[WIP] Building Lexbox login

.vscode/settings.json

@@ -59,6 +59,7 @@
     "langtags",
     "ldml",
     "letsencrypt",
+    "Lexbox",
     "Linq",
     "maint",
     "Memberwise",

Backend.Tests/Controllers/AuthControllerTests.cs

@@ -0,0 +1,114 @@
+using System;
+using System.Collections.Generic;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using Backend.Tests.Mocks;
+using BackendFramework.Controllers;
+using BackendFramework.Models;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using NUnit.Framework;
+
+namespace Backend.Tests.Controllers
+{
+    internal sealed class AuthControllerTests : IDisposable
+    {
+        private PermissionServiceMock _permissionService = null!;
+        private AuthController _controller = null!;
+
+        private const string UserId = "AuthControllerTestsUserId";
+
+        public void Dispose()
+        {
+            _controller?.Dispose();
+            GC.SuppressFinalize(this);
+        }
+
+        [SetUp]
+        public void Setup()
+        {
+            var configValues = new Dictionary<string, string?> { { "LexboxAuth:PostLoginRedirect", "/" } };
+            var configuration = new ConfigurationBuilder().AddInMemoryCollection(configValues).Build();
+            _permissionService = new PermissionServiceMock();
+            _controller = new AuthController(configuration, _permissionService);
+        }
+
+        [Test]
+        public async Task GetAuthStatusUnauthorizedReturnsForbid()
+        {
+            _controller.ControllerContext.HttpContext = PermissionServiceMock.UnauthorizedHttpContext();
+
+            var result = await _controller.GetAuthStatus();
+
+            Assert.That(result, Is.InstanceOf<ForbidResult>());
+        }
+
+        [Test]
+        public async Task GetAuthStatusReturnsLexboxUserWhenLoggedIn()
+        {
+            var claims = new List<Claim> { new("sub", "lex-1"), new("preferred_username", "Lex User") };
+            var authResult = AuthenticateResult.Success(new AuthenticationTicket(
+                new ClaimsPrincipal(new ClaimsIdentity(claims, "LexboxCookie")), "LexboxCookie"));
+            _controller.ControllerContext.HttpContext = GetAuthContext(authResult);
+
+            var result = await _controller.GetAuthStatus() as OkObjectResult;
+
+            Assert.That(result, Is.Not.Null);
+            var authStatus = result.Value as AuthStatus;
+            Assert.That(authStatus, Is.Not.Null);
+            Assert.That(authStatus.IsLoggedIn, Is.True);
+            Assert.That(authStatus.LoggedInAs, Is.EqualTo("Lex User"));
+            Assert.That(authStatus.UserId, Is.EqualTo("lex-1"));
+        }
+
+        [Test]
+        public async Task GetAuthStatusReturnsLoggedOutWhenNotAuthenticatedByLexboxCookie()
+        {
+            _controller.ControllerContext.HttpContext = GetAuthContext(AuthenticateResult.NoResult());
+
+            var result = await _controller.GetAuthStatus() as OkObjectResult;
+
+            Assert.That(result, Is.Not.Null);
+            var authStatus = result.Value as AuthStatus;
+            Assert.That(authStatus, Is.Not.Null);
+            Assert.That(authStatus.IsLoggedIn, Is.False);
+            Assert.That(authStatus.LoggedInAs, Is.Null);
+            Assert.That(authStatus.UserId, Is.Null);
+        }
+
+        [Test]
+        public async Task GetLexboxLoginReturnsExpectedLoginPath()
+        {
+            _controller.ControllerContext.HttpContext = GetAuthContext(AuthenticateResult.NoResult());
+
+            var result = await _controller.GetLexboxLogin();
+
+            Assert.That(result, Is.InstanceOf<EmptyResult>());
+        }
+
+        [Test]
+        public async Task LogOutLexboxReturnsNoContent()
+        {
+            var claims = new List<Claim> { new("sub", "lex-1"), new("preferred_username", "Lex User") };
+            var authResult = AuthenticateResult.Success(new AuthenticationTicket(
+                new ClaimsPrincipal(new ClaimsIdentity(claims, "LexboxCookie")), "LexboxCookie"));
+            _controller.ControllerContext.HttpContext = GetAuthContext(authResult);
+
+            var result = await _controller.LogOutLexbox();
+
+            Assert.That(result, Is.InstanceOf<NoContentResult>());
+        }
+
+        private static HttpContext GetAuthContext(AuthenticateResult authenticateResult)
+        {
+            var context = PermissionServiceMock.HttpContextWithUserId(UserId);
+            var services = new ServiceCollection();
+            services.AddSingleton<IAuthenticationService>(new AuthenticationServiceMock(authenticateResult));
+            context.RequestServices = services.BuildServiceProvider();
+            return context;
+        }
+    }
+}

