first commit

2026-03-11 11:18:25 -05:00
commit f3cb730f3b
472 changed files with 53651 additions and 0 deletions
@@ -0,0 +1,12 @@
+namespace Landmark.OLA.Application.Common.Security
+{
+    public class AzureActiveDirectoryOptions
+    {
+        public string ClientId { get; set; }
+        public string ClientSecret { get; set; }
+        public string Instance { get; set; }
+        public string Domain { get; set; }
+        public string TenantId { get; set; }
+        public string ValidAudience { get; set; }
+    }
+}
@@ -0,0 +1,49 @@
+using System;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Landmark.OLA.Application.Common.Security
+{
+    public static class AzureAdServiceCollectionExtensions
+    {
+        public static AuthenticationBuilder AddAzureAdBearer(this AuthenticationBuilder builder)
+            => builder.AddAzureAdBearer(_ => { });
+
+        public static AuthenticationBuilder AddAzureAdBearer(this AuthenticationBuilder builder, Action<AzureActiveDirectoryOptions> configureOptions)
+        {
+            builder.Services.Configure(configureOptions);
+            builder.Services.AddSingleton<IConfigureOptions<JwtBearerOptions>, ConfigureAzureOptions>();
+            builder.AddJwtBearer();
+            return builder;
+        }
+
+        private class ConfigureAzureOptions : IConfigureNamedOptions<JwtBearerOptions>
+        {
+            private readonly AzureActiveDirectoryOptions _azureOptions;
+
+            public ConfigureAzureOptions(IOptions<AzureActiveDirectoryOptions> azureOptions)
+            {
+                _azureOptions = azureOptions.Value;
+            }
+
+            public void Configure(string name, JwtBearerOptions options)
+            {
+                options.Audience = _azureOptions.ClientId;
+                options.Authority = $"{_azureOptions.Instance}{_azureOptions.TenantId}";
+
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidAudience = _azureOptions.ValidAudience
+                };
+            }
+
+            public void Configure(JwtBearerOptions options)
+            {
+                Configure(Options.DefaultName, options);
+            }
+        }
+    }
+}
@@ -0,0 +1,70 @@
+using System;
+using Microsoft.AspNetCore.Http;
+using Landmark.OLA.Models.OnlineBanking;
+
+namespace Landmark.OLA.Application.Common.Security
+{
+    public class CookieService
+    {
+
+        public static void SetAuthenticationCookie(IResponseCookies cookies, string token)
+        {
+            if (!string.IsNullOrEmpty(token))
+            {
+                var expiry = new DateTimeOffset(DateTime.UtcNow.AddMinutes(15));
+                var options = new CookieOptions
+                {
+                    SameSite = SameSiteMode.Lax,
+                    HttpOnly = true,
+                    Secure = true,
+                    Expires = expiry,
+                    Domain = "landmarkcu.com"
+                };
+                cookies
+                    .Append(Constants.TokenPayload, token, options);
+            }
+        }
+
+        public static void SetAuthorizationCookie(IResponseCookies cookies, string authorization)
+        {            
+            if (!string.IsNullOrEmpty(authorization))
+            {
+                var expiry = new DateTimeOffset(DateTime.UtcNow.AddMinutes(15));
+                var options = new CookieOptions
+                {
+                    SameSite = SameSiteMode.Lax,
+                    HttpOnly = false,
+                    Secure = true,
+                    Expires = expiry,
+                    Domain = "landmarkcu.com",
+                };
+                cookies
+                .Append(Constants.TokenAuthorization, authorization, options);
+            }
+        }
+
+        public static void ExpireCookies(HttpContext context)
+        {           
+            var currentCookies = context.Request.Cookies;
+            var expiry = new DateTimeOffset(DateTime.UtcNow.AddDays(-1));
+            var options = new CookieOptions
+            {
+                HttpOnly = false,
