Revize c349bab3

Backend - JWT Authentication done

.gitignore

@@ -479 +479 @@
 
 # Android studio 3.1+ serialized cache file
 .idea/caches/build_file_checksums.ser
+.idea

Backend/Backend/Authentication/AuthorizationAttribute.cs

@@ +1 @@
+using Core.Entities;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace RestAPI.Authentication;
+
+[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+public class AuthorizeAttribute : Attribute, IAuthorizationFilter
+{
+    public void OnAuthorization(AuthorizationFilterContext context)
+    {
+        // skip authorization if action is decorated with [AllowAnonymous] attribute
+        var allowAnonymous = context.ActionDescriptor.EndpointMetadata.OfType<AllowAnonymousAttribute>().Any();
+        if (allowAnonymous)
+            return;
+
+        // authorization
+        var user = (User?) context.HttpContext.Items["User"];
+        if (user == null)
+            context.Result = new JsonResult(new {message = "Unauthorized"})
+                {StatusCode = StatusCodes.Status401Unauthorized};
+    }
+}

Backend/Backend/Controllers/AuthController.cs

@@ +1 @@
+using System.Net;
+using System.Security.Authentication;
+using Core.Entities;
+using Core.Services;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Models.Authentication;
+using RestAPI.Controllers.Common;
+
+namespace RestAPI.Controllers;
+
+public class AuthController : CommonControllerBase
+{
+    private readonly IAuthService authService;
+
+    public AuthController(IAuthService authService)
+    {
+        this.authService = authService;
+    }
+
+
+    [AllowAnonymous]
+    [HttpPost("/auth/login")]
+    [ProducesResponseType((int) HttpStatusCode.OK, Type = typeof(LoginResponse))]
+    [ProducesResponseType((int) HttpStatusCode.Forbidden)]
+    public ActionResult<LoginResponse> Login([FromBody] LoginRequest loginData)
+    {
+        try
+        {
+            var loginResponse = authService.Login(loginData.Username, loginData.Password);
+            if (loginResponse == null)
+            {
+                return Forbid();
+            }
+            else
+            {
+                return Ok(loginResponse);
+            }
+        }
+        catch (InvalidCredentialException)
+        {
+            return Forbid();
+        }
+        catch (Exception)
+        {
+            return Problem();
+        }
+    }
+
+    [HttpGet("/auth/test")]
+    [ProducesResponseType((int) HttpStatusCode.OK, Type = typeof(User))]
+    [ProducesResponseType((int) HttpStatusCode.Forbidden)]
+    public ActionResult<User> TestLogged([FromServices] User loggedUser)
+    {
+        return loggedUser;
+    }
+}

Backend/Backend/Controllers/Common/CommonControllerBase.cs

@@ +1 @@
+using Microsoft.AspNetCore.Mvc;
+using RestAPI.Authentication;
+
+namespace RestAPI.Controllers.Common;
+
+[ApiController]
+[Authorize]
+public abstract class CommonControllerBase : ControllerBase
+{
+}

Backend/Backend/Middleware/JwtMiddleware.cs

@@ +1 @@
+using Core.Authentication;
+using Core.Services;
+using Microsoft.Extensions.Options;
+
+namespace RestAPI.Middleware;
+
+public class JwtMiddleware
+{
+    private readonly RequestDelegate _next;
+    private readonly JwtConfig _jwtConfig;
+
+    public JwtMiddleware(RequestDelegate next, IOptions<JwtConfig> jwtConfigOptions)
+    {
+        _next = next;
+        _jwtConfig = jwtConfigOptions.Value;
+    }
+
+    public async Task Invoke(HttpContext context, IUserService userService, IJwtUtils jwtUtils)
+    {
+        var token = context.Request.Headers["Authorization"].FirstOrDefault()?.Split(" ").Last();
+        var userId = jwtUtils.ValidateJwtToken(token);
+        if (userId != null)
+        {
+            // attach user to context on successful jwt validation
+            context.Items["User"] = userService.GetUserById(userId.Value);
+        }
+
+        await _next(context);
+    }
+}

Backend/Backend/Program.cs

@@ -1 +1 @@
 using System.Text.Json.Serialization;
+using Core.Authentication;
 using Core.Contexts;
+using Core.Entities;
 using Core.Seeding;
 using Core.Services;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.EntityFrameworkCore;
 using Microsoft.OpenApi.Models;
+using RestAPI.Middleware;
 using Serilog;
 
-
 var builder = WebApplication.CreateBuilder(args);
 
 // Logging
@@ -28 +32 @@
         new OpenApiInfo {Title = "AnnotationTool", Description = "KIV/ASWI ZČU Plzeň, 2022", Version = "0.1.1"});
 });
 
