From b114bf3a10569967a94ce98bddabfea6bf8f281f Mon Sep 17 00:00:00 2001
From: Max <51083570+DRdrProfessor@users.noreply.github.com>
Date: Thu, 21 Sep 2023 20:51:16 +0200
Subject: [PATCH] Working on auth attribute

---
 .../Auth/SessionAuthorizeAttribute.cs         | 10 +++++++++-
 SharpRSS.API/Controllers/AuthController.cs    |  9 ++++++---
 SharpRSS.API/Net/SwaggerSessionHeader.cs      | 19 +++++++++++++++++++
 SharpRSS.API/Program.cs                       |  8 +++++++-
 4 files changed, 41 insertions(+), 5 deletions(-)
 create mode 100644 SharpRSS.API/Net/SwaggerSessionHeader.cs

diff --git a/SharpRSS.API/Auth/SessionAuthorizeAttribute.cs b/SharpRSS.API/Auth/SessionAuthorizeAttribute.cs
index 31e1034..ce29375 100644
--- a/SharpRSS.API/Auth/SessionAuthorizeAttribute.cs
+++ b/SharpRSS.API/Auth/SessionAuthorizeAttribute.cs
@@ -3,6 +3,7 @@ using System.Linq;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.Primitives;
 using ToolQit;
 using ToolQit.Logging;
 
@@ -24,9 +25,16 @@ namespace SharpRSS.API.Auth
         {
             if (context.ActionDescriptor.EndpointMetadata.Any(obj => obj.GetType() == typeof(AllowAnonymousAttribute)))
             {
-                context.Result = new OkResult();
+                //context.Result = new OkResult();
                 return;
             }
+
+            if (context.HttpContext.Request.Headers.TryGetValue("SRSS-Session", out StringValues val))
+            {
+                //TODO: if no permission check for valid session, if permission check if session has access!
+                return;
+            }
+
             //TODO: Check session ID!
             context.Result = new UnauthorizedResult();
         }
diff --git a/SharpRSS.API/Controllers/AuthController.cs b/SharpRSS.API/Controllers/AuthController.cs
index ece77b5..256390c 100644
--- a/SharpRSS.API/Controllers/AuthController.cs
+++ b/SharpRSS.API/Controllers/AuthController.cs
@@ -1,3 +1,4 @@
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
@@ -28,20 +29,22 @@ namespace SharpRSS.API.Controllers
         [HttpPost("[action]")]
         [AllowAnonymous]
         public async Task<ActionResult<string>> Authenticate(AuthenticateUser authenticateUser)
-        {
-            return Ok("Ok!");
+        {   // Return test result
+            return Ok(new { Expires = DateTime.Now.Add(TimeSpan.FromDays(7)), SessionToken = Guid.NewGuid().ToString(), Released = DateTime.Now });
         }
 
         [HttpPost("user")]
+        [SessionAuthorize("auth:user:create")]
         public async Task<ActionResult<UserDto>> CreateUser(AuthenticateUser authenticateUser)
         {
             Result<User> result = await _authService.CreateUser(authenticateUser);
-                if (result.Success)
+            if (result.Success)
                 return Ok(Models.Auth.User.ToDto(result.Value ?? new User()));
             return BadRequest(new ApiResult(result.Message, ApiResults.Error));
         }
 
         [HttpGet("user")]
+        [SessionAuthorize("auth:user:get")]
         public async Task<ActionResult<ApiListResult<IEnumerable<UserDto>>>> GetUsers(int take, int skip)
         {
             var usersAuth = await _authService.GetUsers(take, skip);
diff --git a/SharpRSS.API/Net/SwaggerSessionHeader.cs b/SharpRSS.API/Net/SwaggerSessionHeader.cs
new file mode 100644
index 0000000..492157b
--- /dev/null
+++ b/SharpRSS.API/Net/SwaggerSessionHeader.cs
@@ -0,0 +1,19 @@
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+
+namespace SharpRSS.API.Net
+{
+    public class SwaggerSessionHeader : IOperationFilter
+    {
+        public void Apply(OpenApiOperation operation, OperationFilterContext context)
+        {
+            operation.Parameters.Add(new OpenApiParameter()
+            {
+                Name = "SRSS-Session",
+                In = ParameterLocation.Header,
+                Required = false,
+                Schema = new OpenApiSchema() { Type = "string" }
+            });
+        }
+    }
+}
\ No newline at end of file
diff --git a/SharpRSS.API/Program.cs b/SharpRSS.API/Program.cs
index 58c955f..d89c7e6 100644
--- a/SharpRSS.API/Program.cs
+++ b/SharpRSS.API/Program.cs
@@ -3,9 +3,11 @@ using System.IO;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
+using Microsoft.OpenApi.Models;
 using Serilog;
 using Serilog.Formatting.Compact;
 using SharpRSS.API.Data;
+using SharpRSS.API.Net;
 using ToolQit;
 using ToolQit.Logging.Serilog;
 
@@ -18,7 +20,11 @@ builder.Logging.AddSerilog();
 builder.Services.AddControllers();
 // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
 builder.Services.AddEndpointsApiExplorer();
-builder.Services.AddSwaggerGen();
+builder.Services.AddSwaggerGen(con =>
+{
+    con.SwaggerDoc("v1", new OpenApiInfo() { Title = "SharRSS API", Version = "v1"});
+    con.OperationFilter<SwaggerSessionHeader>();
+});
 builder.Services.AddScoped<AuthService>();
 builder.Services.AddScoped<SharpRssService>();