Migrate auth to Open.IdentityServer

Dockerfile

@@ -1,14 +1,14 @@
 # DorkNet.Server container image — Coolify deploy target.
 # ────────────────────────────────────────────────────────────────────
 # Multi-stage: SDK image builds + publishes, runtime image is the
-# slimmer aspnet:9.0 with only the published output.
+# slimmer aspnet:10.0 with only the published output.
 #
 # Build context: repo root (so Tools/ and DorkNet.Models/ are visible
 # to ProjectReference + dotnet restore). The .dockerignore at the
 # repo root keeps the bin/, obj/, and other dev junk out of the
 # context.
 
-ARG DOTNET_VERSION=9.0
+ARG DOTNET_VERSION=10.0
 ARG NODE_VERSION=20
 
 # ── admin SPA build stage ──────────────────────────────────────────
@@ -76,13 +76,13 @@ WORKDIR /app
 
 # curl + wget for healthcheck probes — Coolify v4 defaults to wget for
 # its own probe regardless of what the image's HEALTHCHECK uses, so
-# both have to be present. The aspnet:9.0 base image strips both by
+# both have to be present. The aspnet:10.0 base image strips both by
 # default to keep the surface area small.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl wget \
     && rm -rf /var/lib/apt/lists/*
 
-# Run as a non-root user — aspnet:9.0 ships with the `app` UID 1654.
+# Run as a non-root user — aspnet:10.0 ships with the `app` UID 1654.
 # Coolify mounts persistent volumes with write permission for this UID.
 USER app
 

DorkNet.Models/DorkNet.Models.csproj

@@ -1,7 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net9.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
   </PropertyGroup>

DorkNet.Server/Auth/IdentityServerIntegration.cs

@@ -3,10 +3,10 @@ using System.Security.Claims;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
-using Duende.IdentityServer;
+using Open.IdentityServer;
-using Duende.IdentityServer.Models;
+using Open.IdentityServer.Models;
-using Duende.IdentityServer.Services;
+using Open.IdentityServer.Services;
-using Duende.IdentityServer.Validation;
+using Open.IdentityServer.Validation;
 using Microsoft.AspNetCore.Http.Features;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Primitives;
@@ -206,12 +206,6 @@ public static class RecRoomIdentityServerRegistration
             .AddIdentityServer(options =>
             {
                 options.IssuerUri = domain.AuthIssuer.TrimEnd('/');
-                options.KeyManagement.Enabled = false;
-                var licenseKey =
-                    Environment.GetEnvironmentVariable("DUENDE_IDENTITYSERVER_LICENSE_KEY")
-                    ?? config["IdentityServer:LicenseKey"];
-                if (!string.IsNullOrWhiteSpace(licenseKey))
-                    options.LicenseKey = licenseKey;
             })
             .AddInMemoryIdentityResources(RecRoomIdentityServerConfig.IdentityResources)
             .AddInMemoryApiScopes(RecRoomIdentityServerConfig.ApiScopes)
@@ -256,7 +250,7 @@ internal static class RecRoomIdentityServerConfig
             ClientName = "Rec Room game client",
             RequireClientSecret = true,
             ClientSecrets = { new Secret(ClientSecret.Sha256()) },
-            AllowedGrantTypes = { GrantType.ResourceOwnerPassword, GrantType.RefreshToken, CachedLoginGrantType },
+            AllowedGrantTypes = { GrantType.ResourceOwnerPassword, "refresh_token", CachedLoginGrantType },
             AllowedScopes = RecRoomScopes(),
             AllowOfflineAccess = true,
             AccessTokenLifetime = 60 * 60 * 12,

