1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
// SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.0
using System.Security.Claims;
using System.Security.Cryptography;
using Microsoft.AspNetCore.RateLimiting;
using Microsoft.EntityFrameworkCore;
using XSharp.Web.Api.Data;
namespace XSharp.Web.Api.Tokens;
internal static class TokenEndpoints
{
private static readonly HashSet<string> AllowedScopes = new(StringComparer.Ordinal)
{
"read",
"publish",
"yank",
};
public static void MapTokenEndpoints(this WebApplication app)
{
RouteGroupBuilder tokens = app.MapGroup("/api/v1/tokens")
.RequireAuthorization()
.RequireRateLimiting("tokens");
tokens.MapGet("/", ListAsync);
tokens.MapPost("/", CreateAsync);
tokens.MapDelete("/{id:guid}", RevokeAsync);
}
private static async Task<IResult> ListAsync(
ClaimsPrincipal principal,
RegistryDbContext database,
CancellationToken cancellationToken)
{
Guid userId = GetUserId(principal);
var tokens = await database.RegistryTokens
.Where(token => token.UserId == userId && token.RevokedAt == null)
.OrderByDescending(token => token.CreatedAt)
.Select(token => new
{
token.Id,
token.Name,
token.Prefix,
token.Scopes,
token.CreatedAt,
token.LastUsedAt,
})
.ToListAsync(cancellationToken);
return Results.Ok(tokens);
}
private static async Task<IResult> CreateAsync(
CreateTokenRequest request,
ClaimsPrincipal principal,
RegistryDbContext database,
CancellationToken cancellationToken)
{
string name = request.Name?.Trim() ?? string.Empty;
string[] scopes = request.Scopes?
.Where(scope => scope is not null)
.Distinct(StringComparer.Ordinal)
.Order(StringComparer.Ordinal)
.ToArray() ?? [];
if (name.Length is < 1 or > 80 || scopes.Length == 0 || scopes.Any(scope => !AllowedScopes.Contains(scope)))
{
return Results.BadRequest(new
{
error = "invalid_token",
message = "Token name or permissions are invalid.",
});
}
string raw = $"xs_{Convert.ToHexString(RandomNumberGenerator.GetBytes(32)).ToLowerInvariant()}";
RegistryToken token = new()
{
UserId = GetUserId(principal),
Name = name,
Digest = SHA256.HashData(System.Text.Encoding.ASCII.GetBytes(raw)),
Prefix = raw[..11],
Scopes = scopes,
};
database.RegistryTokens.Add(token);
await database.SaveChangesAsync(cancellationToken);
return Results.Ok(new
{
token.Id,
Token = raw,
token.Prefix,
token.Scopes,
token.CreatedAt,
});
}
private static async Task<IResult> RevokeAsync(
Guid id,
ClaimsPrincipal principal,
RegistryDbContext database,
CancellationToken cancellationToken)
{
Guid userId = GetUserId(principal);
RegistryToken? token = await database.RegistryTokens
.FirstOrDefaultAsync(item => item.Id == id && item.UserId == userId && item.RevokedAt == null,
cancellationToken);
if (token is null) return Results.NotFound();
token.RevokedAt = DateTimeOffset.UtcNow;
await database.SaveChangesAsync(cancellationToken);
return Results.NoContent();
}
private static Guid GetUserId(ClaimsPrincipal principal) =>
Guid.Parse(principal.FindFirstValue(ClaimTypes.NameIdentifier)
?? throw new InvalidOperationException("Authenticated user identifier is missing."));
}
internal sealed record CreateTokenRequest(string? Name, string[]? Scopes);
|