RecRoomArchive/TenWholeYears.Server
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add JWT auth, token service & Neutrino endpoint

Browse Source
This commit is contained in:
Holden
2026-06-19 12:25:45 -05:00
parent 608def3ac8
commit 3eebfc9ba2
27 changed files with 581 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
API/API.csproj
View File

@@ -4,13 +4,16 @@
<TargetFramework>net10.0</TargetFramework>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<UserSecretsId>cfcf35c1-8c26-473a-a8e9-44ba009adea8</UserSecretsId>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />
<PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.8"/>
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\RecNet.Application\RecNet.Application.csproj" />
<ProjectReference Include="..\RecNet.Infrastructure\RecNet.Infrastructure.csproj" />
<ProjectReference Include="..\RecNet.ServiceDefaults\RecNet.ServiceDefaults.csproj" />
</ItemGroup>

2
API/Configurations/RecNetConfiguration.cs → API/Configurations/RecNetOptions.cs
View File

@@ -1,6 +1,6 @@
namespace API.Configurations;
public class RecNetConfiguration
public class RecNetOptions
{
public bool UseForwardedHeaders { get; set; } = true;
}

25
API/Contracts/Neutrino/Enums/AuthenticationResultCode.cs Normal file
View File

@@ -0,0 +1,25 @@
namespace API.Contracts.Neutrino.Enums;
public enum AuthenticationResultCode
{
/// <summary>
/// Indicates that authentication is incomplete and only the associated data is returned.
/// </summary>
/// <remarks>This value is typically used when launching the game with no account, in which data to authenticate is not provided.</remarks>
AuthenticationIncomplete,
/// <summary>
/// Indicates that authentication was successful.
/// </summary>
AuthenticationSuccessful,
/// <summary>
/// Indicates that authentication failed due to incorrect credentials.
/// </summary>
AuthenticationFailedWrongCredentials,
/// <summary>
/// Indicates that the parameters provided to the operation are invalid.
/// </summary>
InvalidParameters
}

15
API/Contracts/Neutrino/Requests/NeutrinoAuthenticateRequest.cs Normal file
View File

@@ -0,0 +1,15 @@
using System.Text.Json.Serialization;
namespace API.Contracts.Neutrino.Requests;
public class NeutrinoAuthenticateRequest
{
[JsonPropertyName("profileId")]
public Guid ProfileId;
[JsonPropertyName("accessToken")]
public required string AccessToken;
[JsonPropertyName("appVersion")]
public required string AppVersion;
}

28
API/Contracts/Neutrino/Responses/NeutrinoAuthenticateResponse.cs Normal file
View File

@@ -0,0 +1,28 @@
using System.Text.Json.Serialization;
using API.Contracts.Neutrino.Enums;
namespace API.Contracts.Neutrino.Responses;
// {"ResultCode":1,"UserId":"their user id","Nickname":"splotybean"}
public class NeutrinoAuthenticateResponse : NeutrinoResultCodeResponse
{
public static NeutrinoAuthenticateResponse Success(string userId, string nickname) => new()
{
ResultCode = (byte)AuthenticationResultCode.AuthenticationSuccessful,
UserId = userId,
Nickname = nickname
};
public static NeutrinoAuthenticateResponse Failure(AuthenticationResultCode error) => new()
{
ResultCode = (byte)error
};
[JsonPropertyName(name: "UserId")]
[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
public string? UserId { get; set; }
[JsonPropertyName(name: "Nickname")]
[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
public string? Nickname { get; set; }
}

31
API/Contracts/Neutrino/Responses/NeutrinoResultCodeResponse.cs Normal file
View File

@@ -0,0 +1,31 @@
using System.Text.Json.Serialization;
namespace API.Contracts.Neutrino.Responses;
public class NeutrinoResultCodeResponse
{
public static NeutrinoResultCodeResponse Success() => new NeutrinoResultCodeResponse
{
ResultCode = 0
};
public static NeutrinoResultCodeResponse Failure(byte resultCode, string? message = null)
{
return new NeutrinoResultCodeResponse
{
Message = message,
ResultCode = resultCode
};
}
[JsonPropertyName(name: "Data")]
[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
public string? Data { get; set; }
[JsonPropertyName(name: "Message")]
[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
public string? Message { get; set; }
[JsonPropertyName(name: "ResultCode")]
public byte ResultCode { get; set; }
}

