Add JWT authentication and authorization infrastructure

2026-08-18 15:43:46 +05:30
parent ea2e5229c8
commit e0e691acbf
18 changed files with 395 additions and 4 deletions
@@ -0,0 +1,47 @@
+using Microsoft.AspNetCore.Http;
+
+namespace Distribution.Infra.Auth
+{
+    public class CurrentUserService : ICurrentUserService
+    {
+        private readonly IHttpContextAccessor _httpContextAccessor;
+
+        public CurrentUserService(IHttpContextAccessor httpContextAccessor)
+        {
+            _httpContextAccessor = httpContextAccessor;
+        }
+
+        private System.Security.Claims.ClaimsPrincipal? User => _httpContextAccessor.HttpContext?.User;
+
+        public bool IsAuthenticated => User?.Identity?.IsAuthenticated ?? false;
+
+        public Guid? UserId
+        {
+            get
+            {
+                var value = User?.FindFirst("sub")?.Value ?? User?.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
+                return Guid.TryParse(value, out var id) ? id : null;
+            }
+        }
+
+        public Guid? RoleId
+        {
+            get
+            {
+                var value = User?.FindFirst("role_id")?.Value;
+                return Guid.TryParse(value, out var id) ? id : null;
+            }
+        }
+
+        public string? Username => User?.FindFirst("username")?.Value;
+
+        public int RoleLevel
+        {
+            get
+            {
+                var value = User?.FindFirst("role_level")?.Value;
+                return int.TryParse(value, out var level) ? level : 0;
+            }
+        }
+    }
+}
@@ -0,0 +1,11 @@
+namespace Distribution.Infra.Auth
+{
+    public interface ICurrentUserService
+    {
+        Guid? UserId { get; }
+        Guid? RoleId { get; }
+        string? Username { get; }
+        int RoleLevel { get; }
+        bool IsAuthenticated { get; }
+    }
+}
@@ -0,0 +1,7 @@
+namespace Distribution.Infra.Auth
+{
+    public interface IJwtTokenService
+    {
+        string GenerateToken(Models.User user);
+    }
+}
@@ -0,0 +1,7 @@
+namespace Distribution.Infra.Auth
+{
+    public interface IPermissionService
+    {
+        Task<bool> HasPermissionAsync(Guid roleId, string permissionCode);
+    }
+}
@@ -0,0 +1,10 @@
+namespace Distribution.Infra.Auth
+{
+    public interface IScopeAccessService
+    {
+        Task<bool> HasStoreScopeAsync(Guid userId, Guid storeId);
+        Task<bool> HasRouteScopeAsync(Guid userId, Guid routeId);
+        Task<bool> HasRegionScopeAsync(Guid userId, Guid regionId);
+        Task<List<Guid>> GetAccessibleStoreIdsAsync(Guid userId);
+    }
+}
@@ -0,0 +1,48 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Microsoft.Extensions.Configuration;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Distribution.Infra.Auth
+{
+    public class JwtTokenService : IJwtTokenService
+    {
+        private readonly IConfiguration _configuration;
+
+        public JwtTokenService(IConfiguration configuration)
+        {
+            _configuration = configuration;
+        }
+
+        public string GenerateToken(Models.User user)
+        {
+            var jwtSection = _configuration.GetSection("Jwt");
+            var key = jwtSection["Key"] ?? throw new InvalidOperationException("Jwt:Key is not configured.");
+            var issuer = jwtSection["Issuer"];
+            var audience = jwtSection["Audience"];
+            var expiryMinutes = int.TryParse(jwtSection["ExpiryMinutes"], out var m) ? m : 120;
+
+            var claims = new List<Claim>
+            {
+                new("sub", user.Id.ToString()),
+                new("username", user.Username),
+                new("role", user.Role?.Name ?? string.Empty),
+                new("role_id", user.FK_RoleId.ToString()),
+                new("role_level", (user.Role?.Level ?? 0).ToString())
+            };
+
+            var signingKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(key));
+            var credentials = new SigningCredentials(signingKey, SecurityAlgorithms.HmacSha256);
+
+            var token = new JwtSecurityToken(
+                issuer: issuer,
+                audience: audience,
+                claims: claims,
+                expires: DateTime.Now.AddMinutes(expiryMinutes),
+                signingCredentials: credentials);
+
+            return new JwtSecurityTokenHandler().WriteToken(token);
+        }
+    }
+}
@@ -0,0 +1,25 @@
+using Microsoft.AspNetCore.Authorization;
+
+namespace Distribution.Infra.Auth
+{
+    public class PermissionAuthorizationHandler : AuthorizationHandler<PermissionRequirement>
+    {
+        private readonly IPermissionService _permissionService;
+
+        public PermissionAuthorizationHandler(IPermissionService permissionService)
+        {
+            _permissionService = permissionService;
+        }
+
+        protected override async Task HandleRequirementAsync(
+            AuthorizationHandlerContext context, PermissionRequirement requirement)
+        {
+            var roleIdClaim = context.User.FindFirst("role_id")?.Value;
+            if (!Guid.TryParse(roleIdClaim, out var roleId))
+                return;
+
+            if (await _permissionService.HasPermissionAsync(roleId, requirement.PermissionCode))
+                context.Succeed(requirement);
+        }
+    }
+}
@@ -0,0 +1,33 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.Extensions.Options;
+
+namespace Distribution.Infra.Auth
+{
+    public class PermissionPolicyProvider : IAuthorizationPolicyProvider
+    {
+        private readonly DefaultAuthorizationPolicyProvider _fallback;
+
+        public PermissionPolicyProvider(IOptions<AuthorizationOptions> options)
+        {
+            _fallback = new DefaultAuthorizationPolicyProvider(options);
+        }
+
+        public Task<AuthorizationPolicy> GetDefaultPolicyAsync() => _fallback.GetDefaultPolicyAsync();
+
+        public Task<AuthorizationPolicy?> GetFallbackPolicyAsync() => _fallback.GetFallbackPolicyAsync();
+
+        public Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
+        {
+            if (policyName.Contains('.'))
