277 lines
12 KiB
C#
277 lines
12 KiB
C#
using GameAuthApi.Models;
|
|
using GameAuthApi.Services;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.Extensions.Configuration;
|
|
using Microsoft.IdentityModel.Tokens;
|
|
using Microsoft.AspNetCore.RateLimiting;
|
|
using System;
|
|
using System.IdentityModel.Tokens.Jwt;
|
|
using System.Linq;
|
|
using System.Security.Claims;
|
|
using System.Text;
|
|
using System.Threading.Tasks;
|
|
|
|
namespace GameAuthApi.Controllers;
|
|
|
|
[ApiController]
|
|
[Route("api/[controller]")]
|
|
public class AuthController : ControllerBase
|
|
{
|
|
private readonly UserService _userService;
|
|
private readonly IConfiguration _config;
|
|
private readonly BlacklistService _blacklistService;
|
|
private readonly PasswordResetService _passwordResetService;
|
|
private readonly EmailService _emailService;
|
|
private readonly SteamAuthService _steamAuthService;
|
|
|
|
public AuthController(UserService userService, IConfiguration config, BlacklistService blacklistService,
|
|
PasswordResetService passwordResetService = null, EmailService emailService = null,
|
|
SteamAuthService steamAuthService = null)
|
|
{
|
|
_userService = userService;
|
|
_config = config;
|
|
_blacklistService = blacklistService;
|
|
_passwordResetService = passwordResetService;
|
|
_emailService = emailService;
|
|
_steamAuthService = steamAuthService;
|
|
}
|
|
|
|
[HttpPost("register")]
|
|
public async Task<IActionResult> Register([FromBody] RegisterRequest credentials)
|
|
{
|
|
if (await _userService.GetByLoginAsync(credentials.Username) != null ||
|
|
(!string.IsNullOrWhiteSpace(credentials.Email) && await _userService.GetByLoginAsync(credentials.Email) != null))
|
|
return BadRequest("User already exists");
|
|
|
|
if (!IsValidUsername(credentials.Username) || !IsValidEmail(credentials.Email) || !IsValidPassword(credentials.Password))
|
|
return BadRequest("Username, email, or password is invalid");
|
|
|
|
var hash = BCrypt.Net.BCrypt.HashPassword(credentials.Password);
|
|
|
|
var user = new User
|
|
{
|
|
Username = credentials.Username,
|
|
PasswordHash = hash,
|
|
Role = "USER",
|
|
Email = credentials.Email
|
|
};
|
|
|
|
await _userService.CreateAsync(user);
|
|
return Ok("User created");
|
|
}
|
|
|
|
[HttpPost("login")]
|
|
public async Task<IActionResult> Login([FromBody] LoginRequest credentials)
|
|
{
|
|
var user = await _userService.GetByLoginAsync(credentials.Username);
|
|
if (user == null || !BCrypt.Net.BCrypt.Verify(credentials.Password, user.PasswordHash))
|
|
return Unauthorized();
|
|
|
|
var accessToken = GenerateJwtToken(user);
|
|
var refreshToken = Guid.NewGuid().ToString();
|
|
var refreshExpiry = DateTime.UtcNow.AddDays(7);
|
|
|
|
user.RefreshToken = refreshToken;
|
|
user.RefreshTokenExpiry = refreshExpiry;
|
|
await _userService.UpdateAsync(user);
|
|
|
|
return Ok(new { accessToken, refreshToken, user.Username, user.Role });
|
|
}
|
|
|
|
[HttpPost("password-reset/request")]
|
|
[EnableRateLimiting("password-reset")]
|
|
public async Task<IActionResult> RequestPasswordReset([FromBody] PasswordResetRequest request)
|
|
{
|
|
if (_passwordResetService == null || _emailService == null)
|
|
return StatusCode(503, "Password recovery is not configured");
|
|
var user = await _userService.GetByLoginAsync(request.Login ?? string.Empty);
|
|
if (user != null && !string.IsNullOrWhiteSpace(user.Email))
|
|
{
|
|
var code = await _passwordResetService.CreateAsync(user.Id);
|
|
await _emailService.SendPasswordResetCodeAsync(user.Email, code);
|
|
}
|
|
return Accepted(new { message = "If the account exists, a verification code has been sent." });
|
|
}
|
|
|
|
[HttpPost("password-reset/confirm")]
|
|
[EnableRateLimiting("password-reset")]
|
|
