🔊 Logging auth flow

DysonNetwork.Pass/Auth/Auth.cs

@@ -1,13 +1,8 @@
 using System.Security.Claims;
-using System.Security.Cryptography;
 using System.Text.Encodings.Web;
-using DysonNetwork.Pass.Account;
 using Microsoft.AspNetCore.Authentication;
-using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Options;
-using DysonNetwork.Pass.Auth.OidcProvider.Services;
 using DysonNetwork.Pass.Handlers;
-using DysonNetwork.Pass.Wallet;
 using DysonNetwork.Shared.Cache;
 using SystemClock = NodaTime.SystemClock;
 
@@ -38,19 +33,13 @@ public class DysonTokenAuthOptions : AuthenticationSchemeOptions;
 
 public class DysonTokenAuthHandler(
     IOptionsMonitor<DysonTokenAuthOptions> options,
-    IConfiguration configuration,
     ILoggerFactory logger,
     UrlEncoder encoder,
-    AppDatabase database,
-    OidcProviderService oidc,
-    SubscriptionService subscriptions,
-    ICacheService cache,
+    AuthService authService,
     FlushBufferService fbs
 )
     : AuthenticationHandler<DysonTokenAuthOptions>(options, logger, encoder)
 {
-    public const string AuthCachePrefix = "auth:";
-
     protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
     {
         var tokenInfo = _ExtractToken(Request);
@@ -60,48 +49,9 @@ public class DysonTokenAuthHandler(
 
         try
         {
-            var now = SystemClock.Instance.GetCurrentInstant();
-
-            // Validate token and extract session ID
-            if (!ValidateToken(tokenInfo.Token, out var sessionId))
-                return AuthenticateResult.Fail("Invalid token.");
-
-            // Try to get session from cache first
-            var session = await cache.GetAsync<AuthSession>($"{AuthCachePrefix}{sessionId}");
-
-            // If not in cache, load from database
-            if (session is null)
-            {
-                session = await database.AuthSessions
-                    .Where(e => e.Id == sessionId)
-                    .Include(e => e.Challenge)
-                    .ThenInclude(e => e.Client)
-                    .Include(e => e.Account)
-                    .ThenInclude(e => e.Profile)
-                    .FirstOrDefaultAsync();
-
-                if (session is not null)
-                {
-                    var perk = await subscriptions.GetPerkSubscriptionAsync(session.AccountId);
-                    session.Account.PerkSubscription = perk?.ToReference();
-
-                    // Store in cache for future requests
-                    await cache.SetWithGroupsAsync(
-                        $"auth:{sessionId}",
-                        session,
-                        [$"{AccountService.AccountCachePrefix}{session.Account.Id}"],
-                        TimeSpan.FromHours(1)
-                    );
-                }
-            }
-
-            // Check if the session exists
-            if (session == null)
-                return AuthenticateResult.Fail("Session not found.");
-
-            // Check if the session is expired
-            if (session.ExpiredAt.HasValue && session.ExpiredAt.Value < now)
-                return AuthenticateResult.Fail("Session expired.");
+            var (valid, session, message) = await authService.AuthenticateTokenAsync(tokenInfo.Token);
+            if (!valid || session is null)
+                return AuthenticateResult.Fail(message ?? "Authentication failed.");
 
             // Store user and session in the HttpContext.Items for easy access in controllers
             Context.Items["CurrentUser"] = session.Account;
@@ -145,77 +95,6 @@ public class DysonTokenAuthHandler(
         }
     }
 
-    private bool ValidateToken(string token, out Guid sessionId)
-    {
-        sessionId = Guid.Empty;
-
-        try
-        {
-            var parts = token.Split('.');
-
-            switch (parts.Length)
-            {
-                // Handle JWT tokens (3 parts)
-                case 3:
-                    {
-                        var (isValid, jwtResult) = oidc.ValidateToken(token);
-                        if (!isValid) return false;
-                        var jti = jwtResult?.Claims.FirstOrDefault(c => c.Type == "jti")?.Value;
-                        if (jti is null) return false;
-
-                        return Guid.TryParse(jti, out sessionId);
-                    }
-                // Handle compact tokens (2 parts)
-                case 2:
-                    // Original compact token validation logic
-                    try
-                    {
-                        // Decode the payload
-                        var payloadBytes = Base64UrlDecode(parts[0]);
-
-                        // Extract session ID
-                        sessionId = new Guid(payloadBytes);
-
-                        // Load public key for verification
-                        var publicKeyPem = File.ReadAllText(configuration["AuthToken:PublicKeyPath"]!);
-                        using var rsa = RSA.Create();
-                        rsa.ImportFromPem(publicKeyPem);
-
-                        // Verify signature
-                        var signature = Base64UrlDecode(parts[1]);
-                        return rsa.VerifyData(payloadBytes, signature, HashAlgorithmName.SHA256,
-                            RSASignaturePadding.Pkcs1);
-                    }
-                    catch
-                    {
-                        return false;
-                    }
-                default:
-                    return false;
-            }
-        }
-        catch (Exception ex)
-        {
-            Logger.LogWarning(ex, "Token validation failed");
-            return false;
-        }
-    }
-
-    private static byte[] Base64UrlDecode(string base64Url)
-    {
-        var padded = base64Url
-            .Replace('-', '+')
-            .Replace('_', '/');
-
-        switch (padded.Length % 4)
-        {
-            case 2: padded += "=="; break;
-            case 3: padded += "="; break;
-        }
-
-        return Convert.FromBase64String(padded);
-    }
-
     private TokenInfo? _ExtractToken(HttpRequest request)
     {
         // Check for token in query parameters