| | | 1 | | using System.Security.Claims; |
| | | 2 | | using Microsoft.AspNetCore.Authentication; |
| | | 3 | | using Microsoft.AspNetCore.Authentication.Cookies; |
| | | 4 | | using OzonDomains.Models.Partners; |
| | | 5 | | using Services.PartnerServices; |
| | | 6 | | |
| | | 7 | | namespace OzonOrdersWeb.Extensions; |
| | | 8 | | |
| | | 9 | | /// <summary>Регистрация кабинета партнёров PartnerOffice: сервисы и отдельная cookie-схема партнёра.</summary> |
| | | 10 | | public static class PartnerOfficeExtensions |
| | | 11 | | { |
| | | 12 | | public const string PartnerCookieScheme = "PartnerCookie"; |
| | | 13 | | public const string PartnerRole = "Partner"; |
| | | 14 | | public const string PartnerStampClaim = "partner_stamp"; |
| | | 15 | | public const string SwaggerDocName = "partner"; |
| | | 16 | | |
| | | 17 | | public static IServiceCollection AddPartnerOffice(this IServiceCollection services, bool isProd) |
| | | 18 | | { |
| | 0 | 19 | | services.AddOptions<PartnerOfficeOptions>().Configure<IConfiguration>((options, configuration) => |
| | 0 | 20 | | configuration.GetSection(PartnerOfficeOptions.SectionName).Bind(options)); |
| | 0 | 21 | | services.AddTransient<IPartnerLoginMailer, PartnerLoginMailer>(); |
| | 0 | 22 | | services.AddScoped<IPartnerAuditService, PartnerAuditService>(); |
| | 0 | 23 | | services.AddScoped<IPartnerAuthService, PartnerAuthService>(); |
| | 0 | 24 | | services.AddScoped<IPartnerManagementService, PartnerManagementService>(); |
| | 0 | 25 | | services.AddScoped<IPartnerOrdersService, PartnerOrdersService>(); |
| | 0 | 26 | | services.AddScoped<IPartnerPermissionService, PartnerPermissionService>(); |
| | 0 | 27 | | services.AddScoped<OzonOrdersWeb.WebServices.Partners.IPartnerOrderActionsService, OzonOrdersWeb.WebServices.Par |
| | | 28 | | |
| | | 29 | | // Отдельная схема: партнёр не должен попадать в Identity сотрудников Studio2 и наоборот. |
| | 0 | 30 | | services.AddAuthentication().AddCookie(PartnerCookieScheme, options => |
| | 0 | 31 | | { |
| | 0 | 32 | | options.Cookie.Name = ".PartnerOffice.Auth"; |
| | 0 | 33 | | options.Cookie.HttpOnly = true; |
| | 0 | 34 | | options.Cookie.SecurePolicy = isProd ? CookieSecurePolicy.Always : CookieSecurePolicy.SameAsRequest; |
| | 0 | 35 | | options.Cookie.SameSite = SameSiteMode.Strict; |
| | 0 | 36 | | options.ExpireTimeSpan = TimeSpan.FromHours(12); |
| | 0 | 37 | | options.SlidingExpiration = true; |
| | 0 | 38 | | |
| | 0 | 39 | | // API без редиректов: SPA сама показывает форму входа. |
| | 0 | 40 | | options.Events.OnRedirectToLogin = ctx => |
| | 0 | 41 | | { |
| | 0 | 42 | | ctx.Response.StatusCode = StatusCodes.Status401Unauthorized; |
| | 0 | 43 | | return Task.CompletedTask; |
| | 0 | 44 | | }; |
| | 0 | 45 | | options.Events.OnRedirectToAccessDenied = ctx => |
| | 0 | 46 | | { |
| | 0 | 47 | | ctx.Response.StatusCode = StatusCodes.Status403Forbidden; |
| | 0 | 48 | | return Task.CompletedTask; |
| | 0 | 49 | | }; |
| | 0 | 50 | | options.Events.OnValidatePrincipal = ValidatePartnerSessionAsync; |
| | 0 | 51 | | }); |
| | | 52 | | |
| | 0 | 53 | | return services; |
| | | 54 | | } |
| | | 55 | | |
| | | 56 | | public static ClaimsPrincipal CreatePartnerPrincipal(Partner partner) |
| | | 57 | | { |
| | 0 | 58 | | var identity = new ClaimsIdentity( |
| | 0 | 59 | | [ |
| | 0 | 60 | | new Claim(ClaimTypes.NameIdentifier, partner.Id.ToString()), |
| | 0 | 61 | | new Claim(ClaimTypes.Name, partner.Login), |
| | 0 | 62 | | new Claim(ClaimTypes.Role, PartnerRole), |
| | 0 | 63 | | new Claim(PartnerStampClaim, partner.SecurityStamp) |
| | 0 | 64 | | ], |
| | 0 | 65 | | PartnerCookieScheme); |
| | 0 | 66 | | return new ClaimsPrincipal(identity); |
| | | 67 | | } |
| | | 68 | | |
| | | 69 | | public static bool TryGetPartnerId(this ClaimsPrincipal user, out long partnerId) => |
| | 0 | 70 | | long.TryParse(user.FindFirstValue(ClaimTypes.NameIdentifier), out partnerId); |
| | | 71 | | |
| | | 72 | | /// <summary>Сессия живёт, пока партнёр существует, активен и не менялся пароль или статус блокировки.</summary> |
| | | 73 | | private static async Task ValidatePartnerSessionAsync(CookieValidatePrincipalContext context) |
| | | 74 | | { |
| | 0 | 75 | | var principal = context.Principal; |
| | 0 | 76 | | var stamp = principal?.FindFirstValue(PartnerStampClaim); |
| | 0 | 77 | | if (principal is null || stamp is null || !principal.TryGetPartnerId(out var partnerId)) |
| | | 78 | | { |
| | 0 | 79 | | await Reject(context); |
| | 0 | 80 | | return; |
| | | 81 | | } |
| | | 82 | | |
| | 0 | 83 | | var auth = context.HttpContext.RequestServices.GetRequiredService<IPartnerAuthService>(); |
| | 0 | 84 | | var partner = await auth.ValidateSessionAsync(partnerId, stamp, context.HttpContext.RequestAborted); |
| | 0 | 85 | | if (partner is null) await Reject(context); |
| | 0 | 86 | | } |
| | | 87 | | |
| | | 88 | | private static Task Reject(CookieValidatePrincipalContext context) |
| | | 89 | | { |
| | 0 | 90 | | context.RejectPrincipal(); |
| | 0 | 91 | | return context.HttpContext.SignOutAsync(PartnerCookieScheme); |
| | | 92 | | } |
| | | 93 | | } |