10
API/Contracts/Profiles/Responses/LoginResponse.cs
View File

@@ -1,8 +1,16 @@
using RecNet.Application.Profiles;
using System.Text.Json.Serialization;
using RecNet.Application.Profiles;
namespace API.Contracts.Profiles.Responses;
public class LoginResponse
{
[JsonPropertyName("Profile")]
public required ProfileDTO Profile { get; set; }
[JsonPropertyName("AccessToken")]
public required string AccessToken { get; set; }
[JsonPropertyName("ExpiresIn")]
public required int ExpiresIn { get; set; }
}

4
API/Controllers/Config/V1/ConfigController.cs
View File

@@ -1,5 +1,5 @@
using Microsoft.AspNetCore.Mvc;
using RecNet.Application.Services.Configuration;
using Microsoft.AspNetCore.Mvc;
using RecNet.Domain.Services.Configuration;
namespace API.Controllers.Config.V1;

82
API/Controllers/Neutrino/NeutrinoController.cs Normal file
View File

@@ -0,0 +1,82 @@
using System.Security.Claims;
using System.Text.Json;
using API.Contracts.Neutrino.Enums;
using API.Contracts.Neutrino.Requests;
using API.Contracts.Neutrino.Responses;
using Microsoft.AspNetCore.Mvc;
using RecNet.Domain.Repositories;
using RecNet.Domain.Services.Tokens;
namespace API.Controllers.Neutrino;
[Route("[controller]")]
[ApiController]
public class NeutrinoController(
IProfileRepository profileRepository,
ITokenService tokenService) : ControllerBase
{
// This route will be kind of abysmal so bare with it.
[Route("authorize")]
public async Task<ActionResult<NeutrinoAuthenticateResponse>> AuthorizeNeutrinoAsync()
{
// Photon sends the request with Content-Type: text/plain instead of application/json
// This is a really janky workaround since we can't use [FromBody] to automatically parse the data.
using var reader = new StreamReader(Request.Body);
string rawText = await reader.ReadToEndAsync();
NeutrinoAuthenticateRequest? request;
try
{
request = JsonSerializer.Deserialize<NeutrinoAuthenticateRequest>(rawText, new JsonSerializerOptions
{
IncludeFields = true,
PropertyNameCaseInsensitive = true
});
}
catch
{
return Ok(
NeutrinoAuthenticateResponse.Failure(
AuthenticationResultCode.InvalidParameters));
}
// 1. Check if request parameters aren't empty
if (request is null ||
request.ProfileId == Guid.Empty ||
string.IsNullOrWhiteSpace(request.AccessToken))
return Ok(
NeutrinoAuthenticateResponse.Failure(
AuthenticationResultCode.InvalidParameters));
// 2. Verify accessToken is valid
var tokenVerifyResult = tokenService.VerifyToken(request.AccessToken);
if (tokenVerifyResult.IsError || !TryGetProfileId(tokenVerifyResult.Claims, out var tokenAccountId))
return Ok(
NeutrinoAuthenticateResponse.Failure(
AuthenticationResultCode.AuthenticationFailedWrongCredentials));
// 3. Verify that the accountId from the request matches the one from the token
if (tokenAccountId != request.ProfileId)
return Ok(
NeutrinoAuthenticateResponse.Failure(
AuthenticationResultCode.AuthenticationFailedWrongCredentials));
// 4. Get the profile to check if it exists, and for the name
var profile = await profileRepository.GetByIdAsync(request.ProfileId);
if (profile is null)
return Ok(
NeutrinoAuthenticateResponse.Failure(
AuthenticationResultCode.AuthenticationFailedWrongCredentials));
return Ok(
NeutrinoAuthenticateResponse.Success(
userId: request.ProfileId.ToString(),
nickname: profile.Name
)
);
}
private static bool TryGetProfileId(IEnumerable<Claim> claims, out Guid accountId)
=> Guid.TryParse(claims.FirstOrDefault(c => c.Type == "sub")?.Value, out accountId);
}

