host);
+            services.AddSingleton(remote);
+            services.AddSingleton(dispatcher);
+            services.AddSingleton(settings);
+            services.AddSingleton<CSessionStore>();
+            services.AddSingleton<CSongLibrary>();
+            services.AddSingleton<CLiveEvents>();
+            services.AddSingleton<CQueueService>();
+            services.AddSingleton(provider => new CLiveMonitor(remote, provider.GetRequiredService<CLiveEvents>(), provider.GetRequiredService<CQueueService>(),
+                provider.GetRequiredService<CSongLibrary>(), options.OnError));
+            services.AddSingleton(new CImageService(options.CachePath));
+
+            services.AddResponseCompression(compression =>
+            {
+                compression.EnableForHttps = true;
+                compression.Providers.Add<GzipCompressionProvider>();
+            });
+
+            // The entry assembly is Vocaluxe.exe, so MVC would not find our controllers on its own
+            services.AddMvcCore(mvc => mvc.Filters.Add(new CExceptionFilter(options.OnError)))
+                .AddApplicationPart(typeof(CStartup).Assembly)
+                .AddApiExplorer()
+                .AddDataAnnotations()
+                .AddJsonFormatters(json => json.Converters.Add(new StringEnumConverter()))
+                .SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
+
+            services.AddSwaggerGen(swagger =>
+            {
+                swagger.SwaggerDoc("v1", new OpenApiInfo { Title = "Vocaluxe API", Version = "v1" });
+                foreach (var folder in new[] { AppDomain.CurrentDomain.BaseDirectory, Path.GetDirectoryName(typeof(CStartup).Assembly.Location) })
+                {
+                    var xmlDoc = Path.Combine(folder, "VocaluxeWeb.xml");
+                    if (File.Exists(xmlDoc))
+                    {
+                        swagger.IncludeXmlComments(xmlDoc);
+                        break;
+                    }
+                }
+            });
+            services.AddSwaggerGenNewtonsoftSupport();
+        }
+
+        public static void Configure(IApplicationBuilder app, CWebServerOptions options)
+        {
+            app.UseResponseCompression();
+
+            app.UseSwagger();
+            app.UseSwaggerUI(ui => ui.SwaggerEndpoint("/swagger/v1/swagger.json", "Vocaluxe API v1"));
+
+            app.UseMvc();
+
+            if (!string.IsNullOrEmpty(options.WebRoot) && Directory.Exists(options.WebRoot))
+            {
+                var files = new PhysicalFileProvider(Path.GetFullPath(options.WebRoot));
+                var contentTypes = new FileExtensionContentTypeProvider();
+                contentTypes.Mappings[".webmanifest"] = "application/manifest+json";
+
+                app.UseStaticFiles(new StaticFileOptions
+                {
+                    FileProvider = files,
+                    ContentTypeProvider = contentTypes,
+                    OnPrepareResponse = ctx => _SetCacheHeaders(ctx.Context.Response, ctx.File.Name)
+                });
+
+                app.Run(context => _ServeIndex(context, files));
+            }
+            else
+            {
+                app.Run(context => _NotFound(context));
+            }
+        }
+
+        /// Vite puts a hash into every asset name, so those can be cached forever. index.html must always be revalidated.
+        private static void _SetCacheHeaders(HttpResponse response, string fileName)
+        {
+            response.Headers["Cache-Control"] = fileName == _IndexFile ? "no-cache" : "public, max-age=31536000, immutable";
+        }
+
+        /// Single page app fallback: every unknown path outside the API gets index.html, the WebApp's router handles the rest.
+        private static Task _ServeIndex(HttpContext context, IFileProvider files)
+        {
+            var index = files.GetFileInfo(_IndexFile);
+            if (!index.Exists || _IsApiPath(context.Request.Path) || context.Request.Method != HttpMethods.Get)
+            {
+                return _NotFound(context);
+            }
+
+            context.Response.ContentType = "text/html; charset=utf-8";
+            _SetCacheHeaders(context.Response, _IndexFile);
+            return context.Response.SendFileAsync(index, context.RequestAborted);
+        }
+
+        private static bool _IsApiPath(PathString path)
+        {
+            return path.StartsWithSegments("/api") || path.StartsWithSegments("/swagger");
+        }
+
+        private static Task _NotFound(HttpContext context)
+        {
+            context.Response.StatusCode = StatusCodes.Status404NotFound;
+            return Task.CompletedTask;
+        }
+    }
+}

