Add JWT auth, token service & Neutrino endpoint

API/API.csproj

@@ -4,13 +4,16 @@
         <TargetFramework>net10.0</TargetFramework>
         <Nullable>enable</Nullable>
         <ImplicitUsings>enable</ImplicitUsings>
+        <UserSecretsId>cfcf35c1-8c26-473a-a8e9-44ba009adea8</UserSecretsId>
     </PropertyGroup>
 
     <ItemGroup>
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />
         <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.8"/>
     </ItemGroup>
 
     <ItemGroup>
+      <ProjectReference Include="..\RecNet.Application\RecNet.Application.csproj" />
       <ProjectReference Include="..\RecNet.Infrastructure\RecNet.Infrastructure.csproj" />
       <ProjectReference Include="..\RecNet.ServiceDefaults\RecNet.ServiceDefaults.csproj" />
     </ItemGroup>

API/Configurations/RecNetOptions.cs

@@ -1,6 +1,6 @@
 namespace API.Configurations;
 
-public class RecNetConfiguration
+public class RecNetOptions
 {
     public bool UseForwardedHeaders { get; set; } = true;
 }

API/Contracts/Neutrino/Enums/AuthenticationResultCode.cs

@@ -0,0 +1,25 @@
+namespace API.Contracts.Neutrino.Enums;
+
+public enum AuthenticationResultCode
+{
+    /// <summary>
+    /// Indicates that authentication is incomplete and only the associated data is returned.
+    /// </summary>
+    /// <remarks>This value is typically used when launching the game with no account, in which data to authenticate is not provided.</remarks>
+    AuthenticationIncomplete,
+
+    /// <summary>
+    /// Indicates that authentication was successful.
+    /// </summary>
+    AuthenticationSuccessful,
+
+    /// <summary>
+    /// Indicates that authentication failed due to incorrect credentials.
+    /// </summary>
+    AuthenticationFailedWrongCredentials,
+
+    /// <summary>
+    /// Indicates that the parameters provided to the operation are invalid.
+    /// </summary>
+    InvalidParameters
+}

API/Contracts/Neutrino/Requests/NeutrinoAuthenticateRequest.cs

@@ -0,0 +1,15 @@
+using System.Text.Json.Serialization;
+
+namespace API.Contracts.Neutrino.Requests;
+
+public class NeutrinoAuthenticateRequest
+{
+    [JsonPropertyName("profileId")] 
+    public Guid ProfileId;
+    
+    [JsonPropertyName("accessToken")] 
+    public required string AccessToken;
+    
+    [JsonPropertyName("appVersion")] 
+    public required string AppVersion;
+}

API/Contracts/Neutrino/Responses/NeutrinoAuthenticateResponse.cs

@@ -0,0 +1,28 @@
+using System.Text.Json.Serialization;
+using API.Contracts.Neutrino.Enums;
+
+namespace API.Contracts.Neutrino.Responses;
+
+// {"ResultCode":1,"UserId":"their user id","Nickname":"splotybean"}
+public class NeutrinoAuthenticateResponse : NeutrinoResultCodeResponse
+{
+    public static NeutrinoAuthenticateResponse Success(string userId, string nickname) => new()
+    {
+        ResultCode = (byte)AuthenticationResultCode.AuthenticationSuccessful,
+        UserId = userId,
+        Nickname = nickname
+    };
+
+    public static NeutrinoAuthenticateResponse Failure(AuthenticationResultCode error) => new()
+    {
+        ResultCode = (byte)error
+    };
+
+    [JsonPropertyName(name: "UserId")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public string? UserId { get; set; }
+
+    [JsonPropertyName(name: "Nickname")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public string? Nickname { get; set; }
+}

API/Contracts/Neutrino/Responses/NeutrinoResultCodeResponse.cs

@@ -0,0 +1,31 @@
+using System.Text.Json.Serialization;
+
+namespace API.Contracts.Neutrino.Responses;
+
+public class NeutrinoResultCodeResponse
+{
+    public static NeutrinoResultCodeResponse Success() => new NeutrinoResultCodeResponse
+    {
+        ResultCode = 0
+    };
+
+    public static NeutrinoResultCodeResponse Failure(byte resultCode, string? message = null)
+    {
+        return new NeutrinoResultCodeResponse
+        {
+            Message = message,
+            ResultCode = resultCode
+        };
+    }
+
+    [JsonPropertyName(name: "Data")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public string? Data { get; set; }
+
+    [JsonPropertyName(name: "Message")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public string? Message { get; set; }
+
+    [JsonPropertyName(name: "ResultCode")] 
+    public byte ResultCode { get; set; }
+}