29
API/Controllers/Profiles/V1/ProfilesController.cs
View File

@@ -1,8 +1,10 @@
using API.Contracts.Profiles.Responses;
using API.Contracts.Profiles.Responses;
using AutoMapper;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using RecNet.Application.Profiles;
using RecNet.Domain.Repositories;
using RecNet.Domain.Services.Tokens;
using LoginRequest = API.Contracts.Profiles.Requests.LoginRequest;
using Profile = RecNet.Domain.Entities.Profiles.Profile;
@@ -10,9 +12,11 @@ namespace API.Controllers.Profiles.V1;
[Route("api/[controller]/v1")]
[ApiController]
[Authorize]
public class ProfilesController(
IProfileRepository profileRepository,
IMapper mapper) : ControllerBase
IMapper mapper,
ITokenService tokenService) : ControllerBase
{
[HttpGet("{id:guid}")]
public async Task<ActionResult<ProfileDTO>> GetProfile(
@@ -37,28 +41,39 @@ public class ProfilesController(
}
// TODO: Implement
[AllowAnonymous]
[HttpPost("login")]
public async Task<ActionResult<LoginResponse>> Login(
[FromBody] LoginRequest request,
CancellationToken ct)
{
var name = GenerateRandomName();
var profile = await profileRepository.GetByPlatform(request.PlatformType, request.PlatformId, ct);
if (profile is null)
{
profile = Profile.Create(request.Username, request.PlatformType, request.PlatformId);
profile = Profile.Create(name, request.PlatformType, request.PlatformId);
await profileRepository.AddAsync(profile, ct);
}
profile.AddDeviceId(request.DeviceId);
if (request.Username != profile.Name)
profile.SetName(request.Username);
await profileRepository.SaveChangesAsync(ct);
if (profile.IsBanned)
return BadRequest();
var token = tokenService.GenerateProfileToken(profile);
return new LoginResponse
{
Profile = mapper.Map<ProfileDTO>(profile)
Profile = mapper.Map<ProfileDTO>(profile),
AccessToken = token.AccessToken,
ExpiresIn = token.ExpiresIn
};
}
// TODO: REPLACE WITH BETTER GENERATOR, THIS IS TEMP.
private static string GenerateRandomName()
=> string.Concat("rr", Guid.NewGuid().ToString("N").AsSpan(0, 18));
}

32
API/Program.cs
View File

@@ -1,7 +1,11 @@
using System.Text;
using API.Configurations;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.HttpOverrides;
using Microsoft.IdentityModel.Tokens;
using RecNet.Application;
using RecNet.Infrastructure;
using RecNet.Infrastructure.Services.Tokens;
using RecNet.ServiceDefaults;
namespace API;
@@ -12,8 +16,11 @@ public class Program
{
var builder = WebApplication.CreateBuilder(args);
var recNetOptions = builder.Configuration.GetSection("RecNet").Get<RecNetConfiguration>()
?? new RecNetConfiguration();
var recNetOptions = builder.Configuration.GetSection("RecNet").Get<RecNetOptions>()
?? new RecNetOptions();
var jwtOptions = builder.Configuration.GetSection("Jwt").Get<JwtOptions>()
?? new JwtOptions();
builder.AddServiceDefaults();
@@ -30,6 +37,25 @@ public class Program
builder.Services.AddApplication();
builder.AddInfrastructure();
builder.Services
.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtOptions.Secret)),
ValidateIssuer = true,
ValidIssuer = jwtOptions.Issuer,
ValidateAudience = true,
ValidAudience = jwtOptions.Audience,
ValidateLifetime = true,
ClockSkew = TimeSpan.FromMinutes(1)
};
});
builder.Services.AddAuthorization();
builder.Services.AddControllers();
var app = builder.Build();
@@ -37,7 +63,7 @@ public class Program
if (recNetOptions.UseForwardedHeaders)
app.UseForwardedHeaders();
// app.UseAuthentication();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

19
RecNet.Application/Common/Security/ClaimsPrincipalExtensions.cs Normal file
View File

@@ -0,0 +1,19 @@
using System.Security.Claims;
namespace RecNet.Application.Common.Security;
public static class ClaimsPrincipalExtensions
{
public static Guid GetProfileId(this ClaimsPrincipal user)
{
var value =
user.FindFirst("sub")?.Value ??
user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
if (!Guid.TryParse(value, out var profileId))
throw new UnauthorizedAccessException(
"Account id claim is missing or invalid.");
return profileId;
}
}

