Add JWT auth, token service & Neutrino endpoint

RecNet.Infrastructure/Services/Configuration/ConfigService.cs

@@ -0,0 +1,34 @@
+using System.Text.Json;
+using RecNet.Domain.Repositories;
+using RecNet.Domain.Services.Configuration;
+
+namespace RecNet.Infrastructure.Services.Configuration;
+
+public class ConfigService(IServerConfigRepository repository) : IConfigService
+{
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web);
+
+    public async Task<T?> GetAsync<T>(
+        string key,
+        T? defaultValue = default,
+        CancellationToken ct = default)
+    {
+        var config = await repository.GetAsync(key, ct);
+        if (config == null)
+            return defaultValue;
+
+        return JsonSerializer.Deserialize<T>(config.Value, JsonOptions);
+    }
+
+    public async Task SetAsync<T>(
+        string key,
+        T value,
+        CancellationToken ct = default)
+    {
+        var json = JsonSerializer.Serialize(value, JsonOptions);
+
+        await repository.SetAsync(key, json, ct);
+
+        await repository.SaveChangesAsync(ct);
+    }
+}

RecNet.Infrastructure/Services/Tokens/JwtOptions.cs

@@ -0,0 +1,9 @@
+namespace RecNet.Infrastructure.Services.Tokens;
+
+public class JwtOptions
+{
+    public string Secret { get; set; } = string.Empty;
+    public string Issuer { get; set; } = "http://localhost:5155";
+    public string Audience { get; set; } = "TenWholeYears";
+    public int ExpiryMinutes { get; set; } = 60;
+}

RecNet.Infrastructure/Services/Tokens/TokenService.cs

@@ -0,0 +1,89 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+using RecNet.Domain.Entities.Profiles;
+using RecNet.Domain.Services.Tokens;
+
+namespace RecNet.Infrastructure.Services.Tokens;
+
+public class TokenService(IOptions<JwtOptions> options) : ITokenService
+{
+    public TokenResult GenerateProfileToken(Profile profile)
+    {
+        var jwtOptions = options.Value;
+        if (string.IsNullOrWhiteSpace(jwtOptions.Secret))
+            throw new InvalidOperationException("JWT secret is not configured.");
+
+        var expiresAt = DateTimeOffset.UtcNow.AddMinutes(jwtOptions.ExpiryMinutes);
+        var signingCredentials = new SigningCredentials(
+            CreateSecurityKey(jwtOptions),
+            SecurityAlgorithms.HmacSha256);
+
+        var claims = new List<Claim>
+        {
+            new(JwtRegisteredClaimNames.Sub, profile.ProfileId.ToString()),
+            new("rn.plat", ((int)profile.Platform).ToString()),
+            new("rn.platid", profile.PlatformId)
+        };
+        
+        if (profile.IsModerator)
+            claims.Add(new Claim(ClaimTypes.Role, "moderator"));
+
+        var token = new JwtSecurityToken(
+            issuer: jwtOptions.Issuer,
+            audience: jwtOptions.Audience,
+            claims: claims,
+            expires: expiresAt.UtcDateTime,
+            signingCredentials: signingCredentials);
+
+        return new TokenResult(
+            new JwtSecurityTokenHandler().WriteToken(token),
+            jwtOptions.ExpiryMinutes * 60);
+    }
+
+    public TokenVerifyResult VerifyToken(string token)
+    {
+        var jwtOptions = options.Value;
+        if (string.IsNullOrWhiteSpace(jwtOptions.Secret))
+            throw new InvalidOperationException("JWT secret is not configured.");
+
+        if (string.IsNullOrWhiteSpace(token))
+            return TokenVerifyResult.Failure();
+        
+        var tokenHandler = new JwtSecurityTokenHandler();
+        if (!tokenHandler.CanReadToken(token))
+            return TokenVerifyResult.Failure();
+        
+        var validationParameters = new TokenValidationParameters
+        {
+            ValidateIssuerSigningKey = true,
+            IssuerSigningKey = CreateSecurityKey(jwtOptions),
+            ValidateIssuer = true,
+            ValidIssuer = jwtOptions.Issuer,
+            ValidateAudience = true,
+            ValidAudience = jwtOptions.Audience,
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromMinutes(1)
+        };
+
+        try
+        {
+            var principal = tokenHandler.ValidateToken(token, validationParameters, out _);
+
+            return TokenVerifyResult.Success(principal.Claims);
+        }
+        catch (SecurityTokenException)
+        {
+            return TokenVerifyResult.Failure();
+        }
+        catch (ArgumentException)
+        {
+            return TokenVerifyResult.Failure();
+        }
+    }
+
+    private static SymmetricSecurityKey CreateSecurityKey(JwtOptions jwtOptions)
+        => new(Encoding.UTF8.GetBytes(jwtOptions.Secret));
+}