API/Contracts/Profiles/Responses/LoginResponse.cs

@@ -1,8 +1,16 @@
-using RecNet.Application.Profiles;
+using System.Text.Json.Serialization;
+using RecNet.Application.Profiles;
 
 namespace API.Contracts.Profiles.Responses;
 
 public class LoginResponse
 {
+    [JsonPropertyName("Profile")]
     public required ProfileDTO Profile { get; set; }
+    
+    [JsonPropertyName("AccessToken")]
+    public required string AccessToken { get; set; }
+    
+    [JsonPropertyName("ExpiresIn")]
+    public required int ExpiresIn { get; set; }
 }

API/Controllers/Config/V1/ConfigController.cs

@@ -1,5 +1,5 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
-using RecNet.Application.Services.Configuration;
+using RecNet.Domain.Services.Configuration;
 
 namespace API.Controllers.Config.V1;
 

API/Controllers/Neutrino/NeutrinoController.cs

@@ -0,0 +1,82 @@
+using System.Security.Claims;
+using System.Text.Json;
+using API.Contracts.Neutrino.Enums;
+using API.Contracts.Neutrino.Requests;
+using API.Contracts.Neutrino.Responses;
+using Microsoft.AspNetCore.Mvc;
+using RecNet.Domain.Repositories;
+using RecNet.Domain.Services.Tokens;
+
+namespace API.Controllers.Neutrino;
+
+[Route("[controller]")]
+[ApiController]
+public class NeutrinoController(
+    IProfileRepository profileRepository,
+    ITokenService tokenService) : ControllerBase
+{
+    // This route will be kind of abysmal so bare with it.
+    [Route("authorize")]
+    public async Task<ActionResult<NeutrinoAuthenticateResponse>> AuthorizeNeutrinoAsync()
+    {
+        // Photon sends the request with Content-Type: text/plain instead of application/json
+        // This is a really janky workaround since we can't use [FromBody] to automatically parse the data.
+        using var reader = new StreamReader(Request.Body);
+        string rawText = await reader.ReadToEndAsync();
+
+        NeutrinoAuthenticateRequest? request;
+
+        try
+        {
+            request = JsonSerializer.Deserialize<NeutrinoAuthenticateRequest>(rawText, new JsonSerializerOptions
+            {
+                IncludeFields = true,
+                PropertyNameCaseInsensitive = true
+            });
+        }
+        catch
+        {
+            return Ok(
+                NeutrinoAuthenticateResponse.Failure(
+                    AuthenticationResultCode.InvalidParameters));
+        }
+
+        // 1. Check if request parameters aren't empty
+        if (request is null ||
+            request.ProfileId == Guid.Empty ||
+            string.IsNullOrWhiteSpace(request.AccessToken))
+            return Ok(
+                NeutrinoAuthenticateResponse.Failure(
+                    AuthenticationResultCode.InvalidParameters));
+
+        // 2. Verify accessToken is valid
+        var tokenVerifyResult = tokenService.VerifyToken(request.AccessToken);
+        if (tokenVerifyResult.IsError || !TryGetProfileId(tokenVerifyResult.Claims, out var tokenAccountId))
+            return Ok(
+                NeutrinoAuthenticateResponse.Failure(
+                    AuthenticationResultCode.AuthenticationFailedWrongCredentials));
+
+        // 3. Verify that the accountId from the request matches the one from the token
+        if (tokenAccountId != request.ProfileId)
+            return Ok(
+                NeutrinoAuthenticateResponse.Failure(
+                    AuthenticationResultCode.AuthenticationFailedWrongCredentials));
+
+        // 4. Get the profile to check if it exists, and for the name
+        var profile = await profileRepository.GetByIdAsync(request.ProfileId);
+        if (profile is null)
+            return Ok(
+                NeutrinoAuthenticateResponse.Failure(
+                    AuthenticationResultCode.AuthenticationFailedWrongCredentials));
+
+        return Ok(
+            NeutrinoAuthenticateResponse.Success(
+                userId: request.ProfileId.ToString(),
+                nickname: profile.Name
+            )
+        );
+    }
+
+    private static bool TryGetProfileId(IEnumerable<Claim> claims, out Guid accountId)
+        => Guid.TryParse(claims.FirstOrDefault(c => c.Type == "sub")?.Value, out accountId);
+}