6
RecNet.Application/DependencyInjection.cs
View File

@@ -1,5 +1,4 @@
using Microsoft.Extensions.DependencyInjection;
using RecNet.Application.Services.Configuration;
using Microsoft.Extensions.DependencyInjection;
namespace RecNet.Application;
@@ -9,7 +8,8 @@ public static class DependencyInjection
{
services.AddAutoMapper(_ => { }, typeof(DependencyInjection).Assembly);
services.AddScoped<IConfigService, ConfigService>();
// Usually there would be CQRS, but I'm rushing out this server, so I didn't feel like adding it.
// Enjoy a VERY barebones application layer :D
return services;
}

8
RecNet.Application/Profiles/ProfileDto.cs
View File

@@ -1,5 +1,4 @@
using System.Text.Json.Serialization;
using RecNet.Domain.Common;
namespace RecNet.Application.Profiles;
@@ -10,11 +9,4 @@ public class ProfileDTO
[JsonPropertyName("Name")]
public required string Name { get; init; }
[JsonPropertyName("Platform")]
public PlatformType Platform { get; init; }
[JsonPropertyName("CreatedAt")]
public DateTimeOffset CreatedAt { get; init; }
}

6
RecNet.Domain/Entities/Profiles/Profile.cs
View File

@@ -29,6 +29,10 @@ public class Profile
public string PlatformId { get; private set; }
public List<string> DeviceIds { get; private set; } = [];
// EZ
public bool IsBanned { get; private set; }
public bool IsModerator { get; private set; }
public DateTimeOffset CreatedAt { get; private set; }
public static Profile Create(
@@ -57,6 +61,8 @@ public class Profile
DeviceIds.Add(deviceId);
}
private static string RequireValue(string value, string parameterName)
=> !string.IsNullOrWhiteSpace(value) ? value : throw new DomainException($"{parameterName} is required.");
}

2
RecNet.Application/Services/Configuration/IConfigService.cs → RecNet.Domain/Services/Configuration/IConfigService.cs
View File

@@ -1,4 +1,4 @@
namespace RecNet.Application.Services.Configuration;
namespace RecNet.Domain.Services.Configuration;
public interface IConfigService
{

9
RecNet.Domain/Services/Tokens/ITokenService.cs Normal file
View File

@@ -0,0 +1,9 @@
using RecNet.Domain.Entities.Profiles;
namespace RecNet.Domain.Services.Tokens;
public interface ITokenService
{
TokenResult GenerateProfileToken(Profile profile);
TokenVerifyResult VerifyToken(string token);
}

5
RecNet.Domain/Services/Tokens/TokenResult.cs Normal file
View File

@@ -0,0 +1,5 @@
namespace RecNet.Domain.Services.Tokens;
public sealed record TokenResult(
string AccessToken,
int ExpiresIn);

21
RecNet.Domain/Services/Tokens/TokenVerifyResult.cs Normal file
View File

@@ -0,0 +1,21 @@
using System.Security.Claims;
namespace RecNet.Domain.Services.Tokens;
public class TokenVerifyResult
{
public bool IsError { get; set; }
public IEnumerable<Claim> Claims { get; set; }
private TokenVerifyResult(bool isError, IEnumerable<Claim>? claims)
{
IsError = isError;
Claims = claims ?? [];
}
public static TokenVerifyResult Success(IEnumerable<Claim> claims)
=> new(false, claims);
public static TokenVerifyResult Failure()
=> new(true, null);
}

13
RecNet.Infrastructure/DependencyInjection.cs
View File

@@ -1,8 +1,12 @@
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using RecNet.Domain.Repositories;
using RecNet.Domain.Services.Configuration;
using RecNet.Domain.Services.Tokens;
using RecNet.Infrastructure.Persistence;
using RecNet.Infrastructure.Persistence.Repositories;
using RecNet.Infrastructure.Services.Configuration;
using RecNet.Infrastructure.Services.Tokens;
namespace RecNet.Infrastructure;
@@ -13,9 +17,18 @@ public static class DependencyInjection
{
builder.AddNpgsqlDbContext<DatabaseContext>("recnet");
builder.Services
.AddOptions<JwtOptions>()
.Bind(builder.Configuration.GetSection("Jwt"))
.Validate(options => !string.IsNullOrWhiteSpace(options.Secret), "JWT secret is required.")
.ValidateOnStart();
builder.Services.AddScoped<IProfileRepository, ProfileRepository>();
builder.Services.AddScoped<IServerConfigRepository, ServerConfigRepository>();
builder.Services.AddScoped<IConfigService, ConfigService>();
builder.Services.AddScoped<ITokenService, TokenService>();
return builder;
}
}

