1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
// SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
using System.Security.Cryptography;
using System.Text;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Options;
using XSharp.Web.Api.Data;
namespace XSharp.Web.Api.Auth;
internal sealed class AuthCodeService(RegistryDbContext database, IOptions<AuthCodeOptions> options)
{
private const string Alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
private readonly AuthCodeOptions configuration = options.Value;
public async Task<string> CreateAsync(Guid userId, string purpose, CancellationToken cancellationToken)
{
if (string.IsNullOrWhiteSpace(configuration.Pepper))
{
throw new InvalidOperationException("AuthCodes:Pepper is required.");
}
await database.AuthChallenges
.Where(item => item.UserId == userId && item.Purpose == purpose && item.ConsumedAt == null)
.ExecuteUpdateAsync(setters => setters.SetProperty(item => item.ConsumedAt, DateTimeOffset.UtcNow),
cancellationToken);
string code = string.Create(8, 0, static (buffer, _) =>
{
for (int index = 0; index < buffer.Length; ++index)
{
buffer[index] = Alphabet[RandomNumberGenerator.GetInt32(Alphabet.Length)];
}
});
database.AuthChallenges.Add(new AuthChallenge
{
UserId = userId,
Purpose = purpose,
CodeDigest = Digest(code, configuration.Pepper),
ExpiresAt = DateTimeOffset.UtcNow.AddMinutes(configuration.LifetimeMinutes),
});
await database.SaveChangesAsync(cancellationToken);
return code;
}
public async Task<bool> ConsumeAsync(Guid userId, string purpose, string code, CancellationToken cancellationToken)
{
AuthChallenge? challenge = await database.AuthChallenges
.Where(item => item.UserId == userId && item.Purpose == purpose && item.ConsumedAt == null)
.OrderByDescending(item => item.ExpiresAt)
.FirstOrDefaultAsync(cancellationToken);
if (challenge is null || challenge.ExpiresAt <= DateTimeOffset.UtcNow
|| challenge.FailedAttempts >= configuration.MaximumAttempts)
{
return false;
}
byte[] supplied = Digest(code.Trim().ToUpperInvariant(), configuration.Pepper);
if (!CryptographicOperations.FixedTimeEquals(challenge.CodeDigest, supplied))
{
++challenge.FailedAttempts;
await database.SaveChangesAsync(cancellationToken);
return false;
}
challenge.ConsumedAt = DateTimeOffset.UtcNow;
await database.SaveChangesAsync(cancellationToken);
return true;
}
private static byte[] Digest(string code, string pepper) =>
SHA256.HashData(Encoding.UTF8.GetBytes($"{pepper}:{code}"));
}
|