API/Controllers/Profiles/V1/ProfilesController.cs

@@ -1,8 +1,10 @@
-using API.Contracts.Profiles.Responses;
+using API.Contracts.Profiles.Responses;
 using AutoMapper;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using RecNet.Application.Profiles;
 using RecNet.Domain.Repositories;
+using RecNet.Domain.Services.Tokens;
 using LoginRequest = API.Contracts.Profiles.Requests.LoginRequest;
 using Profile = RecNet.Domain.Entities.Profiles.Profile;
 
@@ -10,9 +12,11 @@ namespace API.Controllers.Profiles.V1;
 
 [Route("api/[controller]/v1")]
 [ApiController]
+[Authorize]
 public class ProfilesController(
     IProfileRepository profileRepository,
-    IMapper mapper) : ControllerBase
+    IMapper mapper,
+    ITokenService tokenService) : ControllerBase
 {
     [HttpGet("{id:guid}")]
     public async Task<ActionResult<ProfileDTO>> GetProfile(
@@ -37,28 +41,39 @@ public class ProfilesController(
     }
 
     // TODO: Implement
+    [AllowAnonymous]
     [HttpPost("login")]
     public async Task<ActionResult<LoginResponse>> Login(
         [FromBody] LoginRequest request,
         CancellationToken ct)
     {
+        var name = GenerateRandomName();
+        
         var profile = await profileRepository.GetByPlatform(request.PlatformType, request.PlatformId, ct);
         if (profile is null)
         {
-            profile = Profile.Create(request.Username, request.PlatformType, request.PlatformId);
+            profile = Profile.Create(name, request.PlatformType, request.PlatformId);
             await profileRepository.AddAsync(profile, ct);
         }
 
         profile.AddDeviceId(request.DeviceId);
 
-        if (request.Username != profile.Name)
-            profile.SetName(request.Username);
-        
         await profileRepository.SaveChangesAsync(ct);
         
+        if (profile.IsBanned)
+            return BadRequest();
+
+        var token = tokenService.GenerateProfileToken(profile);
+
         return new LoginResponse
         {
-            Profile = mapper.Map<ProfileDTO>(profile)
+            Profile = mapper.Map<ProfileDTO>(profile),
+            AccessToken = token.AccessToken,
+            ExpiresIn = token.ExpiresIn
         };
     }
+    
+    // TODO: REPLACE WITH BETTER GENERATOR, THIS IS TEMP.
+    private static string GenerateRandomName()
+        => string.Concat("rr", Guid.NewGuid().ToString("N").AsSpan(0, 18));
 }

API/Program.cs

@@ -1,7 +1,11 @@
+using System.Text;
 using API.Configurations;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.HttpOverrides;
+using Microsoft.IdentityModel.Tokens;
 using RecNet.Application;
 using RecNet.Infrastructure;
+using RecNet.Infrastructure.Services.Tokens;
 using RecNet.ServiceDefaults;
 
 namespace API;
@@ -12,8 +16,11 @@ public class Program
     {
         var builder = WebApplication.CreateBuilder(args);
 
-        var recNetOptions = builder.Configuration.GetSection("RecNet").Get<RecNetConfiguration>()
+        var recNetOptions = builder.Configuration.GetSection("RecNet").Get<RecNetOptions>()
-            ?? new RecNetConfiguration();
+            ?? new RecNetOptions();
+        
+        var jwtOptions = builder.Configuration.GetSection("Jwt").Get<JwtOptions>()
+            ?? new JwtOptions();
 
         builder.AddServiceDefaults();
 
@@ -30,6 +37,25 @@ public class Program
         builder.Services.AddApplication();
         builder.AddInfrastructure();
 
+        builder.Services
+            .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+            .AddJwtBearer(options =>
+            {
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtOptions.Secret)),
+                    ValidateIssuer = true,
+                    ValidIssuer = jwtOptions.Issuer,
+                    ValidateAudience = true,
+                    ValidAudience = jwtOptions.Audience,
+                    ValidateLifetime = true,
+                    ClockSkew = TimeSpan.FromMinutes(1)
+                };
+            });
+        
+        builder.Services.AddAuthorization();
+
         builder.Services.AddControllers();
 
         var app = builder.Build();
@@ -37,7 +63,7 @@ public class Program
         if (recNetOptions.UseForwardedHeaders)
             app.UseForwardedHeaders();
 