Backend.Tests/Mocks/AuthenticationServiceMock.cs

@@ -0,0 +1,25 @@
+using System.Security.Claims;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+
+namespace Backend.Tests.Mocks
+{
+    internal sealed class AuthenticationServiceMock(AuthenticateResult authenticateResult) : IAuthenticationService
+    {
+        public Task<AuthenticateResult> AuthenticateAsync(HttpContext context, string? scheme)
+            => Task.FromResult(authenticateResult);
+
+        public Task ChallengeAsync(HttpContext context, string? scheme, AuthenticationProperties? properties)
+            => Task.CompletedTask;
+
+        public Task ForbidAsync(HttpContext context, string? scheme, AuthenticationProperties? properties)
+            => Task.CompletedTask;
+
+        public Task SignInAsync(HttpContext context, string? scheme, ClaimsPrincipal principal,
+            AuthenticationProperties? properties) => Task.CompletedTask;
+
+        public Task SignOutAsync(HttpContext context, string? scheme, AuthenticationProperties? properties)
+            => Task.CompletedTask;
+    }
+}

Backend/BackendFramework.csproj

@@ -18,9 +18,10 @@
     <PackageReference Include="RelaxNG" Version="3.2.3">
       <NoWarn>NU1701</NoWarn>
     </PackageReference>
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.17" />
-    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="8.12.1" />
-    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.12.1" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.24" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="8.0.24" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="8.16.0" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.16.0" />
     <PackageReference Include="MailKit" Version="4.13.0" />
     <PackageReference Include="MongoDB.Driver" Version="3.4.0" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.1" />