DorkNet.Server/Controllers/Admin/AdminController.cs

@@ -40,7 +40,6 @@ public class AdminController(
     SignupCodeService signupCodes,
     IObjectStorage storage,
     DomainConfig domain,
-    IConfiguration config,
     IdentityServerSigningKeyProvider signingKeys,
     ILogger<AdminController> adminLogger) : ControllerBase
 {
@@ -1170,9 +1169,6 @@ public class AdminController(
         var certPath = signingKeys.CertificatePath;
         var fullCertPath = Path.GetFullPath(certPath);
         var certificateExists = signingKeys.LoadedFromBase64 || System.IO.File.Exists(fullCertPath);
-        var licenseConfigured =
-            !string.IsNullOrWhiteSpace(Environment.GetEnvironmentVariable("DUENDE_IDENTITYSERVER_LICENSE_KEY"))
-            || !string.IsNullOrWhiteSpace(config["IdentityServer:LicenseKey"]);
 
         return Ok(new
         {
@@ -1204,10 +1200,6 @@ public class AdminController(
                 NotAfterUtc = signingKeys.Certificate.NotAfter.ToUniversalTime(),
                 Algorithm = SecurityAlgorithms.RsaSha256,
             },
-            License = new
-            {
-                Configured = licenseConfigured,
-            },
             PersistedGrants = new
             {
                 Store = "in-memory",

DorkNet.Server/Controllers/Auth/AuthController.cs

@@ -6,7 +6,7 @@ using DorkNet.Server.Services;
 namespace DorkNet.Server.Controllers.Auth;
 
 /// <summary>
-/// auth.rec.net game-specific auth helpers. OAuth/OIDC endpoints are owned by Duende IdentityServer.
+/// auth.rec.net game-specific auth helpers. OAuth/OIDC endpoints are owned by IdentityServer.
 /// </summary>
 [ApiController]
 public class AuthController(

DorkNet.Server/DorkNet.Server.csproj

@@ -1,21 +1,22 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net9.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Duende.IdentityServer" Version="7.4.7" />
+    <PackageReference Include="Open.IdentityServer" Version="1.0.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.0.4" />
+    <PackageReference Include="MessagePack" Version="3.1.7" />
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.15" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.4">
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.4" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.9" />
-    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="9.0.4" />
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.2" />
     <!-- RenderedCompactJsonFormatter for stdout JSON logs in production
          (Coolify-friendly). The host pipeline reads stdout line-by-line,
          and structured JSON lets a future Loki/Datadog ingest parse fields
@@ -26,8 +27,8 @@
          scale: SignalR group fanout, OrphanAccountTracker (sticky-session
          account-creation flow), and PlayerPresenceService heartbeats all
          need shared state across replicas. -->
-    <PackageReference Include="StackExchange.Redis" Version="2.8.16" />
+    <PackageReference Include="StackExchange.Redis" Version="2.13.17" />
-    <PackageReference Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="9.0.4" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.9" />
     <!-- S3-compatible object storage. Production target: Garage in
          Coolify (one-click). Dev fallback: local MinIO for parity
          testing. The SDK speaks plain S3, so swapping endpoints
@@ -39,7 +40,7 @@
          cost+salt in the output string so we only need one column. -->
     <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
     <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="7.3.1" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.2.3" />
     <!-- Server-side crop/resize for img.* CDN transforms (?cropSquare=1&width=N
          on profile thumbnails). The 2020 client treats this as part of the
          image CDN contract — it uploads a full-frame capture and expects the

DorkNet.Server/admin-ui/src/pages/IdentityServer.tsx

@@ -29,9 +29,6 @@ interface IdentityServerSettings {
     notAfterUtc: string;
     algorithm: string;
   };
-  license: {
-    configured: boolean;
-  };
   persistedGrants: {
     store: string;
     warning: string;
@@ -86,7 +83,6 @@ export function IdentityServer() {
                 </div>
                 <div className="flex flex-wrap gap-2 text-xs">
                   <StatusBadge ok={settings.signing.certificateExists} on="Signing key" off="Missing key" />
-                  <StatusBadge ok={settings.license.configured} on="License set" off="No license key" />
                 </div>
               </div>
 

README.md

@@ -82,7 +82,7 @@ discovery and JWT validation agree on `https://auth.<domain>`.
 dotnet run --project DorkNet.Server
 ```
 
-First boot creates `bin/Debug/net9.0/data/dorknet.db`, applies all EF
+First boot creates `bin/Debug/net10.0/data/dorknet.db`, applies all EF
 migrations under `DorkNet.Server/Migrations/`, seeds canonical rooms +
 store catalog, and starts listening. You should see `Application
 started.` in the log; `curl http://localhost:8080/healthz` returns 200.

tools/DorkNet.ApiRouteCoverage/DorkNet.ApiRouteCoverage.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net9.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>