public async Task<IActionResult> ConfirmPasswordReset([FromBody] PasswordResetConfirmRequest request)
|
|
{
|
|
if (_passwordResetService == null) return StatusCode(503, "Password recovery is not configured");
|
|
if (!IsValidPassword(request.NewPassword)) return BadRequest("Password must be at least 8 characters");
|
|
var user = await _userService.GetByLoginAsync(request.Login ?? string.Empty);
|
|
if (user == null || !await _passwordResetService.ConsumeAsync(user.Id, request.Code ?? string.Empty))
|
|
return BadRequest("The verification code is invalid or expired");
|
|
user.PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.NewPassword);
|
|
user.RefreshToken = null;
|
|
user.RefreshTokenExpiry = DateTime.MinValue;
|
|
await _userService.UpdateAsync(user);
|
|
return Ok(new { message = "Password updated" });
|
|
}
|
|
|
|
[HttpPost("steam/start")]
|
|
public async Task<IActionResult> StartSteamLogin()
|
|
{
|
|
if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
|
|
var started = await _steamAuthService.StartAsync();
|
|
return Ok(new { transactionId = started.Transaction.Id, authUrl = started.AuthUrl, expiresUtc = started.Transaction.ExpiresUtc });
|
|
}
|
|
|
|
[HttpGet("steam/callback")]
|
|
public async Task<IActionResult> SteamCallback([FromQuery] string transactionId)
|
|
{
|
|
if (_steamAuthService == null || !await _steamAuthService.VerifyCallbackAsync(transactionId, Request.Query))
|
|
return StatusCode(400, "Steam sign-in could not be verified. You may close this window.");
|
|
return Content("Steam sign-in verified. Return to MedMind to finish signing in.", "text/plain", Encoding.UTF8);
|
|
}
|
|
|
|
[HttpGet("steam/status/{transactionId}")]
|
|
public async Task<IActionResult> SteamStatus(string transactionId)
|
|
{
|
|
if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
|
|
var transaction = await _steamAuthService.GetAsync(transactionId);
|
|
if (transaction == null) return NotFound(new { status = "expired" });
|
|
if (transaction.Status == "authenticated" && !string.IsNullOrWhiteSpace(transaction.UserId))
|
|
{
|
|
var user = await _userService.GetByIdAsync(transaction.UserId);
|
|
if (user == null) return BadRequest("Linked account no longer exists");
|
|
var tokens = await IssueTokensAsync(user);
|
|
await _steamAuthService.CompleteAsync(transactionId, user, tokens.AccessToken, tokens.RefreshToken);
|
|
transaction = await _steamAuthService.GetAsync(transactionId);
|
|
}
|
|
return Ok(new
|
|
{
|
|
transaction.Status, transaction.Username, transaction.Role,
|
|
transaction.AccessToken, transaction.RefreshToken
|
|
});
|
|
}
|
|
|
|
[HttpPost("steam/complete")]
|
|
public async Task<IActionResult> CompleteSteamLogin([FromBody] SteamCompleteRequest request)
|
|
{
|
|
if (_steamAuthService == null) return StatusCode(503, "Steam authentication is not configured");
|
|
User user;
|
|
if (string.Equals(request.Action, "link", StringComparison.OrdinalIgnoreCase))
|
|
{
|
|
user = await _userService.GetByLoginAsync(request.Username ?? string.Empty);
|
|
if (user == null || !BCrypt.Net.BCrypt.Verify(request.Password ?? string.Empty, user.PasswordHash))
|
|
return Unauthorized();
|
|
}
|
|
else if (string.Equals(request.Action, "create", StringComparison.OrdinalIgnoreCase))
|
|
{
|
|
if (!IsValidUsername(request.Username) || !IsValidEmail(request.Email) || !IsValidPassword(request.Password))
|
|
return BadRequest("Username, email, or password is invalid");
|
|
if (await _userService.GetByLoginAsync(request.Username) != null || await _userService.GetByLoginAsync(request.Email) != null)
|
|
return Conflict("Username or email is already in use");
|
|
user = new User
|
|
{
|
|
Username = request.Username.Trim(), Email = request.Email.Trim(),
|
|
PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.Password), Role = "USER"