-        // app.UseAuthentication();
+        app.UseAuthentication();
         app.UseAuthorization();
 
         app.MapControllers();

RecNet.Application/Common/Security/ClaimsPrincipalExtensions.cs

@@ -0,0 +1,19 @@
+using System.Security.Claims;
+
+namespace RecNet.Application.Common.Security;
+
+public static class ClaimsPrincipalExtensions
+{
+    public static Guid GetProfileId(this ClaimsPrincipal user)
+    {
+        var value =
+            user.FindFirst("sub")?.Value ??
+            user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+
+        if (!Guid.TryParse(value, out var profileId))
+            throw new UnauthorizedAccessException(
+                "Account id claim is missing or invalid.");
+
+        return profileId;
+    }
+}

RecNet.Application/DependencyInjection.cs

@@ -1,5 +1,4 @@
-using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection;
-using RecNet.Application.Services.Configuration;
 
 namespace RecNet.Application;
 
@@ -9,7 +8,8 @@ public static class DependencyInjection
     {
         services.AddAutoMapper(_ => { }, typeof(DependencyInjection).Assembly);
         
-        services.AddScoped<IConfigService, ConfigService>();
+        // Usually there would be CQRS, but I'm rushing out this server, so I didn't feel like adding it.
+        // Enjoy a VERY barebones application layer :D
 
         return services;
     }

RecNet.Application/Profiles/ProfileDto.cs

@@ -1,5 +1,4 @@
 using System.Text.Json.Serialization;
-using RecNet.Domain.Common;
 
 namespace RecNet.Application.Profiles;
 
@@ -10,11 +9,4 @@ public class ProfileDTO
     
     [JsonPropertyName("Name")]
     public required string Name { get; init; }
-    
-    [JsonPropertyName("Platform")]
-    
-    public PlatformType Platform { get; init; }
-    
-    [JsonPropertyName("CreatedAt")]
-    public DateTimeOffset CreatedAt { get; init; }
 }

RecNet.Domain/Entities/Profiles/Profile.cs

@@ -29,6 +29,10 @@ public class Profile
     public string PlatformId { get; private set; }
     public List<string> DeviceIds { get; private set; } = [];
     
+    // EZ
+    public bool IsBanned { get; private set; }
+    public bool IsModerator { get; private set; }
+
     public DateTimeOffset CreatedAt { get; private set; }
 
     public static Profile Create(
@@ -57,6 +61,8 @@ public class Profile
         DeviceIds.Add(deviceId);
     }
 
+    
+    
     private static string RequireValue(string value, string parameterName)
         => !string.IsNullOrWhiteSpace(value) ? value : throw new DomainException($"{parameterName} is required.");
 }

RecNet.Domain/Services/Configuration/IConfigService.cs

@@ -1,4 +1,4 @@
-namespace RecNet.Application.Services.Configuration;
+namespace RecNet.Domain.Services.Configuration;
 
 public interface IConfigService
 {

RecNet.Domain/Services/Tokens/ITokenService.cs

@@ -0,0 +1,9 @@
+using RecNet.Domain.Entities.Profiles;
+
+namespace RecNet.Domain.Services.Tokens;
+
+public interface ITokenService
+{
+    TokenResult GenerateProfileToken(Profile profile);
+    TokenVerifyResult VerifyToken(string token);
+}

RecNet.Domain/Services/Tokens/TokenResult.cs

@@ -0,0 +1,5 @@
+namespace RecNet.Domain.Services.Tokens;
+
+public sealed record TokenResult(
+    string AccessToken,
+    int ExpiresIn);

RecNet.Domain/Services/Tokens/TokenVerifyResult.cs

@@ -0,0 +1,21 @@
+using System.Security.Claims;
+
+namespace RecNet.Domain.Services.Tokens;
+
+public class TokenVerifyResult
+{
+    public bool IsError { get; set; }
+    public IEnumerable<Claim> Claims { get; set; }
+
+    private TokenVerifyResult(bool isError, IEnumerable<Claim>? claims)
+    {
+        IsError = isError;
+        Claims = claims ?? [];
+    }
+    
+    public static TokenVerifyResult Success(IEnumerable<Claim> claims)
+        => new(false, claims);
+    
+    public static TokenVerifyResult Failure()
+        => new(true, null);
+}

