Add MedMind recovery and Steam authentication

2026-07-16 00:24:07 -05:00
parent 0ca7a31daa
commit bf6f86b73c
14 changed files with 556 additions and 8 deletions
@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Configuration;
 using Microsoft.IdentityModel.Tokens;
+using Microsoft.AspNetCore.RateLimiting;
 using System;
 using System.IdentityModel.Tokens.Jwt;
 using System.Linq;
@@ -20,20 +21,32 @@ public class AuthController : ControllerBase
    private readonly UserService _userService;
    private readonly IConfiguration _config;
    private readonly BlacklistService _blacklistService;
+    private readonly PasswordResetService _passwordResetService;
+    private readonly EmailService _emailService;
+    private readonly SteamAuthService _steamAuthService;

-    public AuthController(UserService userService, IConfiguration config, BlacklistService blacklistService)
+    public AuthController(UserService userService, IConfiguration config, BlacklistService blacklistService,
+        PasswordResetService passwordResetService = null, EmailService emailService = null,
+        SteamAuthService steamAuthService = null)
    {
        _userService = userService;
        _config = config;
        _blacklistService = blacklistService;
+        _passwordResetService = passwordResetService;
+        _emailService = emailService;
+        _steamAuthService = steamAuthService;
    }

    [HttpPost("register")]
    public async Task<IActionResult> Register([FromBody] RegisterRequest credentials)
    {
-        if (await _userService.GetByUsernameAsync(credentials.Username) != null)
+        if (await _userService.GetByLoginAsync(credentials.Username) != null ||
+            (!string.IsNullOrWhiteSpace(credentials.Email) && await _userService.GetByLoginAsync(credentials.Email) != null))
            return BadRequest("User already exists");

+        if (!IsValidUsername(credentials.Username) || !IsValidEmail(credentials.Email) || !IsValidPassword(credentials.Password))
+            return BadRequest("Username, email, or password is invalid");
+
        var hash = BCrypt.Net.BCrypt.HashPassword(credentials.Password);

        var user = new User
@@ -51,7 +64,7 @@ public class AuthController : ControllerBase
    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] LoginRequest credentials)
    {
-        var user = await _userService.GetByUsernameAsync(credentials.Username);
+        var user = await _userService.GetByLoginAsync(credentials.Username);
        if (user == null || !BCrypt.Net.BCrypt.Verify(credentials.Password, user.PasswordHash))
            return Unauthorized();

@@ -66,6 +79,105 @@ public class AuthController : ControllerBase
        return Ok(new { accessToken, refreshToken, user.Username, user.Role });
    }