87
RecNet.Infrastructure/Persistence/Migrations/20260619025601_ProfileToggles.Designer.cs generated Normal file
View File

@@ -0,0 +1,87 @@
// <auto-generated />
using System;
using Microsoft.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore.Infrastructure;
using Microsoft.EntityFrameworkCore.Migrations;
using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
using RecNet.Infrastructure.Persistence;
#nullable disable
namespace RecNet.Infrastructure.Persistence.Migrations
{
[DbContext(typeof(DatabaseContext))]
[Migration("20260619025601_ProfileToggles")]
partial class ProfileToggles
{
/// <inheritdoc />
protected override void BuildTargetModel(ModelBuilder modelBuilder)
{
#pragma warning disable 612, 618
modelBuilder
.HasAnnotation("ProductVersion", "10.0.8")
.HasAnnotation("Relational:MaxIdentifierLength", 63);
NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
modelBuilder.Entity("RecNet.Domain.Entities.Configuration.ServerConfig", b =>
{
b.Property<string>("Key")
.HasMaxLength(128)
.HasColumnType("character varying(128)");
b.Property<string>("Value")
.IsRequired()
.HasColumnType("jsonb");
b.HasKey("Key");
b.ToTable("ServerConfigs");
});
modelBuilder.Entity("RecNet.Domain.Entities.Profiles.Profile", b =>
{
b.Property<Guid>("ProfileId")
.ValueGeneratedOnAdd()
.HasColumnType("uuid");
b.Property<DateTimeOffset>("CreatedAt")
.HasColumnType("timestamp with time zone");
b.PrimitiveCollection<string>("DeviceIds")
.IsRequired()
.HasColumnType("jsonb");
b.Property<bool>("IsBanned")
.HasColumnType("boolean");
b.Property<bool>("IsModerator")
.HasColumnType("boolean");
b.Property<string>("Name")
.IsRequired()
.HasMaxLength(32)
.HasColumnType("character varying(32)");
b.Property<string>("Platform")
.IsRequired()
.HasMaxLength(50)
.HasColumnType("character varying(50)");
b.Property<string>("PlatformId")
.IsRequired()
.HasMaxLength(50)
.HasColumnType("character varying(50)");
b.HasKey("ProfileId");
b.HasIndex("Platform", "PlatformId")
.IsUnique();
b.ToTable("Profiles");
});
#pragma warning restore 612, 618
}
}
}

40
RecNet.Infrastructure/Persistence/Migrations/20260619025601_ProfileToggles.cs Normal file
View File

@@ -0,0 +1,40 @@
using Microsoft.EntityFrameworkCore.Migrations;
#nullable disable
namespace RecNet.Infrastructure.Persistence.Migrations
{
/// <inheritdoc />
public partial class ProfileToggles : Migration
{
/// <inheritdoc />
protected override void Up(MigrationBuilder migrationBuilder)
{
migrationBuilder.AddColumn<bool>(
name: "IsBanned",
table: "Profiles",
type: "boolean",
nullable: false,
defaultValue: false);
migrationBuilder.AddColumn<bool>(
name: "IsModerator",
table: "Profiles",
type: "boolean",
nullable: false,
defaultValue: false);
}
/// <inheritdoc />
protected override void Down(MigrationBuilder migrationBuilder)
{
migrationBuilder.DropColumn(
name: "IsBanned",
table: "Profiles");
migrationBuilder.DropColumn(
name: "IsModerator",
table: "Profiles");
}
}
}

6
RecNet.Infrastructure/Persistence/Migrations/DatabaseContextModelSnapshot.cs
View File

@@ -50,6 +50,12 @@ namespace RecNet.Infrastructure.Persistence.Migrations
.IsRequired()
.HasColumnType("jsonb");
b.Property<bool>("IsBanned")
.HasColumnType("boolean");
b.Property<bool>("IsModerator")
.HasColumnType("boolean");
b.Property<string>("Name")
.IsRequired()
.HasMaxLength(32)