RecNet.Infrastructure/DependencyInjection.cs

@@ -1,8 +1,12 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using RecNet.Domain.Repositories;
+using RecNet.Domain.Services.Configuration;
+using RecNet.Domain.Services.Tokens;
 using RecNet.Infrastructure.Persistence;
 using RecNet.Infrastructure.Persistence.Repositories;
+using RecNet.Infrastructure.Services.Configuration;
+using RecNet.Infrastructure.Services.Tokens;
 
 namespace RecNet.Infrastructure;
 
@@ -13,9 +17,18 @@ public static class DependencyInjection
     {
         builder.AddNpgsqlDbContext<DatabaseContext>("recnet");
         
+        builder.Services
+            .AddOptions<JwtOptions>()
+            .Bind(builder.Configuration.GetSection("Jwt"))
+            .Validate(options => !string.IsNullOrWhiteSpace(options.Secret), "JWT secret is required.")
+            .ValidateOnStart();
+        
         builder.Services.AddScoped<IProfileRepository, ProfileRepository>();
         builder.Services.AddScoped<IServerConfigRepository, ServerConfigRepository>();
         
+        builder.Services.AddScoped<IConfigService, ConfigService>();
+        builder.Services.AddScoped<ITokenService, TokenService>();
+
         return builder;
     }
 }

RecNet.Infrastructure/Persistence/Migrations/20260619025601_ProfileToggles.Designer.cs

@@ -0,0 +1,87 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using RecNet.Infrastructure.Persistence;
+
+#nullable disable
+
+namespace RecNet.Infrastructure.Persistence.Migrations
+{
+    [DbContext(typeof(DatabaseContext))]
+    [Migration("20260619025601_ProfileToggles")]
+    partial class ProfileToggles
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.8")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("RecNet.Domain.Entities.Configuration.ServerConfig", b =>
+                {
+                    b.Property<string>("Key")
+                        .HasMaxLength(128)
+                        .HasColumnType("character varying(128)");
+
+                    b.Property<string>("Value")
+                        .IsRequired()
+                        .HasColumnType("jsonb");
+
+                    b.HasKey("Key");
+
+                    b.ToTable("ServerConfigs");
+                });
+
+            modelBuilder.Entity("RecNet.Domain.Entities.Profiles.Profile", b =>
+                {
+                    b.Property<Guid>("ProfileId")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.PrimitiveCollection<string>("DeviceIds")
+                        .IsRequired()
+                        .HasColumnType("jsonb");
+
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("IsModerator")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(32)
+                        .HasColumnType("character varying(32)");
+
+                    b.Property<string>("Platform")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("character varying(50)");
+
+                    b.Property<string>("PlatformId")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("character varying(50)");
+
+                    b.HasKey("ProfileId");
+
+                    b.HasIndex("Platform", "PlatformId")
+                        .IsUnique();
+
+                    b.ToTable("Profiles");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

RecNet.Infrastructure/Persistence/Migrations/20260619025601_ProfileToggles.cs

@@ -0,0 +1,40 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace RecNet.Infrastructure.Persistence.Migrations
+{
+    /// <inheritdoc />
+    public partial class ProfileToggles : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "IsBanned",
+                table: "Profiles",
+                type: "boolean",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "IsModerator",
+                table: "Profiles",
+                type: "boolean",
+                nullable: false,
+                defaultValue: false);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "IsBanned",
+                table: "Profiles");
+
+            migrationBuilder.DropColumn(
+                name: "IsModerator",
+                table: "Profiles");
+        }
+    }
+}

RecNet.Infrastructure/Persistence/Migrations/DatabaseContextModelSnapshot.cs

@@ -50,6 +50,12 @@ namespace RecNet.Infrastructure.Persistence.Migrations
                         .IsRequired()
                         .HasColumnType("jsonb");
 
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("IsModerator")
+                        .HasColumnType("boolean");
+
                     b.Property<string>("Name")
                         .IsRequired()
                         .HasMaxLength(32)

RecNet.Infrastructure/RecNet.Infrastructure.csproj

@@ -8,10 +8,10 @@
 
     <ItemGroup>
       <PackageReference Include="Aspire.Npgsql.EntityFrameworkCore.PostgreSQL" Version="13.4.5" />
+      <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.14.0" />
     </ItemGroup>
 
