SF-3730 Require authentication for SignalR notifications

[pmachapman]

This PR updates the SignalR notification hub to check that the user has access to the project they wish to subscribe to or send notifications to.

These permission checks are only performed on client calls to SignalR - all server calls to SignalR are performed via the functions in NotificationHubExtensions, which do not perform permission checks, as they are called primarily form background jobs.

---

---

This change is 

[codecov]

Codecov Report

❌ Patch coverage is 0% with 32 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.26%. Comparing base (5eccf75) to head (f1b2f2c).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...L.XForge.Scripture/Services/NotificationHubBase.cs	0.00%	18 Missing ⚠️
...c/SIL.XForge.Scripture/Services/NotificationHub.cs	0.00%	10 Missing ⚠️
....XForge.Scripture/Services/DraftNotificationHub.cs	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3735      +/-   ##
==========================================
- Coverage   81.33%   81.26%   -0.07%     
==========================================
  Files         620      621       +1     
  Lines       39037    39067      +30     
  Branches     6364     6368       +4     
==========================================
  Hits        31749    31749              
- Misses       6304     6334      +30     
  Partials      984      984              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[marksvc]

@marksvc reviewed 3 files and all commit messages, and made 1 comment.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on pmachapman).

---

src/SIL.XForge.Scripture/Services/NotificationHub.cs line 7 at r3 (raw file):

namespace SIL.XForge.Scripture.Services;

public class NotificationHub(IRealtimeService realtimeService)

Is it true that if Alice and Bob subscribe to receive notifications on project X, that from her frontend, Alice can cause Bob to receive build progress notifications regarding project X?

That's not the end of the world. But I don't think that's what we are going for.

From what I'm gathering, it sounds like the NotificationHub.cs NotifyFoo() methods are never called by either the current frontend or current backend. They are just there to satisfy the SignalR structure. And if remove INotifier from NotificationHub, we might (?) still satisfy the SignalR structure, but frontend clients will not be able to call the NotifyFoo methods. Furthermore, we could probably delete the bodies of the NotifyFoo methods here and they could be implemented as no-op methods.

If this is so, I don't like that the current NotifyFoo methods (1) look like they do something, but aren't supposed to be used to do anything, and (2) are providing an unnecessary surface to defend.

This is new to me. Can you tell me if I'm way off base? Maybe you considered what I described but favoured the proposed way to set up the code?

[pmachapman]

@pmachapman made 1 comment.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on marksvc).

---

src/SIL.XForge.Scripture/Services/NotificationHub.cs line 7 at r3 (raw file):

Is it true that if Alice and Bob subscribe to receive notifications on project X, that from her frontend, Alice can cause Bob to receive build progress notifications regarding project X?

Yes, that is by design, as the starting of a build should display to other users on the project. It is the same for applying a draft.

From what I'm gathering, it sounds like the NotificationHub.cs NotifyFoo() methods are never called by either the current frontend or current backend.

These are called by the frontend via SignalR (see a basic example of the structure at: https://learn.microsoft.com/en-us/aspnet/core/tutorials/signalr?view=aspnetcore-10.0&tabs=visual-studio#create-a-signalr-hub). The backend calls the extension methods (which I have named the same).