|
|
};
|
|
await _userService.CreateAsync(user);
|
|
}
|
|
else return BadRequest("Action must be create or link");
|
|
|
|
try { await _steamAuthService.LinkAsync(request.TransactionId, user.Id); }
|
|
catch (MongoDB.Driver.MongoWriteException) { return Conflict("This Steam account is already linked"); }
|
|
return Ok(new { status = "linked" });
|
|
}
|
|
|
|
[HttpPost("refresh")]
|
|
public async Task<IActionResult> Refresh([FromBody] RefreshRequest req)
|
|
{
|
|
var user = await _userService.GetByUsernameAsync(req.Username);
|
|
if (user == null || user.RefreshToken != req.RefreshToken || user.RefreshTokenExpiry < DateTime.UtcNow)
|
|
return Unauthorized("Invalid or expired refresh token");
|
|
|
|
var newAccessToken = GenerateJwtToken(user);
|
|
return Ok(new { accessToken = newAccessToken });
|
|
}
|
|
|
|
[HttpPost("logout")]
|
|
[Authorize(Roles = "USER,SUPER")]
|
|
public async Task<IActionResult> Logout()
|
|
{
|
|
var token = HttpContext.Request.Headers["Authorization"].FirstOrDefault()?.Replace("Bearer ", "");
|
|
if (string.IsNullOrWhiteSpace(token))
|
|
return BadRequest("Token missing");
|
|
|
|
var jwtToken = new JwtSecurityTokenHandler().ReadToken(token) as JwtSecurityToken;
|
|
var expiry = jwtToken.ValidTo;
|
|
|
|
await _blacklistService.AddToBlacklistAsync(token, expiry);
|
|
return Ok("Token blacklisted, user logged out.");
|
|
}
|
|
|
|
[HttpPost("role")]
|
|
[Authorize(Roles = "SUPER")]
|
|
public async Task<IActionResult> ChangeUserRole([FromBody] ChangeRoleRequest request)
|
|
{
|
|
if (request.NewRole != "USER" && request.NewRole != "SUPER")
|
|
return BadRequest("Role must be 'USER' or 'SUPER'");
|
|
|
|
var user = await _userService.GetByUsernameAsync(request.Username);
|
|
if (user == null)
|
|
return NotFound("User not found");
|
|
|
|
user.Role = request.NewRole;
|
|
await _userService.UpdateAsync(user);
|
|
|
|
return Ok($"{request.Username}'s role updated to {request.NewRole}");
|
|
}
|
|
|
|
[HttpGet("users")]
|
|
[Authorize(Roles = "SUPER")]
|
|
public async Task<IActionResult> GetAllUsers()
|
|
{
|
|
var users = await _userService.GetAllAsync();
|
|
return Ok(users);
|
|
}
|
|
|
|
|
|
private string GenerateJwtToken(User user)
|
|
{
|
|
var key = Encoding.UTF8.GetBytes(_config["Jwt:Key"]);
|
|
var creds = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256);
|
|
|
|
var claims = new[]
|
|
{
|
|
new Claim(ClaimTypes.Name, user.Username),
|
|
new Claim(ClaimTypes.NameIdentifier, user.Id),
|
|
new Claim(ClaimTypes.Role, user.Role)
|
|
};
|
|
|
|
var token = new JwtSecurityToken(
|
|
_config["Jwt:Issuer"],
|
|
_config["Jwt:Issuer"],
|
|
claims,
|
|
expires: DateTime.UtcNow.AddMinutes(15),
|
|
signingCredentials: creds);
|
|
|
|
return new JwtSecurityTokenHandler().WriteToken(token);
|
|
}
|
|
|
|
private async Task<(string AccessToken, string RefreshToken)> IssueTokensAsync(User user)
|
|
{
|
|
var accessToken = GenerateJwtToken(user);
|
|
var refreshToken = Guid.NewGuid().ToString();
|
|
user.RefreshToken = refreshToken;
|
|
user.RefreshTokenExpiry = DateTime.UtcNow.AddDays(7);
|
|
await _userService.UpdateAsync(user);
|
|
return (accessToken, refreshToken);
|
|
}
|
|
|
|
private static bool IsValidUsername(string value) =>
|
|
!string.IsNullOrWhiteSpace(value) && value.Length is >= 3 and <= 24 && value.All(c => char.IsLetterOrDigit(c) || c == '_');
|
|
private static bool IsValidEmail(string value) =>
|
|
!string.IsNullOrWhiteSpace(value) && value.Contains('@') && value.Length <= 254;
|
|
private static bool IsValidPassword(string value) => !string.IsNullOrEmpty(value) && value.Length >= 8;
|
|
|
|
public class RefreshRequest
|
|
{
|
|
public string Username { get; set; }
|
|
public string RefreshToken { get; set; }
|
|
}
|
|
}
|