+// JWT authentication
+var tokenValidationParams = JwtUtils.GetTokenValidationParameters(builder.Configuration);
+builder.Services.AddSingleton(tokenValidationParams);
+builder.Services.Configure<JwtConfig>(builder.Configuration.GetSection("JwtConfig"));
+builder.Services.AddAuthentication(options =>
+    {
+        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
+        options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
+        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
+    })
+    .AddJwtBearer(jwt =>
+        {
+            jwt.SaveToken = true;
+            jwt.TokenValidationParameters = tokenValidationParams;
+        }
+    );
+
+builder.Services.AddHttpContextAccessor();
+builder.Services.AddScoped<User>(provider =>
+    ((User?) provider.GetRequiredService<IHttpContextAccessor>().HttpContext?.Items["User"]));
+
 // Database
 builder.Services.AddDbContext<DatabaseContext>();
 
@@ -57 +82 @@
     .AllowAnyMethod()
     .AllowCredentials());
 
+// JWT Authentication
+app.UseMiddleware<JwtMiddleware>();
+
+/*
+app.UseAuthentication();
 app.UseAuthorization();
+*/
+
 
 app.MapControllers();
 
@@ -87 +119 @@
         // In production we seed administrator 
         Seeder.SeedProduction(context);
     }
-
 }
 
-app.Run();
+app.Run();

Backend/Backend/RestAPI.csproj

@@ -9 +9 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="6.0.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -22 +23 @@
 
   <ItemGroup>
     <ProjectReference Include="..\Core\Core.csproj" />
+    <ProjectReference Include="..\Models\Models.csproj" />
   </ItemGroup>
 
   <ItemGroup>

Backend/Backend/appsettings.json

@@ -6 +6 @@
     }
   },
   "AllowedHosts": "*",
-  "ConnectionString": "Host=localhost:5432;Database=dbo;Username=myuser;Password=password"
+  "ConnectionString": "Host=localhost:5432;Database=dbo;Username=myuser;Password=password",
+  "JwtConfig": {
+    "Secret": "CJgvc9BtwJjnCExzKLB2ndtxERW3YMhqMMPNrBZuTJaskPqRVfZQHRUnbRHH9Ekp5zsaTSeM73vQSKvq48w2u8jTnKUn7Uhk2zBeD9wLz48ssKMppNC9HDTXSk6RWP5PtXfCayJ67mbUWF6aknnteLg4sDKzqYeNYjyw8Jk6",
+    "Issuer": "0x00.server"
+  }
 }

Backend/Core/Authentication/JwtConfig.cs

@@ +1 @@
+namespace Core.Authentication;
+
+public class JwtConfig
+{
+    public string Secret { get; set; }
+    public string Issuer { get; set; }
+}
+

Backend/Core/Authentication/JwtUtils.cs

@@ +1 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Core.Entities;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Core.Authentication;
+
+public interface IJwtUtils
+{
+    public string GenerateJwtToken(User user, DateTime? expiration = null);
+    public Guid? ValidateJwtToken(string token);
+}
+
+public class JwtUtils : IJwtUtils
+{
+    private const int EXPIRATION_SECONDS = 8 * 60 * 60; // 8 hod
+
+    private readonly JwtConfig _jwtConfig;
+    private readonly TokenValidationParameters _tokenValidationParameters;
+
+    public JwtUtils(IOptions<JwtConfig> jwtConfig, TokenValidationParameters tokenValidationParameters)
+    {
+        _jwtConfig = jwtConfig.Value;
+        _tokenValidationParameters = tokenValidationParameters;
+    }
+
+    public static TokenValidationParameters GetTokenValidationParameters(ConfigurationManager configuration)
+    {
+        return new TokenValidationParameters
+        {
+            RequireExpirationTime = true,
+            ValidateIssuerSigningKey = false,
+            IssuerSigningKey =
+                new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["JwtConfig:Secret"])),
+            ValidateIssuer = false,
+            ValidIssuer = configuration["JwtConfig:Issuer"],
+            ValidateAudience = false,
+            ValidateLifetime = true
+        };
+    }
+
+
+    public string GenerateJwtToken(User user, DateTime? expiration = null)
+    {
+        expiration ??= DateTime.Now.AddHours(10);
+
+        var tokenHandler = new JwtSecurityTokenHandler();
+        var key = Encoding.ASCII.GetBytes(_jwtConfig.Secret);
+        var tokenDescriptor = new SecurityTokenDescriptor
+        {
+            Subject = new ClaimsIdentity(new[] {new Claim("id", user.Id.ToString())}),
+            Expires = expiration,
+            SigningCredentials =
+                new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
+        };
+        var token = tokenHandler.CreateToken(tokenDescriptor);
+        return tokenHandler.WriteToken(token);
+    }
+
+    public Guid? ValidateJwtToken(string? token)
+    {
+        if (token == null)
+            return null;
+
+        var tokenHandler = new JwtSecurityTokenHandler();
+        var key = Encoding.ASCII.GetBytes(_jwtConfig.Secret);
+        try
+        {
+            tokenHandler.ValidateToken(token, _tokenValidationParameters, out SecurityToken validatedToken);
+
+            var jwtToken = (JwtSecurityToken) validatedToken;
+            var userId = Guid.Parse(jwtToken.Claims.First(x => x.Type == "id").Value);
+
+            // return user id from JWT token if validation successful
+            return userId;
+        }
+        catch
+        {
+            // return null if validation fails
+            return null;
+        }
+    }
+}