+    [HttpPost("password-reset/request")]
+    [EnableRateLimiting("password-reset")]
+    public async Task<IActionResult> RequestPasswordReset([FromBody] PasswordResetRequest request)
+    {
+        if (_passwordResetService == null || _emailService == null)
+            return StatusCode(503, "Password recovery is not configured");
+        var user = await _userService.GetByLoginAsync(request.Login ?? string.Empty);
+        if (user != null && !string.IsNullOrWhiteSpace(user.Email))
+        {
+            var code = await _passwordResetService.CreateAsync(user.Id);
+            await _emailService.SendPasswordResetCodeAsync(user.Email, code);
+        }
+        return Accepted(new { message = "If the account exists, a verification code has been sent." });
+    }
+
+    [HttpPost("password-reset/confirm")]
+    [EnableRateLimiting("password-reset")]
+    public async Task<IActionResult> ConfirmPasswordReset([FromBody] PasswordResetConfirmRequest request)
+    {
+        if (_passwordResetService == null) return StatusCode(503, "Password recovery is not configured");
+        if (!IsValidPassword(request.NewPassword)) return BadRequest("Password must be at least 8 characters");
+        var user = await _userService.GetByLoginAsync(request.Login ?? string.Empty);
+        if (user == null || !await _passwordResetService.ConsumeAsync(user.Id, request.Code ?? string.Empty))
+            return BadRequest("The verification code is invalid or expired");
+        user.PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.NewPassword);
+        user.RefreshToken = null;
+        user.RefreshTokenExpiry = DateTime.MinValue;
+        await _userService.UpdateAsync(user);
+        return Ok(new { message = "Password updated" });
+    }
+
+    [HttpPost("steam/start")]
+    public async Task<IActionResult> StartSteamLogin()
+    {
+        if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
+        var started = await _steamAuthService.StartAsync();
+        return Ok(new { transactionId = started.Transaction.Id, authUrl = started.AuthUrl, expiresUtc = started.Transaction.ExpiresUtc });
+    }
+
+    [HttpGet("steam/callback")]
+    public async Task<IActionResult> SteamCallback([FromQuery] string transactionId)
+    {
+        if (_steamAuthService == null || !await _steamAuthService.VerifyCallbackAsync(transactionId, Request.Query))
+            return StatusCode(400, "Steam sign-in could not be verified. You may close this window.");
+        return Content("Steam sign-in verified. Return to MedMind to finish signing in.", "text/plain", Encoding.UTF8);
+    }
+
+    [HttpGet("steam/status/{transactionId}")]
+    public async Task<IActionResult> SteamStatus(string transactionId)
+    {
+        if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
+        var transaction = await _steamAuthService.GetAsync(transactionId);
+        if (transaction == null) return NotFound(new { status = "expired" });
+        if (transaction.Status == "authenticated" && !string.IsNullOrWhiteSpace(transaction.UserId))
+        {
+            var user = await _userService.GetByIdAsync(transaction.UserId);
+            if (user == null) return BadRequest("Linked account no longer exists");
+            var tokens = await IssueTokensAsync(user);
+            await _steamAuthService.CompleteAsync(transactionId, user, tokens.AccessToken, tokens.RefreshToken);
+            transaction = await _steamAuthService.GetAsync(transactionId);
+        }
+        return Ok(new
+        {
+            transaction.Status, transaction.Username, transaction.Role,
+            transaction.AccessToken, transaction.RefreshToken
+        });
+    }
+
+    [HttpPost("steam/complete")]
+    public async Task<IActionResult> CompleteSteamLogin([FromBody] SteamCompleteRequest request)
+    {
+        if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
+        User user;
+        if (string.Equals(request.Action, "link", StringComparison.OrdinalIgnoreCase))
+        {
+            user = await _userService.GetByLoginAsync(request.Username ?? string.Empty);
+            if (user == null || !BCrypt.Net.BCrypt.Verify(request.Password ?? string.Empty, user.PasswordHash))
+                return Unauthorized();
+        }
+        else if (string.Equals(request.Action, "create", StringComparison.OrdinalIgnoreCase))
+        {
+            if (!IsValidUsername(request.Username) || !IsValidEmail(request.Email) || !IsValidPassword(request.Password))
+                return BadRequest("Username, email, or password is invalid");
+            if (await _userService.GetByLoginAsync(request.Username) != null || await _userService.GetByLoginAsync(request.Email) != null)
+                return Conflict("Username or email is already in use");
+            user = new User
+            {
+                Username = request.Username.Trim(), Email = request.Email.Trim(),
+                PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.Password), Role = "USER"
+            };
+            await _userService.CreateAsync(user);
+        }
+        else return BadRequest("Action must be create or link");
+
+        try { await _steamAuthService.LinkAsync(request.TransactionId, user.Id); }
+        catch (MongoDB.Driver.MongoWriteException) { return Conflict("This Steam account is already linked"); }
+        return Ok(new { status = "linked" });
+    }
+
    [HttpPost("refresh")]
    public async Task<IActionResult> Refresh([FromBody] RefreshRequest req)
    {
@@ -140,9 +252,25 @@ public class AuthController : ControllerBase
        return new JwtSecurityTokenHandler().WriteToken(token);
    }

+    private async Task<(string AccessToken, string RefreshToken)> IssueTokensAsync(User user)
+    {
+        var accessToken = GenerateJwtToken(user);
+        var refreshToken = Guid.NewGuid().ToString();
+        user.RefreshToken = refreshToken;
+        user.RefreshTokenExpiry = DateTime.UtcNow.AddDays(7);
+        await _userService.UpdateAsync(user);
+        return (accessToken, refreshToken);
+    }
+
+    private static bool IsValidUsername(string value) =>
+        !string.IsNullOrWhiteSpace(value) && value.Length is >= 3 and <= 24 && value.All(c => char.IsLetterOrDigit(c) || c == '_');
+    private static bool IsValidEmail(string value) =>
+        !string.IsNullOrWhiteSpace(value) && value.Contains('@') && value.Length <= 254;
+    private static bool IsValidPassword(string value) => !string.IsNullOrEmpty(value) && value.Length >= 8;
+
    public class RefreshRequest
    {
        public string Username { get; set; }
        public string RefreshToken { get; set; }
    }
-}
+}