127 lines
4.0 KiB
C#
127 lines
4.0 KiB
C#
using Microsoft.AspNetCore.Authentication.JwtBearer;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using Microsoft.IdentityModel.Tokens;
|
|
using Scalar.AspNetCore;
|
|
using System.Text;
|
|
using System.Text.Json.Serialization;
|
|
using Tiku.Api.Middleware;
|
|
using Tiku.Api.OpenApi;
|
|
using Tiku.Api.Security;
|
|
using Tiku.Application;
|
|
using Tiku.Application.Security;
|
|
using Tiku.Infrastructure;
|
|
using Tiku.Infrastructure.Persistence;
|
|
|
|
var builder = WebApplication.CreateBuilder(args);
|
|
|
|
builder.Services.AddControllers()
|
|
.AddJsonOptions(options =>
|
|
{
|
|
options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
|
|
});
|
|
builder.Services.AddOpenApi(options =>
|
|
{
|
|
options.AddDocumentTransformer<BearerSecuritySchemeTransformer>();
|
|
});
|
|
builder.Services.AddProblemDetails();
|
|
builder.Services.AddApplication();
|
|
|
|
var connectionString =
|
|
builder.Configuration.GetConnectionString("Database") ??
|
|
builder.Configuration["DATABASE_URL"] ??
|
|
"Host=localhost;Database=tiku;Username=postgres";
|
|
|
|
builder.Services.AddInfrastructure(connectionString);
|
|
|
|
builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection("Security:Jwt"));
|
|
var jwtOptions = builder.Configuration
|
|
.GetSection("Security:Jwt")
|
|
.Get<JwtOptions>() ?? new JwtOptions();
|
|
|
|
builder.Services
|
|
.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
|
|
.AddJwtBearer(options =>
|
|
{
|
|
options.TokenValidationParameters = new TokenValidationParameters
|
|
{
|
|
ValidateIssuer = true,
|
|
ValidIssuer = jwtOptions.Issuer,
|
|
ValidateAudience = true,
|
|
ValidAudience = jwtOptions.Audience,
|
|
ValidateIssuerSigningKey = true,
|
|
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtOptions.SigningKey)),
|
|
ValidateLifetime = true,
|
|
ClockSkew = TimeSpan.FromMinutes(1)
|
|
};
|
|
options.Events = new JwtBearerEvents
|
|
{
|
|
OnTokenValidated = async context =>
|
|
{
|
|
if (!jwtOptions.ValidateSessions)
|
|
{
|
|
return;
|
|
}
|
|
|
|
var sessionIdValue = context.Principal?.FindFirst(TikuClaimTypes.SessionId)?.Value;
|
|
if (!Guid.TryParse(sessionIdValue, out var sessionId))
|
|
{
|
|
context.Fail("Missing session claim.");
|
|
return;
|
|
}
|
|
|
|
var dbContext = context.HttpContext.RequestServices.GetRequiredService<TikuDbContext>();
|
|
var now = DateTimeOffset.UtcNow;
|
|
var isSessionActive = await dbContext.AuthSessions.AnyAsync(
|
|
session =>
|
|
session.Id == sessionId &&
|
|
session.RevokedAt == null &&
|
|
session.ExpiresAt > now);
|
|
|
|
if (!isSessionActive)
|
|
{
|
|
context.Fail("Session has been revoked or expired.");
|
|
}
|
|
}
|
|
};
|
|
});
|
|
|
|
builder.Services.AddAuthorization(options =>
|
|
{
|
|
options.AddPolicy(
|
|
TikuPolicies.AuthenticatedUser,
|
|
policy => policy.RequireAuthenticatedUser());
|
|
options.AddPolicy(
|
|
TikuPolicies.CurrentTenantMember,
|
|
policy => policy
|
|
.RequireAuthenticatedUser()
|
|
.RequireAssertion(context => TenantRoleAuthorization.IsTenantMember(context.User)));
|
|
options.AddPolicy(
|
|
TikuPolicies.TenantAdmin,
|
|
policy => policy
|
|
.RequireAuthenticatedUser()
|
|
.RequireAssertion(context => TenantRoleAuthorization.IsTenantAdmin(context.User)));
|
|
});
|
|
|
|
var app = builder.Build();
|
|
|
|
if (app.Environment.IsDevelopment())
|
|
{
|
|
app.MapOpenApi();
|
|
app.MapScalarApiReference(options => options
|
|
.WithTitle("TIKU Backend API")
|
|
.AddPreferredSecuritySchemes("BearerAuth")
|
|
.EnablePersistentAuthentication());
|
|
}
|
|
|
|
app.UseMiddleware<ExceptionHandlingMiddleware>();
|
|
app.UseHttpsRedirection();
|
|
app.UseAuthentication();
|
|
app.UseMiddleware<CurrentPrincipalMiddleware>();
|
|
app.UseAuthorization();
|
|
|
|
app.MapControllers();
|
|
|
|
app.Run();
|
|
|
|
public partial class Program;
|