Backend/Core/Core.csproj

@@ -14 +14 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="6.10.0" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="6.0.3" />
     <PackageReference Include="Serilog" Version="2.10.0" />
     <PackageReference Include="Serilog.AspNetCore" Version="5.0.0" />
     <PackageReference Include="Serilog.Sinks.Console" Version="4.0.1" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="6.10.0" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Models\Models.csproj" />
   </ItemGroup>
 
 </Project>

Backend/Core/Services/AuthService/AuthService.cs

@@ +1 @@
+using Core.Authentication;
+using Core.Entities;
+using Models.Authentication;
+
+namespace Core.Services;
+
+public class AuthService : IAuthService
+{
+    private readonly IUserService userService;
+    private readonly IJwtUtils jwtUtils;
+
+    public AuthService(IUserService userService, IJwtUtils jwtUtils)
+    {
+        this.userService = userService;
+        this.jwtUtils = jwtUtils;
+    }
+
+    public LoginResponse? Login(string username, string password)
+    {
+        var user = userService.CheckUsernamePassword(username, password);
+
+        if (user == null)
+        {
+            // user with given credentials not found
+            return null;
+        }
+
+        var expiration = DateTime.Now.AddHours(12);
+        var token = jwtUtils.GenerateJwtToken(user, expiration);
+
+        var loginResult = new LoginResponse(true, token, expiration);
+
+        return loginResult;
+    }
+}

Backend/Core/Services/AuthService/IAuthService.cs

@@ +1 @@
+using Core.Entities;
+using Models.Authentication;
+
+namespace Core.Services;
+
+public interface IAuthService
+{
+    public LoginResponse? Login(string username, string password);
+}

Backend/Core/Services/Registration.cs

@@ -1 @@
-using Microsoft.AspNetCore.Builder;
+using Core.Authentication;
+using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.DependencyInjection;
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using System.Threading.Tasks;
 
 namespace Core.Services
 {
@@ -13 +9 @@
         public static void RegisterServices(WebApplicationBuilder builder)
         {
             builder.Services.AddScoped<IUserService, UserServiceEF>();
+            builder.Services.AddScoped<IAuthService, AuthService>();
+            
+            builder.Services.AddScoped<IJwtUtils, JwtUtils>();
         }
     }
-}
+}

Backend/Core/Services/UserService/IUserService.cs

@@ -12 +12 @@
     {
         public User? CreateUser(string username, string name, string surname, string password, ERole role);
         public User? GetUserByUsername(string username);
-        public User? GetUserByGuid(Guid id);
+        public User? GetUserById(Guid id);
         public User UpdateUser(User user, string? username = null, string? name = null, string? surname = null, ERole? role = null);
         public User ChangePassword(User user, string newPassword);
         public User? CheckUsernamePassword(string username, string password);

Backend/Core/Services/UserService/UserServiceEF.cs

@@ -44 +44 @@
                 User u = _databaseContext.Users.First(u => u.Username == username);
                 if (!BCrypt.Net.BCrypt.Verify(password, u.Password))
                 {
-                    _logger.Information($"Password for user {username} don't match.");
+                    _logger.Information($"Password for user {username} doesn't match.");
                     return null;
                 }
                 return u;
@@ -93 +93 @@
             }
         }
 
-        public User? GetUserByGuid(Guid id)
+        public User? GetUserById(Guid id)
         {
             try
             {

Backend/Models/Authentication/LoginRequest.cs

@@ +1 @@
+namespace Models.Authentication;
+
+public class LoginRequest
+{
+    public string Username { get; set; }
+    public string Password { get; set; }
+}   

