RecRoomArchive/TenWholeYears.Server
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Invalidate JWTs on profile changes

Browse Source
This commit is contained in:
Holden
2026-06-28 12:46:12 -05:00
parent fefa01cf3f
commit e194bbf9c4
15 changed files with 395 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/RecNet.Application/Common/Security/ClaimsPrincipalExtensions.cs
View File

@@ -16,4 +16,15 @@ public static class ClaimsPrincipalExtensions
return profileId;
}
public static Guid GetTokenVersion(this ClaimsPrincipal user)
{
var value = user.FindFirst("token_version")?.Value;
if (!Guid.TryParse(value, out var tokenVersion))
throw new UnauthorizedAccessException(
"Token version claim is missing or invalid.");
return tokenVersion;
}
}

9
src/RecNet.Application/Common/Tokens/TokenVerifyResult.cs
View File

@@ -2,11 +2,12 @@ namespace RecNet.Application.Common.Tokens;
public sealed record TokenVerifyResult(
bool Succeeded,
Guid? ProfileId)
Guid? ProfileId,
Guid? TokenVersion)
{
public static TokenVerifyResult Success(Guid profileId)
=> new(true, profileId);
public static TokenVerifyResult Success(Guid profileId, Guid tokenVersion)
=> new(true, profileId, tokenVersion);
public static TokenVerifyResult Failure()
=> new(false, null);
=> new(false, null, null);
}

5
src/RecNet.Application/Neutrino/NeutrinoAuthorizationService.cs
View File

@@ -15,7 +15,7 @@ public class NeutrinoAuthorizationService(
return NeutrinoAuthorizationResult.InvalidParameters();
var tokenVerifyResult = tokenService.VerifyToken(command.AccessToken);
if (!tokenVerifyResult.Succeeded || tokenVerifyResult.ProfileId is null)
if (!tokenVerifyResult.Succeeded || tokenVerifyResult.ProfileId is null || tokenVerifyResult.TokenVersion is null)
return NeutrinoAuthorizationResult.AuthenticationFailed();
if (tokenVerifyResult.ProfileId.Value != command.ProfileId)
@@ -25,6 +25,9 @@ public class NeutrinoAuthorizationService(
if (profile is null || profile.IsBanned)
return NeutrinoAuthorizationResult.AuthenticationFailed();
if (tokenVerifyResult.TokenVersion.Value != profile.TokenVersion)
return NeutrinoAuthorizationResult.AuthenticationFailed();
return NeutrinoAuthorizationResult.Success(profile.ProfileId, profile.Name);
}
}

10
src/RecNet.Application/Profiles/IProfileService.cs
View File

@@ -7,11 +7,19 @@ namespace RecNet.Application.Profiles;
public interface IProfileService
{
// Profiles
Task<ProfileDTO?> GetProfileAsync(Guid profileId, CancellationToken ct = default);
Task<IReadOnlyList<ProfileDTO>> GetProfilesAsync(List<Guid> profileIds, CancellationToken ct = default);
// Avatar
Task<AvatarDTO?> GetAvatarAsync(Guid profileId, CancellationToken ct = default);
Task<AvatarDTO?> UpdateAvatarAsync(Guid profileId, UpdateAvatarCommand command, CancellationToken ct = default);
// PlayerSettings
Task<IReadOnlyList<PlayerSettingDTO>> GetPlayerSettingsAsync(Guid profileId, CancellationToken ct = default);
Task<bool> UpdatePlayerSettingAsync(Guid profileId, UpdatePlayerSettingCommand command, CancellationToken ct = default);
Task<IReadOnlyList<ProfileDTO>> GetProfilesAsync(List<Guid> profileIds, CancellationToken ct = default);
Task IncrementTokenVersion(Guid profileId, CancellationToken ct = default);
Task<LoginProfileResult> LoginAsync(LoginProfileCommand command, CancellationToken ct = default);
}

25
src/RecNet.Application/Profiles/ProfileService.cs
View File

@@ -30,6 +30,15 @@ public class ProfileService(
: mapper.Map<ProfileDTO>(profile);
}
public async Task<IReadOnlyList<ProfileDTO>> GetProfilesAsync(
List<Guid> profileIds,
CancellationToken ct = default)
{
var profiles = await profileRepository.GetByIdsAsync(profileIds, ct);
return mapper.Map<List<ProfileDTO>>(profiles);
}
public async Task<AvatarDTO?> GetAvatarAsync(Guid profileId, CancellationToken ct = default)
{
var avatar = await profileRepository.GetAvatarByProfileIdAsync(profileId, ct);
@@ -86,13 +95,15 @@ public class ProfileService(
return true;
}
public async Task<IReadOnlyList<ProfileDTO>> GetProfilesAsync(
List<Guid> profileIds,
CancellationToken ct = default)
public async Task IncrementTokenVersion(Guid profileId, CancellationToken ct = default)
{
var profiles = await profileRepository.GetByIdsAsync(profileIds, ct);
return mapper.Map<List<ProfileDTO>>(profiles);
var profile = await profileRepository.GetByIdWithSettingsAsync(profileId, ct);
if (profile is null)
return;
profile.IncrementTokenVersion();
await profileRepository.SaveChangesAsync(ct);
}
public async Task<LoginProfileResult> LoginAsync(
@@ -146,7 +157,7 @@ public class ProfileService(
return LoginProfileResult.Fail("Platform Auth Failed: Invalid authentication");
if (profile.IsBanned)
return LoginProfileResult.Fail("Profile is banned");
return LoginProfileResult.Fail("TenWholeYears requires you to take a shower in order to continue playing.");
profile.RecordSuccessfulLogin(command.DeviceId, auth.Name);