VocaluxeWeb/Hosting/CWebHost.cs

@@ -0,0 +1,177 @@
+#region license
+// This file is part of Vocaluxe.
+//
+// Vocaluxe is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Vocaluxe is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
+#endregion
+
+using System;
+using System.Collections.Generic;
+using System.Net;
+using System.Security.Cryptography.X509Certificates;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Server.Kestrel.Core;
+using VocaluxeWeb.Dispatching;
+using VocaluxeWeb.Remote;
+using VocaluxeWeb.Services;
+
+namespace VocaluxeWeb.Hosting
+{
+    /// The embedded webserver (Kestrel). Serves the WebApp and the REST API.
+    public sealed class CWebHost : IDisposable
+    {
+        private readonly IVocaluxeRemote _Remote;
+        private readonly CWebServerOptions _Options;
+        private IWebHost _Host;
+        private CLiveMonitor _Monitor;
+        private CQueueService _Queue;
+        private bool _QueuePlaylistReady;
+
+        public CMainThreadDispatcher Dispatcher { get; }
+
+        public CWebSettingsStore Settings { get; }
+
+        /// Address other devices in the network use to reach the server, e.g. http://192.168.0.10:3000/
+        public Uri Address { get; private set; }
+
+        public bool IsRunning => _Host != null;
+
+        public bool UseHttps => _Options.UseHttps;
+
+        public int Port => _Options.Port;
+
+        public CWebHost(IVocaluxeRemote remote, CWebServerOptions options)
+        {
+            _Remote = remote;
+            _Options = options;
+            Dispatcher = new CMainThreadDispatcher(options.MainThreadTimeout);
+            Settings = new CWebSettingsStore(options.SettingsPath);
+        }
+
+        public void Start()
+        {
+            if (_Host != null)
+            {
+                return;
+            }
+
+            var hostName = Dns.GetHostName();
+            var lanAddresses = CNetworkAddress.GetLanAddresses();
+            var certificate = _Options.UseHttps ? CCertificateProvider.GetOrCreate(_Options.CertificatePath, hostName, lanAddresses) : null;
+
+            var host = new WebHostBuilder()
+                .UseKestrel(kestrel => _ConfigureKestrel(kestrel, certificate))
+                .UseContentRoot(AppDomain.CurrentDomain.BaseDirectory)
+                .ConfigureServices(services => CStartup.ConfigureServices(services, this, _Remote, Dispatcher, Settings, _Options))
+                .Configure(app => CStartup.Configure(app, _Options))
+                .Build();
+
+            try
+            {
+                host.StartAsync().GetAwaiter().GetResult();
+            }
+            catch
+            {
+                host.Dispose();
+                throw;
+            }
+
+            _Host = host;
+            _Monitor = (CLiveMonitor)host.Services.GetService(typeof(CLiveMonitor));
+            _Queue = (CQueueService)host.Services.GetService(typeof(CQueueService));
+            _QueuePlaylistReady = false;
+
+            var shownHost = lanAddresses.Count > 0 ? lanAddresses[0].ToString() : hostName;
+            Address = new UriBuilder(_Options.UseHttps ? "https" : "http", shownHost, _Options.Port).Uri;
+        }
+
+        /// Name of the playlist that is used as queue.
+        public string QueuePlaylistName => Settings.Current.QueuePlaylistName;
+
+        /// The queue with requesters and singers, for the queue screen of the game. Main thread only.
+        public IList<RemoteQueueItem> GetQueueForGame()
+        {
+            return _Queue?.GetGameSnapshot() ?? new List<RemoteQueueItem>();
+        }
+
+        /// The queue entry at this position was started in the game and leaves the queue. Main thread only.
+        public void MarkQueueEntryStarted(int index)
+        {
+            _Queue?.MarkStarted(index);
+        }
+
+        /// Runs pending requests and watches the game for live events. Must be called once per frame from the main thread.
+        public void Tick()
+        {
+            Dispatcher.ProcessPending();
+            if (_Queue == null || !_Remote.IsReady)
+            {
+                return;
+            }
+
+            try
+            {
+                //The playlists are loaded after the server started, so the queue playlist is created here
+                if (!_QueuePlaylistReady)
+                {
+                    _QueuePlaylistReady = true;
+                    _Queue.EnsurePlaylist();
+                }
+
+                _Monitor?.Tick();
+            }
+            catch (Exception e)
+            {
+                _Options.OnError?.Invoke(e);
+            }
+        }
+
+        public void Stop()
+        {
+            if (_Host == null)
+            {
+                return;
+            }
+
+            try
+            {
+                _Host.StopAsync(TimeSpan.FromSeconds(2)).GetAwaiter().GetResult();
+            }
+            finally
+            {
+                _Host.Dispose();
+                _Host = null;
+                _Monitor = null;
+                _Queue = null;
+            }
+        }
+
+        public void Dispose()
+        {
+            Stop();
+        }
+
+        private void _ConfigureKestrel(KestrelServerOptions kestrel, X509Certificate2 certificate)
+        {
+            kestrel.AddServerHeader = false;
+            kestrel.Limits.MaxRequestBodySize = 20 * 1024 * 1024; //Photos
+            kestrel.Listen(IPAddress.Any, _Options.Port, listen =>
+            {
+                if (certificate != null)
+                {
+                    listen.UseHttps(certificate);
+                }
+            });
+        }
+    }
+}

VocaluxeWeb/Hosting/CWebServerOptions.cs

@@ -0,0 +1,47 @@
+#region license
+// This file is part of Vocaluxe.
+//
+// Vocaluxe is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Vocaluxe is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
+#endregion
+
+using System;
+
+namespace VocaluxeWeb.Hosting
+{
+    public sealed class CWebServerOptions
+    {
+        public int Port = 3000;
+
+        /// Serve HTTPS with a self-signed certificate instead of plain HTTP.
+        public bool UseHttps;
+
+        /// Folder with the built WebApp (index.html, assets).
+        public string WebRoot;
+
+        /// Where the self-signed certificate is stored (only used with HTTPS).
+        public string CertificatePath;
+
+        /// JSON file with the webserver settings (permissions, join token, ...).
+        public string SettingsPath;
+
+        /// Folder for scaled covers and avatars.
+        public string CachePath;
+
+        /// How long a request waits for the game's main thread.
+        public TimeSpan MainThreadTimeout = TimeSpan.FromSeconds(5);
+
+        /// Called for unhandled exceptions while processing a request.
+        public Action<Exception> OnError;
+    }
+}