Backend/Models/Authentication/LoginResponse.cs

@@ +1 @@
+namespace Models.Authentication;
+
+public class LoginResponse
+{
+    public LoginResponse(bool ok, string token, DateTime expiration)
+    {
+        Ok = ok;
+        Token = token;
+        Expiration = expiration;
+    }
+
+    public LoginResponse()
+    {
+    }
+
+    public bool Ok { get; set; }
+    public string Token { get; set; }
+    public DateTime Expiration { get; set; }
+}

webapp/.idea/.gitignore

@@ -1 @@
-# Default ignored files
-/shelf/
-/workspace.xml
-# Editor-based HTTP Client requests
-/httpRequests/

webapp/.idea/codeStyles/Project.xml

@@ -1 @@
-<component name="ProjectCodeStyleConfiguration">
-  <code_scheme name="Project" version="173">
-    <HTMLCodeStyleSettings>
-      <option name="HTML_SPACE_INSIDE_EMPTY_TAG" value="true" />
-      <option name="HTML_QUOTE_STYLE" value="Single" />
-      <option name="HTML_ENFORCE_QUOTES" value="true" />
-    </HTMLCodeStyleSettings>
-    <JSCodeStyleSettings version="0">
-      <option name="FORCE_SEMICOLON_STYLE" value="true" />
-      <option name="SPACE_BEFORE_FUNCTION_LEFT_PARENTH" value="false" />
-      <option name="USE_DOUBLE_QUOTES" value="false" />
-      <option name="FORCE_QUOTE_STYlE" value="true" />
-      <option name="ENFORCE_TRAILING_COMMA" value="WhenMultiline" />
-      <option name="SPACES_WITHIN_OBJECT_LITERAL_BRACES" value="true" />
-      <option name="SPACES_WITHIN_IMPORTS" value="true" />
-    </JSCodeStyleSettings>
-    <TypeScriptCodeStyleSettings version="0">
-      <option name="FORCE_SEMICOLON_STYLE" value="true" />
-      <option name="SPACE_BEFORE_FUNCTION_LEFT_PARENTH" value="false" />
-      <option name="USE_DOUBLE_QUOTES" value="false" />
-      <option name="FORCE_QUOTE_STYlE" value="true" />
-      <option name="ENFORCE_TRAILING_COMMA" value="WhenMultiline" />
-      <option name="SPACES_WITHIN_OBJECT_LITERAL_BRACES" value="true" />
-      <option name="SPACES_WITHIN_IMPORTS" value="true" />
-    </TypeScriptCodeStyleSettings>
-    <VueCodeStyleSettings>
-      <option name="INTERPOLATION_NEW_LINE_AFTER_START_DELIMITER" value="false" />
-      <option name="INTERPOLATION_NEW_LINE_BEFORE_END_DELIMITER" value="false" />
-    </VueCodeStyleSettings>
-    <codeStyleSettings language="HTML">
-      <option name="SOFT_MARGINS" value="90" />
-      <indentOptions>
-        <option name="CONTINUATION_INDENT_SIZE" value="4" />
-      </indentOptions>
-    </codeStyleSettings>
-    <codeStyleSettings language="JavaScript">
-      <option name="SOFT_MARGINS" value="90" />
-    </codeStyleSettings>
-    <codeStyleSettings language="TypeScript">
-      <option name="SOFT_MARGINS" value="90" />
-    </codeStyleSettings>
-    <codeStyleSettings language="Vue">
-      <option name="SOFT_MARGINS" value="90" />
-      <indentOptions>
-        <option name="INDENT_SIZE" value="4" />
-        <option name="TAB_SIZE" value="4" />
-      </indentOptions>
-    </codeStyleSettings>
-  </code_scheme>
-</component>

webapp/.idea/codeStyles/codeStyleConfig.xml

@@ -1 @@
-<component name="ProjectCodeStyleConfiguration">
-  <state>
-    <option name="USE_PER_PROJECT_SETTINGS" value="true" />
-  </state>
-</component>

webapp/.idea/inspectionProfiles/Project_Default.xml

@@ -1 @@
-<component name="InspectionProjectProfileManager">
-  <profile version="1.0">
-    <option name="myName" value="Project Default" />
-    <inspection_tool class="Eslint" enabled="true" level="WARNING" enabled_by_default="true" />
-  </profile>
-</component>

webapp/.idea/modules.xml

@@ -1 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="ProjectModuleManager">
-    <modules>
-      <module fileurl="file://$PROJECT_DIR$/.idea/webapp.iml" filepath="$PROJECT_DIR$/.idea/webapp.iml" />
-    </modules>
-  </component>
-</project>

webapp/.idea/prettier.xml

@@ -1 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="PrettierConfiguration">
-    <option name="myRunOnSave" value="true" />
-    <option name="myRunOnReformat" value="true" />
-  </component>
-</project>

webapp/.idea/vcs.xml

@@ -1 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="VcsDirectoryMappings">
-    <mapping directory="$PROJECT_DIR$/.." vcs="Git" />
-  </component>
-</project>

webapp/.idea/webapp.iml

@@ -1 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module type="WEB_MODULE" version="4">
-  <component name="NewModuleRootManager">
-    <content url="file://$MODULE_DIR$">
-      <excludeFolder url="file://$MODULE_DIR$/temp" />
-      <excludeFolder url="file://$MODULE_DIR$/.tmp" />
-      <excludeFolder url="file://$MODULE_DIR$/tmp" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>