+            {
+                var policy = new AuthorizationPolicyBuilder()
+                    .RequireAuthenticatedUser()
+                    .AddRequirements(new PermissionRequirement(policyName))
+                    .Build();
+                return Task.FromResult<AuthorizationPolicy?>(policy);
+            }
+
+            return _fallback.GetPolicyAsync(policyName);
+        }
+    }
+}
@@ -0,0 +1,14 @@
+using Microsoft.AspNetCore.Authorization;
+
+namespace Distribution.Infra.Auth
+{
+    public class PermissionRequirement : IAuthorizationRequirement
+    {
+        public string PermissionCode { get; }
+
+        public PermissionRequirement(string permissionCode)
+        {
+            PermissionCode = permissionCode;
+        }
+    }
+}
@@ -0,0 +1,21 @@
+using Distribution.Data;
+using Microsoft.EntityFrameworkCore;
+
+namespace Distribution.Infra.Auth
+{
+    public class PermissionService : IPermissionService
+    {
+        private readonly AppDBContext _context;
+
+        public PermissionService(AppDBContext context)
+        {
+            _context = context;
+        }
+
+        public async Task<bool> HasPermissionAsync(Guid roleId, string permissionCode) =>
+            await _context.RolePermissions
+                .Where(rp => rp.FK_RoleId == roleId && rp.IsActive)
+                .Join(_context.Permissions.Where(p => p.IsActive), rp => rp.FK_PermissionId, p => p.Id, (rp, p) => p.Code)
+                .AnyAsync(code => code == permissionCode);
+    }
+}
@@ -0,0 +1,63 @@
+using Distribution.Data;
+using Microsoft.EntityFrameworkCore;
+
+namespace Distribution.Infra.Auth
+{
+    public class ScopeAccessService : IScopeAccessService
+    {
+        private readonly AppDBContext _context;
+
+        public ScopeAccessService(AppDBContext context)
+        {
+            _context = context;
+        }
+
+        public async Task<bool> HasStoreScopeAsync(Guid userId, Guid storeId) =>
+            await _context.UserStoreScopes.AnyAsync(s => s.FK_UserId == userId && s.FK_StoreId == storeId && s.IsActive);
+
+        public async Task<bool> HasRouteScopeAsync(Guid userId, Guid routeId) =>
+            await _context.UserRouteScopes.AnyAsync(s => s.FK_UserId == userId && s.FK_RouteId == routeId && s.IsActive);
+
+        public async Task<bool> HasRegionScopeAsync(Guid userId, Guid regionId) =>
+            await _context.UserRegionScopes.AnyAsync(s => s.FK_UserId == userId && s.FK_RegionId == regionId && s.IsActive);
+
+        public async Task<List<Guid>> GetAccessibleStoreIdsAsync(Guid userId)
+        {
+            var directStoreIds = await _context.UserStoreScopes
+                .Where(s => s.FK_UserId == userId && s.IsActive)
+                .Select(s => s.FK_StoreId)
+                .ToListAsync();
+
+            var routeIds = await _context.UserRouteScopes
+                .Where(s => s.FK_UserId == userId && s.IsActive)
+                .Select(s => s.FK_RouteId)
+                .ToListAsync();
+
+            var regionIds = await _context.UserRegionScopes
+                .Where(s => s.FK_UserId == userId && s.IsActive)
+                .Select(s => s.FK_RegionId)
+                .ToListAsync();
+
+            var storeIdsViaRoute = await _context.Stores
+                .Where(s => routeIds.Contains(s.FK_RouteId) && s.IsActive)
+                .Select(s => s.Id)
+                .ToListAsync();
+
+            var routeIdsViaRegion = await _context.Routes
+                .Where(r => regionIds.Contains(r.FK_RegionId) && r.IsActive)
+                .Select(r => r.Id)
+                .ToListAsync();
+
+            var storeIdsViaRegion = await _context.Stores
+                .Where(s => routeIdsViaRegion.Contains(s.FK_RouteId) && s.IsActive)
+                .Select(s => s.Id)
+                .ToListAsync();
+
+            return directStoreIds
+                .Concat(storeIdsViaRoute)
+                .Concat(storeIdsViaRegion)
+                .Distinct()
+                .ToList();
+        }
+    }
+}