| | | 1 | | using ArturRios.Util.WebApi.Security.Authentication; |
| | | 2 | | using ArturRios.Util.WebApi.Security.Configuration; |
| | | 3 | | using ArturRios.Util.WebApi.Security.Interfaces; |
| | | 4 | | using ArturRios.Util.WebApi.Security.Mappers; |
| | | 5 | | using ArturRios.Util.WebApi.Security.Providers; |
| | | 6 | | using Microsoft.Extensions.Caching.Memory; |
| | | 7 | | using Microsoft.Extensions.DependencyInjection; |
| | | 8 | | using Microsoft.Extensions.DependencyInjection.Extensions; |
| | | 9 | | |
| | | 10 | | namespace ArturRios.Util.WebApi.Security.Extensions; |
| | | 11 | | |
| | | 12 | | /// <summary> |
| | | 13 | | /// Dependency-injection helpers for registering authentication providers. |
| | | 14 | | /// </summary> |
| | | 15 | | public static class AuthenticationServiceCollectionExtensions |
| | | 16 | | { |
| | | 17 | | /// <param name="services">The service collection to register into.</param> |
| | | 18 | | extension(IServiceCollection services) |
| | | 19 | | { |
| | | 20 | | /// <summary> |
| | | 21 | | /// Registers <typeparamref name="TProvider"/> as the underlying <see cref="IAuthenticationProvider"/> and |
| | | 22 | | /// exposes it through a <see cref="CachedAuthenticationProvider"/>, so repeated user lookups within the |
| | | 23 | | /// configured time-to-live are served from an <see cref="IMemoryCache"/> instead of the store. |
| | | 24 | | /// </summary> |
| | | 25 | | /// <typeparam name="TProvider">The concrete provider that performs the actual (e.g. database) lookup.</typepara |
| | | 26 | | /// <param name="configure">Optional callback to configure caching behavior (time-to-live, negative caching).</p |
| | | 27 | | /// <returns>The same <paramref name="services"/> instance, for chaining.</returns> |
| | | 28 | | /// <exception cref="ArgumentOutOfRangeException">The configured time-to-live is not positive.</exception> |
| | | 29 | | public IServiceCollection AddCachedAuthenticationProvider<TProvider>( |
| | | 30 | | Action<CachedAuthenticationProviderOptions>? configure = null) |
| | | 31 | | where TProvider : class, IAuthenticationProvider |
| | | 32 | | { |
| | 2 | 33 | | var options = new CachedAuthenticationProviderOptions(); |
| | 2 | 34 | | configure?.Invoke(options); |
| | | 35 | | |
| | 2 | 36 | | if (options.Ttl <= TimeSpan.Zero) |
| | | 37 | | { |
| | 1 | 38 | | throw new ArgumentOutOfRangeException(nameof(configure), options.Ttl, |
| | 1 | 39 | | "CachedAuthenticationProviderOptions.Ttl must be positive."); |
| | | 40 | | } |
| | | 41 | | |
| | 1 | 42 | | services.AddMemoryCache(); |
| | 1 | 43 | | services.AddScoped<TProvider>(); |
| | | 44 | | |
| | 1 | 45 | | services.AddScoped<IAuthenticationProvider>(serviceProvider => |
| | 2 | 46 | | new CachedAuthenticationProvider( |
| | 2 | 47 | | serviceProvider.GetRequiredService<TProvider>(), |
| | 2 | 48 | | serviceProvider.GetRequiredService<IMemoryCache>(), |
| | 2 | 49 | | options)); |
| | | 50 | | |
| | 1 | 51 | | return services; |
| | | 52 | | } |
| | | 53 | | |
| | | 54 | | /// <summary> |
| | | 55 | | /// Registers the consolidated <see cref="AuthenticationOptions"/>, the enabled token validators, and |
| | | 56 | | /// <see cref="DefaultAuthenticatedUserMapper"/> as the claims mapper, unless an |
| | | 57 | | /// <see cref="IAuthenticatedUserMapper"/> is already registered. Use the generic overload taking a |
| | | 58 | | /// <c>TMapper</c> to supply your own mapper instead. |
| | | 59 | | /// </summary> |
| | | 60 | | /// <param name="configure">Configures the options.</param> |
| | | 61 | | /// <exception cref="ArgumentException">No scheme enabled, or Google enabled without any client IDs.</exception> |
| | | 62 | | public IServiceCollection AddTokenAuthentication(Action<AuthenticationOptions> configure) => |
| | 10 | 63 | | services.AddTokenAuthentication<DefaultAuthenticatedUserMapper>(configure); |
| | | 64 | | |
| | | 65 | | /// <summary> |
| | | 66 | | /// Registers the consolidated <see cref="AuthenticationOptions"/>, the enabled token validators, and |
| | | 67 | | /// <typeparamref name="TMapper"/> as the claims mapper, unless an <see cref="IAuthenticatedUserMapper"/> |
| | | 68 | | /// is already registered. Validators are registered app-JWT first, Google second, so the middleware |
| | | 69 | | /// tries them in that order. The app must separately register <c>JwtConfiguration</c> and |
| | | 70 | | /// <c>JwtHandler</c> (for JWT) and an <see cref="IAuthenticationProvider"/> (required for Google and |
| | | 71 | | /// for JWT <c>Revalidate</c> mode). Calling it again does not register a validator twice. |
| | | 72 | | /// </summary> |
| | | 73 | | /// <typeparam name="TMapper">The mapper translating between the app's user and its token claims.</typeparam> |
| | | 74 | | /// <param name="configure">Configures the options.</param> |
| | | 75 | | /// <exception cref="ArgumentException">No scheme enabled, or Google enabled without any client IDs.</exception> |
| | | 76 | | public IServiceCollection AddTokenAuthentication<TMapper>(Action<AuthenticationOptions> configure) |
| | | 77 | | where TMapper : class, IAuthenticatedUserMapper |
| | | 78 | | { |
| | 11 | 79 | | ArgumentNullException.ThrowIfNull(configure); |
| | | 80 | | |
| | 11 | 81 | | var options = new AuthenticationOptions(); |
| | 11 | 82 | | configure(options); |
| | | 83 | | |
| | 11 | 84 | | if (!options.EnableJwt && !options.EnableGoogle) |
| | | 85 | | { |
| | 1 | 86 | | throw new ArgumentException("At least one authentication scheme (JWT or Google) must be enabled."); |
| | | 87 | | } |
| | | 88 | | |
| | 10 | 89 | | if (options.EnableGoogle && options.GoogleClientIds.Count == 0) |
| | | 90 | | { |
| | 1 | 91 | | throw new ArgumentException("EnableGoogle requires at least one entry in GoogleClientIds."); |
| | | 92 | | } |
| | | 93 | | |
| | 9 | 94 | | services.AddSingleton(options); |
| | 9 | 95 | | services.TryAddSingleton<IAuthenticatedUserMapper, TMapper>(); |
| | | 96 | | |
| | 9 | 97 | | if (options.EnableJwt) |
| | | 98 | | { |
| | 9 | 99 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<ITokenValidator, JwtTokenValidator>()); |
| | | 100 | | } |
| | | 101 | | |
| | 9 | 102 | | if (options.EnableGoogle) |
| | | 103 | | { |
| | 1 | 104 | | services.TryAddSingleton<IGoogleTokenVerifier, GoogleTokenVerifier>(); |
| | 1 | 105 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<ITokenValidator, GoogleTokenValidator>()); |
| | | 106 | | } |
| | | 107 | | |
| | 9 | 108 | | return services; |
| | | 109 | | } |
| | | 110 | | } |
| | | 111 | | } |