| 1 | using System.Security.Claims; |
| 2 | using System.Text.Encodings.Web; |
| 3 | using IntercomService.Options; |
| 4 | using Microsoft.AspNetCore.Authentication; |
| 5 | using Microsoft.Extensions.Options; |
| 6 | |
| 7 | namespace IntercomService.Auth; |
| 8 | |
| 9 | public sealed class DevBearerAuthenticationHandler( |
| 10 | IOptionsMonitor<AuthenticationSchemeOptions> options, |
| 11 | ILoggerFactory logger, |
| 12 | UrlEncoder encoder, |
| 13 | IOptions<DevAuthOptions> devOptions, |
| 14 | IHostEnvironment environment) |
| 15 | : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder) |
| 16 | { |
| 17 | public const string SchemeName = "DevBearer"; |
| 18 | |
| 19 | protected override Task<AuthenticateResult> HandleAuthenticateAsync() |
| 20 | { |
| 21 | if (!environment.IsDevelopment()) |
| 22 | return Task.FromResult(AuthenticateResult.NoResult()); |
| 23 | |
| 24 | var dev = devOptions.Value; |
| 25 | if (string.IsNullOrWhiteSpace(dev.TeamToken)) |
| 26 | return Task.FromResult(AuthenticateResult.NoResult()); |
| 27 | |
| 28 | if (!Request.Headers.TryGetValue("Authorization", out var header)) |
| 29 | return Task.FromResult(AuthenticateResult.NoResult()); |
| 30 | |
| 31 | var value = header.ToString(); |
| 32 | if (!value.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)) |
| 33 | return Task.FromResult(AuthenticateResult.NoResult()); |
| 34 | |
| 35 | var token = value["Bearer ".Length..].Trim(); |
| 36 | if (!string.Equals(token, dev.TeamToken, StringComparison.Ordinal)) |
| 37 | return Task.FromResult(AuthenticateResult.Fail("Invalid dev team token")); |
| 38 | |
| 39 | var claims = new[] |
| 40 | { |
| 41 | new Claim(ClaimTypes.NameIdentifier, dev.MemberId), |
| 42 | new Claim("display_name", dev.DisplayName), |
| 43 | }; |
| 44 | var identity = new ClaimsIdentity(claims, SchemeName); |
| 45 | var principal = new ClaimsPrincipal(identity); |
| 46 | var ticket = new AuthenticationTicket(principal, SchemeName); |
| 47 | return Task.FromResult(AuthenticateResult.Success(ticket)); |
| 48 | } |
| 49 | } |
| 50 | |