| | | 1 | | using ArturRios.Heimdall.Command.Services; |
| | | 2 | | |
| | | 3 | | namespace ArturRios.Heimdall.WebApi.Security; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// The <see cref="IGoogleIdTokenVerifier" /> a deployment with no Google client configured runs |
| | | 7 | | /// with: it refuses every token, so UC-25 answers <c>401</c> (AF-25a) rather than accepting one |
| | | 8 | | /// no one checked. |
| | | 9 | | /// </summary> |
| | | 10 | | /// <remarks> |
| | | 11 | | /// The refusing default is the point. Verification needs an audience to check against (NFR-13), |
| | | 12 | | /// and a verifier with no configured client ID could only either reject everything or trust |
| | | 13 | | /// everything — so it rejects. This differs from the email fallback, which degrades to logging |
| | | 14 | | /// because a missing verification mail is an inconvenience; a missing token check is an open |
| | | 15 | | /// door. Failing start-up instead was the alternative, and it would take the whole API down over |
| | | 16 | | /// one optional feature that a scope must also switch on (FR-GO-01) before it is reachable. |
| | | 17 | | /// </remarks> |
| | 0 | 18 | | public class UnconfiguredGoogleIdTokenVerifier(ILogger<UnconfiguredGoogleIdTokenVerifier> logger) |
| | | 19 | | : IGoogleIdTokenVerifier |
| | | 20 | | { |
| | | 21 | | public Task<GoogleIdTokenPayload?> VerifyAsync(string idToken) |
| | | 22 | | { |
| | 0 | 23 | | logger.LogWarning( |
| | 0 | 24 | | "Google sign-in attempted but no Google client is configured ({Variable}); the token " + |
| | 0 | 25 | | "cannot be verified and is refused", |
| | 0 | 26 | | GoogleSignInOptions.ClientIdsVariable); |
| | | 27 | | |
| | 0 | 28 | | return Task.FromResult<GoogleIdTokenPayload?>(null); |
| | | 29 | | } |
| | | 30 | | } |