Backend/Controllers/AuthController.cs

@@ -0,0 +1,127 @@
+using System;
+using System.Threading.Tasks;
+using BackendFramework.Helper;
+using BackendFramework.Interfaces;
+using BackendFramework.Models;
+using BackendFramework.Otel;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Configuration;
+
+namespace BackendFramework.Controllers
+{
+    [Produces("application/json")]
+    [Route("v1/auth")]
+    public class AuthController(IConfiguration configuration, IPermissionService permissionService) : Controller
+    {
+        private readonly IConfiguration _configuration = configuration;
+        private readonly IPermissionService _permissionService = permissionService;
+
+        private const string otelTagName = "otel.AuthController";
+        private const string LexboxCookieScheme = "LexboxCookie";
+        private const string LexboxOidcScheme = "LexboxOidc";
+        private const string PostLoginRedirectConfigKey = "LexboxAuth:PostLoginRedirect";
+
+        /// <summary> Gets authentication status for the current request. </summary>
+        [HttpGet("status", Name = "GetAuthStatus")]
+        [ProducesResponseType(StatusCodes.Status200OK, Type = typeof(AuthStatus))]
+        [ProducesResponseType(StatusCodes.Status403Forbidden)]
+        public async Task<IActionResult> GetAuthStatus()
+        {
+            using var activity = OtelService.StartActivityWithTag(otelTagName, "getting auth status");
+
+            if (!_permissionService.IsCurrentUserAuthenticated(HttpContext))
+            {
+                return Forbid();
+            }
+
+            var result = await HttpContext.AuthenticateAsync(LexboxCookieScheme);
+            if (!result.Succeeded || result.Principal is null)
+            {
+                return Ok(AuthStatus.LoggedOut());
+            }
+
+            var user = GetUserFromClaims(result.Principal);
+            return user is null ? Ok(AuthStatus.LoggedOut()) : Ok(AuthStatus.LoggedIn(user));
+        }
+
+        /// <summary> Generates a redirect to Lexbox login for OIDC sign-in. </summary>
+        [HttpGet("lexbox-login", Name = "GetLexboxLogin")]
+        [ProducesResponseType(StatusCodes.Status302Found)]
+        [ProducesResponseType(StatusCodes.Status500InternalServerError)]
+        public async Task<IActionResult> GetLexboxLogin()
+        {
+            using var activity = OtelService.StartActivityWithTag(otelTagName, "getting lexbox login");
+
+            var redirectUrl = NormalizeReturnUrl(_configuration[PostLoginRedirectConfigKey])
+                ?? NormalizeReturnUrl(Domain.FrontendDomain)
+                ?? "/";
+            var authProperties = new AuthenticationProperties { RedirectUri = redirectUrl };
+
+            return await ChallengeLexboxAsync(authProperties);
+        }
+
+        /// <summary> Signs out the current user from Lexbox cookie and OIDC. </summary>
+        [HttpGet("lexbox-logout", Name = "LogOutLexbox")]
+        [ProducesResponseType(StatusCodes.Status204NoContent)]
+        public async Task<IActionResult> LogOutLexbox()
+        {
+            using var activity = OtelService.StartActivityWithTag(otelTagName, "logging out");
+
+            await HttpContext.SignOutAsync(LexboxCookieScheme);
+            await HttpContext.SignOutAsync(LexboxOidcScheme);
+
+            return NoContent();
+        }
+
+        private async Task<IActionResult> ChallengeLexboxAsync(AuthenticationProperties authProperties)
+        {
+            try
+            {
+                await HttpContext.ChallengeAsync(LexboxOidcScheme, authProperties);
+                return new EmptyResult();
+            }
+            catch (Exception ex)
+            {
+                return Problem(title: "Lexbox OIDC challenge failed", detail: ex.Message,
+                    statusCode: StatusCodes.Status500InternalServerError);
+            }
+        }
+
+        private static string? NormalizeReturnUrl(string? url)
+        {
+            url = url?.Trim();
+            if (string.IsNullOrEmpty(url) || !Uri.TryCreate(url, UriKind.RelativeOrAbsolute, out var uri))
+            {
+                return null;
+            }
+
+            return uri.IsAbsoluteUri ? uri.PathAndQuery : uri.ToString();
+        }
+
+        private static LexboxAuthUser? GetUserFromClaims(System.Security.Claims.ClaimsPrincipal principal)
+        {
+            var userId = principal.FindFirst("sub")?.Value?.Trim();
+            if (string.IsNullOrEmpty(userId))
+            {
+                userId = principal.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value?.Trim();
+            }
+
+            var displayName = principal.FindFirst("preferred_username")?.Value
+                ?? principal.FindFirst("email")?.Value
+                ?? principal.FindFirst("name")?.Value
+                ?? principal.FindFirst("upn")?.Value
+                ?? principal.Identity?.Name;
+            displayName = displayName?.Trim();
+            if (string.IsNullOrEmpty(displayName))
+            {
+                displayName = userId;
+            }
+
+            return string.IsNullOrEmpty(displayName) && string.IsNullOrEmpty(userId)
+                ? null
+                : new LexboxAuthUser { DisplayName = displayName, UserId = userId };
+        }
+    }
+}

Backend/Models/AuthStatus.cs

@@ -0,0 +1,21 @@
+namespace BackendFramework.Models
+{
+    public class AuthStatus
+    {
+        public bool IsLoggedIn { get; set; }
+        public string? LoggedInAs { get; set; }
+        public string? UserId { get; set; }
+
+        public static AuthStatus LoggedOut() => new()
+        {
+            IsLoggedIn = false
+        };
+
+        public static AuthStatus LoggedIn(LexboxAuthUser user) => new()
+        {
+            IsLoggedIn = true,
+            LoggedInAs = user.DisplayName,
+            UserId = user.UserId
+        };
+    }
+}

