| | | 1 | | using Microsoft.AspNetCore.Mvc; |
| | | 2 | | using Microsoft.AspNetCore.Mvc.Filters; |
| | | 3 | | using Microsoft.Extensions.Options; |
| | | 4 | | |
| | | 5 | | namespace OzonOrdersWeb.Api; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Action-фильтр, ограничивающий доступ к endpoint'у импорта выдачи Ozon значением заголовка |
| | | 9 | | /// X-Api-Key, настроенным в OzonHandover:ApiKey. Endpoint вызывается внешним приложением |
| | | 10 | | /// ("Telegram Lite") без пользовательской сессии, поэтому cookie-авторизация не подходит — |
| | | 11 | | /// по аналогии с OzonIpWhitelistFilter для Ozon-вебхука. |
| | | 12 | | /// </summary> |
| | | 13 | | public sealed class OzonHandoverApiKeyFilter : IActionFilter |
| | | 14 | | { |
| | | 15 | | private const string HeaderName = "X-Api-Key"; |
| | | 16 | | |
| | | 17 | | private readonly ILogger<OzonHandoverApiKeyFilter> _logger; |
| | | 18 | | private readonly OzonHandoverOptions _options; |
| | | 19 | | |
| | 3 | 20 | | public OzonHandoverApiKeyFilter(ILogger<OzonHandoverApiKeyFilter> logger, IOptions<OzonHandoverOptions> options) |
| | | 21 | | { |
| | 3 | 22 | | _logger = logger; |
| | 3 | 23 | | _options = options.Value; |
| | 3 | 24 | | } |
| | | 25 | | |
| | | 26 | | public void OnActionExecuting(ActionExecutingContext context) |
| | | 27 | | { |
| | 3 | 28 | | var configuredKey = _options.ApiKey; |
| | 3 | 29 | | var providedKey = context.HttpContext.Request.Headers[HeaderName].ToString(); |
| | | 30 | | |
| | 3 | 31 | | if (string.IsNullOrEmpty(configuredKey) || |
| | 3 | 32 | | string.IsNullOrEmpty(providedKey) || |
| | 3 | 33 | | !FixedTimeEquals(configuredKey, providedKey)) |
| | | 34 | | { |
| | 2 | 35 | | var remoteIp = context.HttpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown"; |
| | 2 | 36 | | _logger.LogInformation("Ozon handover import: запрос отклонён — неверный или отсутствующий {Header} (IP: {Ip |
| | | 37 | | |
| | 2 | 38 | | context.Result = new JsonResult(new { error = "unauthorized" }) |
| | 2 | 39 | | { |
| | 2 | 40 | | StatusCode = StatusCodes.Status401Unauthorized |
| | 2 | 41 | | }; |
| | | 42 | | } |
| | 3 | 43 | | } |
| | | 44 | | |
| | | 45 | | public void OnActionExecuted(ActionExecutedContext context) |
| | | 46 | | { |
| | | 47 | | // Действий после выполнения не требуется |
| | 0 | 48 | | } |
| | | 49 | | |
| | | 50 | | /// <summary>Сравнение без утечки по времени — ключ приходит по HTTP, не полагаемся на String.Equals.</summary> |
| | | 51 | | private static bool FixedTimeEquals(string a, string b) |
| | | 52 | | { |
| | 2 | 53 | | var bytesA = System.Text.Encoding.UTF8.GetBytes(a); |
| | 2 | 54 | | var bytesB = System.Text.Encoding.UTF8.GetBytes(b); |
| | 2 | 55 | | return System.Security.Cryptography.CryptographicOperations.FixedTimeEquals(bytesA, bytesB); |
| | | 56 | | } |
| | | 57 | | } |