Getting basics working

2025-08-22 23:00:38 -05:00
parent 058d514d29
commit 676d56288e
8 changed files with 280 additions and 43 deletions
@@ -0,0 +1,113 @@
+using Auth.Models;
+using Auth.Services;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.IdentityModel.Tokens;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+
+namespace Auth.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class AuthController : ControllerBase
+{
+    private readonly UserService _users;
+    private readonly IConfiguration _cfg;
+    private readonly BlacklistService _blacklist;
+
+    public AuthController(UserService users, IConfiguration cfg, BlacklistService blacklist)
+    {
+        _users = users; _cfg = cfg; _blacklist = blacklist;
+    }
+
+    [HttpPost("register")]
+    public async Task<IActionResult> Register([FromBody] RegisterRequest req)
+    {
+        if (string.IsNullOrWhiteSpace(req.Username) || string.IsNullOrWhiteSpace(req.Password))
+            return BadRequest("Username and password required");
+
+        if (await _users.GetByUsernameAsync(req.Username) != null)
+            return BadRequest("User already exists");
+
+        var hash = BCrypt.Net.BCrypt.HashPassword(req.Password);
+        var user = new User { Username = req.Username, PasswordHash = hash, Role = "USER", Email = req.Email };
+        await _users.CreateAsync(user);
+        return Ok("User created");
+    }
+
+    [HttpPost("login")]
+    public async Task<IActionResult> Login([FromBody] LoginRequest req)
+    {
+        var user = await _users.GetByUsernameAsync(req.Username);
+        if (user == null || !BCrypt.Net.BCrypt.Verify(req.Password, user.PasswordHash))
+            return Unauthorized();
+
+        var (accessToken, jti, expUtc) = GenerateJwtToken(user);
+        user.RefreshToken = Guid.NewGuid().ToString("N");
+        user.RefreshTokenExpiry = DateTime.UtcNow.AddDays(7);
+        await _users.UpdateAsync(user);
+
+        return Ok(new { accessToken, refreshToken = user.RefreshToken, user.Username, user.Role, jti, exp = expUtc });
+    }
+
+    [HttpPost("refresh")]
+    public async Task<IActionResult> Refresh([FromBody] RefreshRequest req)
+    {
+        var user = await _users.GetByUsernameAsync(req.Username);
+        if (user == null || user.RefreshToken != req.RefreshToken || user.RefreshTokenExpiry < DateTime.UtcNow)
+            return Unauthorized("Invalid or expired refresh token");
+
+        var (accessToken, _, expUtc) = GenerateJwtToken(user);
+        return Ok(new { accessToken, exp = expUtc });
+    }
+
+    [HttpPost("logout")]
+    [Authorize(Roles = "USER,SUPER")]
+    public async Task<IActionResult> Logout()
+    {
+        var token = HttpContext.Request.Headers["Authorization"].FirstOrDefault()?.Replace("Bearer ", "");
+        if (string.IsNullOrWhiteSpace(token)) return BadRequest("Token missing");
+        var jwt = new JwtSecurityTokenHandler().ReadJwtToken(token);
+        await _blacklist.AddToBlacklistAsync(jwt.Id, jwt.ValidTo);
+        return Ok("Logged out.");
+    }
+
+    [HttpPost("role")]
+    [Authorize(Roles = "SUPER")]
+    public async Task<IActionResult> ChangeUserRole([FromBody] ChangeRoleRequest req)
+    {
+        if (req.NewRole is not ("USER" or "SUPER")) return BadRequest("Role must be 'USER' or 'SUPER'");
+        var user = await _users.GetByUsernameAsync(req.Username);
+        if (user is null) return NotFound("User not found");
+        user.Role = req.NewRole;
+        await _users.UpdateAsync(user);
+        return Ok($"{req.Username}'s role updated to {req.NewRole}");
+    }
+
+    [HttpGet("users")]
+    [Authorize(Roles = "SUPER")]
+    public async Task<IActionResult> GetAllUsers() => Ok(await _users.GetAllAsync());
+
