| | | 1 | | using ArturRios.Heimdall.Command.Input; |
| | | 2 | | using ArturRios.Heimdall.Command.Output; |
| | | 3 | | using ArturRios.Heimdall.Domain.Enums; |
| | | 4 | | using ArturRios.Heimdall.Query.Input; |
| | | 5 | | using ArturRios.Heimdall.Query.Output; |
| | | 6 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 7 | | using ArturRios.Heimdall.WebApi.Security; |
| | | 8 | | using ArturRios.Mediator.Command; |
| | | 9 | | using ArturRios.Mediator.Query; |
| | | 10 | | using ArturRios.Output; |
| | | 11 | | using ArturRios.Util.WebApi.AspNetCore; |
| | | 12 | | using ArturRios.Util.WebApi.Security.Attributes; |
| | | 13 | | using Microsoft.AspNetCore.Mvc; |
| | | 14 | | using Microsoft.AspNetCore.Mvc.ModelBinding; |
| | | 15 | | |
| | | 16 | | namespace ArturRios.Heimdall.WebApi.Controllers; |
| | | 17 | | |
| | | 18 | | /// <summary> |
| | | 19 | | /// An application's credentials (UC-53…UC-55, FR-AP-10…FR-AP-12): the secrets it exchanges for an |
| | | 20 | | /// application token at <c>POST /api/applications/token</c>. |
| | | 21 | | /// </summary> |
| | | 22 | | /// <remarks> |
| | | 23 | | /// A <c>User</c> can own no application (FR-AP-03) and is refused by the attribute. Among System |
| | | 24 | | /// Admins and Scope Admins the rule is data-dependent and lives in the handlers, through |
| | | 25 | | /// <c>ApplicationManagementAccess</c> — the same rule as reading or renaming the application. |
| | | 26 | | /// </remarks> |
| | | 27 | | [Route("api/scopes/{scopeId:guid}/applications/{id:guid}/credentials")] |
| | 38 | 28 | | public class ApplicationCredentialController(CommandMediator commandMediator, QueryMediator queryMediator) : Controller |
| | | 29 | | { |
| | | 30 | | /// <summary> |
| | | 31 | | /// Issues a credential (UC-53). The body is optional and carries only <c>expiresAt</c>. The |
| | | 32 | | /// answer is the only place the secret ever appears; Heimdall keeps its hash alone. |
| | | 33 | | /// </summary> |
| | | 34 | | [HttpPost] |
| | | 35 | | [RoleRequirement((int)Roles.SystemAdmin, (int)Roles.ScopeAdmin)] |
| | | 36 | | public async Task<ActionResult<DataOutput<IssueApplicationCredentialCommandOutput?>>> Issue( |
| | | 37 | | Guid scopeId, Guid id, |
| | | 38 | | [FromBody(EmptyBodyBehavior = EmptyBodyBehavior.Allow)] IssueApplicationCredentialCommand? command) |
| | | 39 | | { |
| | | 40 | | // AF-53c — a body that is not JSON, or an expiresAt that is not a date-time, never reaches here: |
| | | 41 | | // MalformedRequestFilter answers it (NFR-10). Only a genuinely empty body means "no expiry". |
| | 20 | 42 | | command ??= new IssueApplicationCredentialCommand(); |
| | 20 | 43 | | command.ScopeId = scopeId; |
| | 20 | 44 | | command.Id = id; |
| | 20 | 45 | | HttpContext.ApplyActor(command); |
| | | 46 | | |
| | 20 | 47 | | var result = await commandMediator |
| | 20 | 48 | | .ExecuteCommandAsync<IssueApplicationCredentialCommand, IssueApplicationCredentialCommandOutput>(command); |
| | | 49 | | |
| | 20 | 50 | | return result.ToActionResult(statusMap: ApplicationCredentialMessageMap.StatusCodes); |
| | 20 | 51 | | } |
| | | 52 | | |
| | | 53 | | /// <summary> |
| | | 54 | | /// Lists the application's credentials, newest first, with whether each is live (UC-54). |
| | | 55 | | /// Never a secret or a hash. |
| | | 56 | | /// </summary> |
| | | 57 | | [HttpGet] |
| | | 58 | | [RoleRequirement((int)Roles.SystemAdmin, (int)Roles.ScopeAdmin)] |
| | | 59 | | public async Task<ActionResult<DataOutput<ApplicationCredentialListOutput?>>> List(Guid scopeId, Guid id) |
| | | 60 | | { |
| | 6 | 61 | | var query = new ListApplicationCredentialsQuery { ScopeId = scopeId, Id = id }; |
| | 6 | 62 | | HttpContext.ApplyActor(query); |
| | | 63 | | |
| | 6 | 64 | | var result = await queryMediator |
| | 6 | 65 | | .ExecuteQueryAsync<ListApplicationCredentialsQuery, ApplicationCredentialListOutput>(query); |
| | | 66 | | |
| | 6 | 67 | | return result.ToActionResult(statusMap: ApplicationCredentialMessageMap.StatusCodes); |
| | 6 | 68 | | } |
| | | 69 | | |
| | | 70 | | /// <summary> |
| | | 71 | | /// Revokes one credential (UC-55). Its secret stops being exchanged at once, and every token |
| | | 72 | | /// already issued from it fails the next live re-check (UC-57). |
| | | 73 | | /// </summary> |
| | | 74 | | [HttpDelete("{credentialId:guid}")] |
| | | 75 | | [RoleRequirement((int)Roles.SystemAdmin, (int)Roles.ScopeAdmin)] |
| | | 76 | | public async Task<ActionResult<DataOutput<RevokeApplicationCredentialCommandOutput?>>> Revoke( |
| | | 77 | | Guid scopeId, Guid id, Guid credentialId) |
| | | 78 | | { |
| | 9 | 79 | | var command = new RevokeApplicationCredentialCommand { ScopeId = scopeId, Id = id, CredentialId = credentialId } |
| | 9 | 80 | | HttpContext.ApplyActor(command); |
| | | 81 | | |
| | 9 | 82 | | var result = await commandMediator |
| | 9 | 83 | | .ExecuteCommandAsync<RevokeApplicationCredentialCommand, RevokeApplicationCredentialCommandOutput>(command); |
| | | 84 | | |
| | 9 | 85 | | return result.ToActionResult(statusMap: ApplicationCredentialMessageMap.StatusCodes); |
| | 9 | 86 | | } |
| | | 87 | | } |