feat: add authorize in OAuth
This commit is contained in:
166
Security/Services/OAuthService.cs
Normal file
166
Security/Services/OAuthService.cs
Normal file
@ -0,0 +1,166 @@
|
||||
using Microsoft.AspNetCore.Http;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Mirea.Api.Security.Common.Domain;
|
||||
using Mirea.Api.Security.Common.Domain.OAuth2;
|
||||
using Mirea.Api.Security.Common.Domain.OAuth2.UserInfo;
|
||||
using Mirea.Api.Security.Common.Interfaces;
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using System.Net.Http;
|
||||
using System.Net.Http.Headers;
|
||||
using System.Security;
|
||||
using System.Text.Json;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
|
||||
namespace Mirea.Api.Security.Services;
|
||||
|
||||
public class OAuthService(ILogger<OAuthService> logger, Dictionary<OAuthProvider, (string ClientId, string Secret)> providers)
|
||||
{
|
||||
private static readonly Dictionary<OAuthProvider, OAuthProviderUrisData> ProviderData = new()
|
||||
{
|
||||
[OAuthProvider.Google] = new OAuthProviderUrisData
|
||||
{
|
||||
RedirectUrl = "https://accounts.google.com/o/oauth2/v2/auth",
|
||||
TokenUrl = "https://oauth2.googleapis.com/token",
|
||||
UserInfoUrl = "https://www.googleapis.com/oauth2/v2/userinfo",
|
||||
Scope = "openid email profile",
|
||||
AuthHeader = "Bearer",
|
||||
UserInfoType = typeof(GoogleUserInfo)
|
||||
},
|
||||
[OAuthProvider.Yandex] = new OAuthProviderUrisData
|
||||
{
|
||||
RedirectUrl = "https://oauth.yandex.ru/authorize",
|
||||
TokenUrl = "https://oauth.yandex.ru/token",
|
||||
UserInfoUrl = "https://login.yandex.ru/info?format=json",
|
||||
Scope = "login:email login:info login:avatar",
|
||||
AuthHeader = "OAuth",
|
||||
UserInfoType = typeof(YandexUserInfo)
|
||||
},
|
||||
[OAuthProvider.MailRu] = new OAuthProviderUrisData
|
||||
{
|
||||
RedirectUrl = "https://oauth.mail.ru/login",
|
||||
TokenUrl = "https://oauth.mail.ru/token",
|
||||
UserInfoUrl = "https://oauth.mail.ru/userinfo",
|
||||
AuthHeader = "",
|
||||
Scope = "",
|
||||
UserInfoType = typeof(MailRuUserInfo)
|
||||
}
|
||||
};
|
||||
|
||||
private static async Task<OAuthTokenResponse?> ExchangeCodeForTokensAsync(string requestUri, string redirectUrl, string code, string clientId, string secret, CancellationToken cancellation)
|
||||
{
|
||||
var tokenRequest = new HttpRequestMessage(HttpMethod.Post, requestUri)
|
||||
{
|
||||
Content = new FormUrlEncodedContent(new Dictionary<string, string>
|
||||
{
|
||||
{ "code", code },
|
||||
{ "client_id", clientId },
|
||||
{ "client_secret", secret },
|
||||
{ "redirect_uri", redirectUrl},
|
||||
{ "grant_type", "authorization_code" }
|
||||
})
|
||||
};
|
||||
|
||||
using var httpClient = new HttpClient();
|
||||
httpClient.DefaultRequestHeaders.UserAgent.ParseAdd("MireaSchedule/1.0 (Winsomnia)");
|
||||
|
||||
var response = await httpClient.SendAsync(tokenRequest, cancellation);
|
||||
var data = await response.Content.ReadAsStringAsync(cancellation);
|
||||
|
||||
if (!response.IsSuccessStatusCode)
|
||||
throw new HttpRequestException(data);
|
||||
|
||||
return JsonSerializer.Deserialize<OAuthTokenResponse>(data);
|
||||
}
|
||||
|
||||
private static async Task<OAuthUser?> GetUserProfileAsync(string requestUri, string authHeader, string accessToken, OAuthProvider provider, CancellationToken cancellation)
|
||||
{
|
||||
var request = new HttpRequestMessage(HttpMethod.Get, requestUri);
|
||||
|
||||
if (string.IsNullOrEmpty(authHeader))
|
||||
request.RequestUri = new Uri(request.RequestUri?.AbsoluteUri + "?access_token=" + accessToken);
|
||||
else
|