+    private (string token, string jti, DateTime expUtc) GenerateJwtToken(User user)
+    {
+        var key = Encoding.UTF8.GetBytes(_cfg["Jwt:Key"]!);
+        var issuer = _cfg["Jwt:Issuer"] ?? "GameAuthApi";
+        var audience = _cfg["Jwt:Audience"] ?? issuer;
+
+        var creds = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256);
+        var jti = Guid.NewGuid().ToString("N");
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim(ClaimTypes.NameIdentifier, user.Id),
+            new Claim(ClaimTypes.Role, user.Role),
+            new Claim(JwtRegisteredClaimNames.Jti, jti)
+        };
+
+        var exp = DateTime.UtcNow.AddMinutes(15);
+        var token = new JwtSecurityToken(issuer, audience, claims, expires: exp, signingCredentials: creds);
+        return (new JwtSecurityTokenHandler().WriteToken(token), jti, exp);
+    }
+}
@@ -0,0 +1,6 @@
+namespace Auth.Models;
+
+public class RegisterRequest { public string Username { get; set; } = ""; public string Password { get; set; } = ""; public string? Email { get; set; } }
+public class LoginRequest    { public string Username { get; set; } = ""; public string Password { get; set; } = ""; }
+public class ChangeRoleRequest { public string Username { get; set; } = ""; public string NewRole { get; set; } = ""; }
+public class RefreshRequest  { public string Username { get; set; } = ""; public string RefreshToken { get; set; } = ""; }
@@ -0,0 +1,16 @@
+using MongoDB.Bson;
+using MongoDB.Bson.Serialization.Attributes;
+
+namespace Auth.Models;
+
+public class User
+{
+    [BsonId] [BsonRepresentation(BsonType.ObjectId)]
+    public string Id { get; set; } = default!;
+    public string Username { get; set; } = default!;
+    public string PasswordHash { get; set; } = default!;
+    public string Role { get; set; } = "USER";
+    public string? Email { get; set; }
+    public string? RefreshToken { get; set; }
+    public DateTime? RefreshTokenExpiry { get; set; }
+}
@@ -1,41 +1,53 @@
-var builder = WebApplication.CreateBuilder(args);
+using Auth.Services;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using System.Security.Claims;
+using System.Text;

-// Add services to the container.
-// Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
-builder.Services.AddOpenApi();
+var builder = WebApplication.CreateBuilder(args);
+builder.Services.AddControllers();
+
+// DI
+builder.Services.AddSingleton<UserService>();
+builder.Services.AddSingleton<BlacklistService>();
+
+// AuthN/JWT
+var cfg    = builder.Configuration;
+var jwtKey = cfg["Jwt:Key"]    ?? throw new Exception("Jwt:Key missing");
+var issuer = cfg["Jwt:Issuer"] ?? "GameAuthApi";
+var aud    = cfg["Jwt:Audience"] ?? issuer;
+
+builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(o =>
+    {
+        o.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,   ValidIssuer = issuer,
+            ValidateAudience = true, ValidAudience = aud,
+            ValidateIssuerSigningKey = true,
+            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey)),
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromSeconds(30)
+        };
+        o.Events = new JwtBearerEvents
+        {
+            OnTokenValidated = async ctx =>
+            {
+                var jti = ctx.Principal?.FindFirstValue(System.IdentityModel.Tokens.Jwt.JwtRegisteredClaimNames.Jti);
+                if (!string.IsNullOrEmpty(jti))
+                {
+                    var bl = ctx.HttpContext.RequestServices.GetRequiredService<BlacklistService>();
+                    if (await bl.IsBlacklistedAsync(jti)) ctx.Fail("Token revoked");
+                }
+            }
+        };
+    });
+
+builder.Services.AddAuthorization();

 var app = builder.Build();
-
-// Configure the HTTP request pipeline.