Backend/Models/LexboxAuthUser.cs

@@ -0,0 +1,8 @@
+namespace BackendFramework.Models
+{
+    public class LexboxAuthUser
+    {
+        public string? UserId { get; init; }
+        public string? DisplayName { get; init; }
+    }
+}

Backend/Startup.cs

@@ -133,6 +133,21 @@ public void ConfigureServices(IServiceCollection services)
             }
 
             var key = ASCII.GetBytes(secretKey);
+
+            var lexboxAuthority = Configuration["LexboxAuth:Authority"]?.Trim().TrimEnd('/');
+            lexboxAuthority = string.IsNullOrEmpty(lexboxAuthority) ? "https://lexbox.org" : lexboxAuthority;
+            // Authorization endpoint needs to be defined before discovery happens with the metadata address.
+            var lexboxAuthorizationEndpoint = Configuration["LexboxAuth:AuthorizationEndpoint"]?.Trim();
+            lexboxAuthorizationEndpoint = string.IsNullOrEmpty(lexboxAuthorizationEndpoint)
+                ? "https://lexbox.org/api/oauth/open-id-auth"
+                : lexboxAuthorizationEndpoint;
+            var lexboxCallbackPath = Configuration["LexboxAuth:CallbackPath"] ?? "/v1/auth/oauth-callback";
+            var lexboxClientId = Configuration["LexboxAuth:ClientId"] ?? "the-combine";
+            var lexboxMetadataAddress = Configuration["LexboxAuth:OpenIdConfigUrl"]
+                ?? "https://lexbox.org/.well-known/openid-configuration";
+            var lexboxPrompt = Configuration["LexboxAuth:Prompt"] ?? "select_account";
+            var lexboxScope = Configuration["LexboxAuth:Scope"] ?? "profile openid offline_access sendandreceive";
+
             services.AddAuthentication(x =>
                 {
                     x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
@@ -144,10 +159,50 @@ public void ConfigureServices(IServiceCollection services)
                     x.SaveToken = true;
                     x.TokenValidationParameters = new TokenValidationParameters
                     {
-                        ValidateIssuerSigningKey = true,
                         IssuerSigningKey = new SymmetricSecurityKey(key),
+                        ValidateAudience = false,
                         ValidateIssuer = false,
-                        ValidateAudience = false
+                        ValidateIssuerSigningKey = true
+                    };
+                })
+                .AddCookie("LexboxCookie", options =>
+                {
+                    options.Cookie.HttpOnly = true;
+                    options.Cookie.IsEssential = true;
+                    options.Cookie.Name = "lexbox_auth";
+                    options.Cookie.SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Lax;
+                    options.Cookie.SecurePolicy = Microsoft.AspNetCore.Http.CookieSecurePolicy.SameAsRequest;
+                    options.ExpireTimeSpan = TimeSpan.FromHours(1);
+                    options.SlidingExpiration = true;
+                })
+                .AddOpenIdConnect("LexboxOidc", options =>
+                {
+                    options.Authority = lexboxAuthority;
+                    options.CallbackPath = lexboxCallbackPath;
+                    options.ClientId = lexboxClientId;
+                    options.GetClaimsFromUserInfoEndpoint = true;
+                    options.MetadataAddress = lexboxMetadataAddress;
+                    options.RequireHttpsMetadata = true;
+                    options.ResponseType = "code";
+                    options.SaveTokens = true;
+                    options.SignInScheme = "LexboxCookie";
+                    options.UsePkce = true;
+
+                    options.Scope.Clear();
+                    foreach (var scope in lexboxScope.Split(' ', StringSplitOptions.RemoveEmptyEntries))
+                    {
+                        options.Scope.Add(scope);
+                    }
+
+                    options.Events.OnRedirectToIdentityProvider = context =>
+                    {
+                        if (string.IsNullOrWhiteSpace(context.ProtocolMessage.IssuerAddress))
+                        {
+                            context.ProtocolMessage.IssuerAddress = lexboxAuthorizationEndpoint;
+                        }
+
+                        context.ProtocolMessage.Prompt = lexboxPrompt;
+                        return System.Threading.Tasks.Task.CompletedTask;
                     };
                 });