     <ItemGroup>
-      <ProjectReference Include="..\RecNet.Application\RecNet.Application.csproj" />
       <ProjectReference Include="..\RecNet.Domain\RecNet.Domain.csproj" />
     </ItemGroup>
 

RecNet.Infrastructure/Services/Configuration/ConfigService.cs

@@ -1,7 +1,8 @@
-using System.Text.Json;
+using System.Text.Json;
 using RecNet.Domain.Repositories;
+using RecNet.Domain.Services.Configuration;
 
-namespace RecNet.Application.Services.Configuration;
+namespace RecNet.Infrastructure.Services.Configuration;
 
 public class ConfigService(IServerConfigRepository repository) : IConfigService
 {

RecNet.Infrastructure/Services/Tokens/JwtOptions.cs

@@ -0,0 +1,9 @@
+namespace RecNet.Infrastructure.Services.Tokens;
+
+public class JwtOptions
+{
+    public string Secret { get; set; } = string.Empty;
+    public string Issuer { get; set; } = "http://localhost:5155";
+    public string Audience { get; set; } = "TenWholeYears";
+    public int ExpiryMinutes { get; set; } = 60;
+}

RecNet.Infrastructure/Services/Tokens/TokenService.cs

@@ -0,0 +1,89 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+using RecNet.Domain.Entities.Profiles;
+using RecNet.Domain.Services.Tokens;
+
+namespace RecNet.Infrastructure.Services.Tokens;
+
+public class TokenService(IOptions<JwtOptions> options) : ITokenService
+{
+    public TokenResult GenerateProfileToken(Profile profile)
+    {
+        var jwtOptions = options.Value;
+        if (string.IsNullOrWhiteSpace(jwtOptions.Secret))
+            throw new InvalidOperationException("JWT secret is not configured.");
+
+        var expiresAt = DateTimeOffset.UtcNow.AddMinutes(jwtOptions.ExpiryMinutes);
+        var signingCredentials = new SigningCredentials(
+            CreateSecurityKey(jwtOptions),
+            SecurityAlgorithms.HmacSha256);
+
+        var claims = new List<Claim>
+        {
+            new(JwtRegisteredClaimNames.Sub, profile.ProfileId.ToString()),
+            new("rn.plat", ((int)profile.Platform).ToString()),
+            new("rn.platid", profile.PlatformId)
+        };
+        
+        if (profile.IsModerator)
+            claims.Add(new Claim(ClaimTypes.Role, "moderator"));
+
+        var token = new JwtSecurityToken(
+            issuer: jwtOptions.Issuer,
+            audience: jwtOptions.Audience,
+            claims: claims,
+            expires: expiresAt.UtcDateTime,
+            signingCredentials: signingCredentials);
+
+        return new TokenResult(
+            new JwtSecurityTokenHandler().WriteToken(token),
+            jwtOptions.ExpiryMinutes * 60);
+    }
+
+    public TokenVerifyResult VerifyToken(string token)
+    {
+        var jwtOptions = options.Value;
+        if (string.IsNullOrWhiteSpace(jwtOptions.Secret))
+            throw new InvalidOperationException("JWT secret is not configured.");
+
+        if (string.IsNullOrWhiteSpace(token))
+            return TokenVerifyResult.Failure();
+        
+        var tokenHandler = new JwtSecurityTokenHandler();
+        if (!tokenHandler.CanReadToken(token))
+            return TokenVerifyResult.Failure();
+        
+        var validationParameters = new TokenValidationParameters
+        {
+            ValidateIssuerSigningKey = true,
+            IssuerSigningKey = CreateSecurityKey(jwtOptions),
+            ValidateIssuer = true,
+            ValidIssuer = jwtOptions.Issuer,
+            ValidateAudience = true,
+            ValidAudience = jwtOptions.Audience,
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromMinutes(1)
+        };
+
+        try
+        {
+            var principal = tokenHandler.ValidateToken(token, validationParameters, out _);
+
+            return TokenVerifyResult.Success(principal.Claims);
+        }
+        catch (SecurityTokenException)
+        {
+            return TokenVerifyResult.Failure();
+        }
+        catch (ArgumentException)
+        {
+            return TokenVerifyResult.Failure();
+        }
+    }
+
+    private static SymmetricSecurityKey CreateSecurityKey(JwtOptions jwtOptions)
+        => new(Encoding.UTF8.GetBytes(jwtOptions.Secret));
+}