-if (app.Environment.IsDevelopment())
-{
-    app.MapOpenApi();
-}
-
-app.UseHttpsRedirection();
-
-var summaries = new[]
-{
-    "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
-};
-
-app.MapGet("/weatherforecast", () =>
-{
-    var forecast =  Enumerable.Range(1, 5).Select(index =>
-        new WeatherForecast
-        (
-            DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
-            Random.Shared.Next(-20, 55),
-            summaries[Random.Shared.Next(summaries.Length)]
-        ))
-        .ToArray();
-    return forecast;
-})
-.WithName("GetWeatherForecast");
-
+app.MapGet("/healthz", () => Results.Ok("ok"));
+app.UseAuthentication();
+app.UseAuthorization();
+app.MapControllers();
 app.Run();
-
-record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
-{
-    public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
-}
@@ -0,0 +1,36 @@
+using MongoDB.Bson.Serialization.Attributes;
+using MongoDB.Driver;
+
+namespace Auth.Services;
+
+public class BlacklistedToken
+{
+    [BsonId] public string Jti { get; set; } = default!;
+    public DateTime ExpiresAt { get; set; }
+}
+
+public class BlacklistService
+{
+    private readonly IMongoCollection<BlacklistedToken> _col;
+
+    public BlacklistService(IConfiguration cfg)
+    {
+        var cs = cfg["MongoDB:ConnectionString"] ?? "mongodb://127.0.0.1:27017";
+        var dbName = cfg["MongoDB:DatabaseName"] ?? "GameDb";
+        var client = new MongoClient(cs);
+        var db = client.GetDatabase(dbName);
+        _col = db.GetCollection<BlacklistedToken>("token_blacklist");
+
+        // TTL index so revocations expire automatically
+        var keys = Builders<BlacklistedToken>.IndexKeys.Ascending(x => x.ExpiresAt);
+        _col.Indexes.CreateOne(new CreateIndexModel<BlacklistedToken>(keys, new CreateIndexOptions { ExpireAfter = TimeSpan.Zero }));
+    }
+
+    public Task AddToBlacklistAsync(string jti, DateTime expiresAt) =>
+        _col.ReplaceOneAsync(x => x.Jti == jti,
+            new BlacklistedToken { Jti = jti, ExpiresAt = expiresAt },
+            new ReplaceOptions { IsUpsert = true });
+
+    public Task<bool> IsBlacklistedAsync(string jti) =>
+        _col.Find(x => x.Jti == jti).AnyAsync();
+}
@@ -0,0 +1,32 @@
+using Auth.Models;
+using MongoDB.Driver;
+
+namespace Auth.Services;
+
+public class UserService
+{
+    private readonly IMongoCollection<User> _col;
+
+    public UserService(IConfiguration cfg)
+    {
+        var cs = cfg["MongoDB:ConnectionString"] ?? "mongodb://127.0.0.1:27017";
+        var dbName = cfg["MongoDB:DatabaseName"] ?? "GameDb";
+        var client = new MongoClient(cs);
+        var db = client.GetDatabase(dbName);
+        _col = db.GetCollection<User>("users");
+
+        var keys = Builders<User>.IndexKeys.Ascending(u => u.Username);
+        _col.Indexes.CreateOne(new CreateIndexModel<User>(keys, new CreateIndexOptions { Unique = true }));
+    }
+
+    public Task<User?> GetByUsernameAsync(string username) =>
+        _col.Find(u => u.Username == username).FirstOrDefaultAsync();
+
+    public Task CreateAsync(User user) => _col.InsertOneAsync(user);
+
+    public Task UpdateAsync(User user) =>
+        _col.ReplaceOneAsync(u => u.Id == user.Id, user);
+
+    public Task<List<User>> GetAllAsync() =>
+        _col.Find(FilterDefinition<User>.Empty).ToListAsync();
+}
@@ -1,9 +1,7 @@
 {
-  "Logging": {
-    "LogLevel": {
-      "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
-    }
-  },
+  "Kestrel": { "Endpoints": { "Http": { "Url": "http://0.0.0.0:5000" } } },
+  "MongoDB": { "ConnectionString": "mongodb://192.168.86.50:27017", "DatabaseName": "GameDb" },
+  "Jwt": { "Key": "SuperUltraSecureJwtKeyWithAtLeast32Chars!!", "Issuer": "GameAuthApi", "Audience": "game-auth-api" },
+  "Logging": { "LogLevel": { "Default": "Information" } },
  "AllowedHosts": "*"
 }
@@ -0,0 +1,24 @@
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.5.2.0
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Auth", "Auth\Auth.csproj", "{334F3B23-EFE8-6F1A-5E5F-9A2275D56E28}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{334F3B23-EFE8-6F1A-5E5F-9A2275D56E28}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{334F3B23-EFE8-6F1A-5E5F-9A2275D56E28}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{334F3B23-EFE8-6F1A-5E5F-9A2275D56E28}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{334F3B23-EFE8-6F1A-5E5F-9A2275D56E28}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {F82C87CC-7411-493D-A138-491A81FBCC32}
+	EndGlobalSection
+EndGlobal