Notes

namespace SecureSoft.Services
{
using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Security.Claims;
using System.Text;
using System.Threading.Tasks;

using Microsoft.IdentityModel.Tokens;

using SecureSoft.Domain.Repositories;

public class Jwt
{
private const string Issuer = "SECURE SOFT AUTH SERVER";

private const string Audience = "https://localhost:44399";

private const int Lifetime = 1;

private static readonly string Key =
Environment.GetEnvironmentVariable("BEARER_KEY");

private readonly IUserRepository userRepository;

public Jwt(IUserRepository userRepository)
{
this.userRepository = userRepository;
}

public async Task<string> GetToken(string login, string password)
{
var identity = await GetIdentity(login, password);

if (identity == null)
{
return "non-authorized";
}

var now = DateTime.UtcNow;

var jwt = new JwtSecurityToken(
issuer: Issuer,
audience: Audience,
notBefore: now,
claims: identity.Claims,
expires: now.Add(TimeSpan.FromMinutes(Lifetime)),
signingCredentials: new SigningCredentials(
GetSymmetricSecurityKey(),
SecurityAlgorithms.HmacSha256));
var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt);

return encodedJwt;
}

public (string role, int id) ValidateToken(string authToken)
{
var tokenHandler = new JwtSecurityTokenHandler();
var validationParameters = GetValidationParameters();

tokenHandler.ValidateToken(
authToken,
validationParameters,
out var decodeToken);
var role = (decodeToken as JwtSecurityToken)?.Claims
.First(claim => claim.Type == ClaimTypes.Role).Value;
var id = Convert.ToInt32((decodeToken as JwtSecurityToken)?.Claims
.First(claim => claim.Type == ClaimTypes.Name).Value);

return (role, id);
}

private SymmetricSecurityKey GetSymmetricSecurityKey()
{
return new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Key));
}

private async Task<ClaimsIdentity> GetIdentity(
string username,
string password)
{
var user = await this.userRepository.GetByLogin(username);
if (user == null)
{
throw new Exception("Invalid username or password!");
}
else if (!SecurityServices.VerifyHashedPassword(
user.Password,
password))
{
throw new Exception("Invalid username or password!");
}
else
{
var claims = new List<Claim>
{
new Claim(
ClaimsIdentity.DefaultNameClaimType,
user.Id.ToString()),
new Claim(
ClaimsIdentity.DefaultRoleClaimType,
user.Role)
};
var claimsIdentity = new ClaimsIdentity(
claims,
"Token",
ClaimsIdentity.DefaultNameClaimType,
ClaimsIdentity.DefaultRoleClaimType);
return claimsIdentity;
}
}

private TokenValidationParameters GetValidationParameters()
{
return new TokenValidationParameters()
{
ValidateIssuer = true,
ValidIssuer = Issuer,
ValidateAudience = true,
ValidAudience = Audience,
ValidateLifetime = true,
IssuerSigningKey = GetSymmetricSecurityKey(),
ValidateIssuerSigningKey = true
};
}
}
}