+                Secure = true,
+                Expires = expiry,
+                Domain = ".landmarkcu.com"
+            };
+            if (currentCookies[Constants.TokenPayload] != null)
+            {
+                context.Response.Cookies
+                    .Delete(Constants.TokenPayload, options);
+            }
+
+            if (currentCookies[Constants.TokenAuthorization] != null)
+            {
+                context.Response.Cookies
+                    .Delete(Constants.TokenAuthorization, options);
+            }
+        }
+    }
+}
@@ -0,0 +1,22 @@
+using Landmark.OLA.Models.Loan;
+
+namespace Landmark.OLA.Application.Common.Security
+{
+    public static class CosmosIdService
+    {
+        public static LoanContainer AppendCosmosId(LoanContainer loanContainer, string cosmosId)
+        {
+            if (!string.IsNullOrEmpty(cosmosId))
+            {
+                loanContainer.Id = cosmosId;
+            }
+            return loanContainer;
+        }
+
+        public static LoanContainer RemoveCosmosId(LoanContainer loanContainer)
+        {
+            loanContainer.LoanId = null;
+            return loanContainer;
+        }
+    }
+}
@@ -0,0 +1,26 @@
+using System.Linq;
+using System.Net;
+using Microsoft.AspNetCore.Http;
+using Landmark.OLA.Models.Loan;
+
+namespace Landmark.OLA.Application.Common.Security
+{
+    public static class ForwardedHeaderService
+    {
+        public static string GetRemoteIPAddress(HttpContext context)
+        {
+            var header = (context.Request.Headers["CF-Connecting-IP"].FirstOrDefault() ?? context.Request.Headers["X-Forwarded-For"].FirstOrDefault());
+            if (IPAddress.TryParse(header, out IPAddress ip))
+            {
+                return ip.ToString();
+            }
+            return context.Connection.RemoteIpAddress.ToString();
+        }
+
+        public static LoanContainer AppendIPAddress(LoanContainer loanContainer, HttpContext context)
+        {
+            loanContainer.LoanApplication.IPAddress = GetRemoteIPAddress(context);
+            return loanContainer;
+        }
+    }
+}
@@ -0,0 +1,28 @@
+using Landmark.OLA.Models.Loan;
+using Landmark.OLA.Models.OnlineBanking;
+
+namespace Landmark.OLA.Application.Common.Security
+{
+    public static class MemberIdService
+    {
+        public static LoanContainer AppendMemberInfo(LoanContainer loanContainer, OnlineBankingToken token)
+        {
+            if (!string.IsNullOrEmpty(token?.MemberID) )
+            {
+                loanContainer.MemberId = token.MemberID;
+            }
+            if (!string.IsNullOrEmpty(token?.IndividualID) )
+            {
+                loanContainer.IndividualId = token.IndividualID;
+            }
+            return loanContainer;
+        }
+
+        public static LoanContainer RemoveMemberId(LoanContainer loanContainer)
+        {
+            loanContainer.MemberId = null;
+            loanContainer.IndividualId = null;
+            return loanContainer;
+        }
+    }
+}
@@ -0,0 +1,33 @@
+using System;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+using Serilog;
+using OnlineBankingAuth.Tokens;
+
+namespace Landmark.OLA.Application.Common.Security
+{
+    public class RenewAuthenticatedSessionMiddleware
+    {
+        private readonly RequestDelegate _next;
+        
+        public RenewAuthenticatedSessionMiddleware(RequestDelegate next)
+        {
+            _next = next;
+        }
+
+        public async Task InvokeAsync(HttpContext context, ITokenService tokenService)
+        {
+            await _next(context);
+            try
+            {
+                CookieService.SetAuthenticationCookie(context.Response.Cookies, tokenService.RenewOnlineBankingJWT(context));
+                CookieService.SetAuthorizationCookie(context.Response.Cookies, tokenService.RenewAuthorization(context));
+            }
+            catch(Exception ex)
+            {
+                Log.Fatal("Error renewing cookied", ex);
+                // Could not refresh token :-( no biggie?
+            }
+        }
+    }
+}