2
RecNet.Infrastructure/RecNet.Infrastructure.csproj
View File

@@ -8,10 +8,10 @@
<ItemGroup>
<PackageReference Include="Aspire.Npgsql.EntityFrameworkCore.PostgreSQL" Version="13.4.5" />
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.14.0" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\RecNet.Application\RecNet.Application.csproj" />
<ProjectReference Include="..\RecNet.Domain\RecNet.Domain.csproj" />
</ItemGroup>

5
RecNet.Application/Services/Configuration/ConfigService.cs → RecNet.Infrastructure/Services/Configuration/ConfigService.cs
View File

@@ -1,7 +1,8 @@
using System.Text.Json;
using System.Text.Json;
using RecNet.Domain.Repositories;
using RecNet.Domain.Services.Configuration;
namespace RecNet.Application.Services.Configuration;
namespace RecNet.Infrastructure.Services.Configuration;
public class ConfigService(IServerConfigRepository repository) : IConfigService
{

9
RecNet.Infrastructure/Services/Tokens/JwtOptions.cs Normal file
View File

@@ -0,0 +1,9 @@
namespace RecNet.Infrastructure.Services.Tokens;
public class JwtOptions
{
public string Secret { get; set; } = string.Empty;
public string Issuer { get; set; } = "http://localhost:5155";
public string Audience { get; set; } = "TenWholeYears";
public int ExpiryMinutes { get; set; } = 60;
}

89
RecNet.Infrastructure/Services/Tokens/TokenService.cs Normal file
View File

@@ -0,0 +1,89 @@
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
using RecNet.Domain.Entities.Profiles;
using RecNet.Domain.Services.Tokens;
namespace RecNet.Infrastructure.Services.Tokens;
public class TokenService(IOptions<JwtOptions> options) : ITokenService
{
public TokenResult GenerateProfileToken(Profile profile)
{
var jwtOptions = options.Value;
if (string.IsNullOrWhiteSpace(jwtOptions.Secret))
throw new InvalidOperationException("JWT secret is not configured.");
var expiresAt = DateTimeOffset.UtcNow.AddMinutes(jwtOptions.ExpiryMinutes);
var signingCredentials = new SigningCredentials(
CreateSecurityKey(jwtOptions),
SecurityAlgorithms.HmacSha256);
var claims = new List<Claim>
{
new(JwtRegisteredClaimNames.Sub, profile.ProfileId.ToString()),
new("rn.plat", ((int)profile.Platform).ToString()),
new("rn.platid", profile.PlatformId)
};
if (profile.IsModerator)
claims.Add(new Claim(ClaimTypes.Role, "moderator"));
var token = new JwtSecurityToken(
issuer: jwtOptions.Issuer,
audience: jwtOptions.Audience,
claims: claims,
expires: expiresAt.UtcDateTime,
signingCredentials: signingCredentials);
return new TokenResult(
new JwtSecurityTokenHandler().WriteToken(token),
jwtOptions.ExpiryMinutes * 60);
}
public TokenVerifyResult VerifyToken(string token)
{
var jwtOptions = options.Value;
if (string.IsNullOrWhiteSpace(jwtOptions.Secret))
throw new InvalidOperationException("JWT secret is not configured.");
if (string.IsNullOrWhiteSpace(token))
return TokenVerifyResult.Failure();
var tokenHandler = new JwtSecurityTokenHandler();
if (!tokenHandler.CanReadToken(token))
return TokenVerifyResult.Failure();
var validationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = CreateSecurityKey(jwtOptions),
ValidateIssuer = true,
ValidIssuer = jwtOptions.Issuer,
ValidateAudience = true,
ValidAudience = jwtOptions.Audience,
ValidateLifetime = true,
ClockSkew = TimeSpan.FromMinutes(1)
};
try
{
var principal = tokenHandler.ValidateToken(token, validationParameters, out _);
return TokenVerifyResult.Success(principal.Claims);
}
catch (SecurityTokenException)
{
return TokenVerifyResult.Failure();
}
catch (ArgumentException)
{
return TokenVerifyResult.Failure();
}
}
private static SymmetricSecurityKey CreateSecurityKey(JwtOptions jwtOptions)
=> new(Encoding.UTF8.GetBytes(jwtOptions.Secret));
}