||||
request.Headers.Authorization = new AuthenticationHeaderValue(authHeader, accessToken);
|
||||
|
||||
using var httpClient = new HttpClient();
|
||||
httpClient.DefaultRequestHeaders.UserAgent.ParseAdd("MireaSchedule/1.0 (Winsomnia)");
|
||||
|
||||
var response = await httpClient.SendAsync(request, cancellation);
|
||||
var data = await response.Content.ReadAsStringAsync(cancellation);
|
||||
|
||||
if (!response.IsSuccessStatusCode)
|
||||
throw new HttpRequestException(data);
|
||||
|
||||
var userInfo = JsonSerializer.Deserialize(data, ProviderData[provider].UserInfoType) as IUserInfo;
|
||||
return userInfo?.MapToInternalUser();
|
||||
}
|
||||
|
||||
public (OAuthProvider Provider, Uri Redirect)[] GetAvailableProviders(HttpContext context, CookieOptionsParameters cookieOptions, string redirectUrl)
|
||||
{
|
||||
var redirectUri = "?client_id={0}" +
|
||||
"&response_type=code" +
|
||||
$"&redirect_uri={redirectUrl}" +
|
||||
"&scope={1}" +
|
||||
$"&state={new RequestContextInfo(context, cookieOptions).Fingerprint}_{{2}}";
|
||||
|
||||
return providers.Select(x => (x.Key, new Uri(ProviderData[x.Key].RedirectUrl.TrimEnd('/') +
|
||||
string.Format(redirectUri,
|
||||
x.Value.ClientId,
|
||||
ProviderData[x.Key].Scope,
|
||||
Enum.GetName(x.Key))))
|
||||
).ToArray();
|
||||
}
|
||||
|
||||
public async Task<(OAuthProvider provider, OAuthUser User)> LoginOAuth(HttpContext context, CookieOptionsParameters cookieOptions, string redirectUrl, string code, string state, CancellationToken cancellation = default)
|
||||
{
|
||||
var requestContext = new RequestContextInfo(context, cookieOptions);
|
||||
|
||||
var partsState = state.Split('_');
|
||||
|
||||
if (!Enum.TryParse<OAuthProvider>(partsState.Last(), true, out var provider) ||
|
||||
!providers.TryGetValue(provider, out var providerInfo) ||
|
||||
!ProviderData.TryGetValue(provider, out var currentProviderStruct))
|
||||
{
|
||||
logger.LogWarning("Failed to parse OAuth provider from state: {State}", state);
|
||||
throw new InvalidOperationException("Invalid authorization request.");
|
||||
}
|
||||
|
||||
var fingerprint = string.Join("_", partsState.SkipLast(1));
|
||||
|
||||
if (requestContext.Fingerprint != fingerprint)
|
||||
{
|
||||
logger.LogWarning("Fingerprint mismatch. Possible CSRF attack detected.");
|
||||
throw new SecurityException("Suspicious activity detected. Please try again.");
|
||||
}
|
||||
|
||||
OAuthTokenResponse? accessToken = null;
|
||||
try
|
||||
{
|
||||
accessToken = await ExchangeCodeForTokensAsync(currentProviderStruct.TokenUrl, redirectUrl, code, providerInfo.ClientId, providerInfo.Secret, cancellation);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
logger.LogWarning(ex, "Failed to exchange authorization code for tokens with provider {Provider}", provider);
|
||||
}
|
||||
|
||||
if (accessToken == null)
|
||||
throw new SecurityException("Unable to complete authorization with the provider. Please try again later.");
|
||||
|
||||
OAuthUser? result = null;
|
||||
try
|
||||
{
|
||||
result = await GetUserProfileAsync(currentProviderStruct.UserInfoUrl, currentProviderStruct.AuthHeader, accessToken.AccessToken, provider, cancellation);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
logger.LogWarning(ex, "Failed to retrieve user information from provider {Provider}", provider);
|
||||
}
|
||||
|
||||
if (result == null)
|
||||
throw new SecurityException("Unable to retrieve user information. Please check the details and try again.");
|
||||
|
||||
return (provider, result);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user