| | | 1 | | using ArturRios.Data.Relational.Core.Interfaces; |
| | | 2 | | using ArturRios.Heimdall.Command.Input; |
| | | 3 | | using ArturRios.Heimdall.Command.Output; |
| | | 4 | | using ArturRios.Heimdall.Command.Services; |
| | | 5 | | using ArturRios.Heimdall.Domain.Entities; |
| | | 6 | | using ArturRios.Heimdall.Domain.Enums; |
| | | 7 | | using ArturRios.Heimdall.Domain.Persistence; |
| | | 8 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 9 | | using ArturRios.Mediator.Command.Interfaces; |
| | | 10 | | using ArturRios.Output; |
| | | 11 | | using Microsoft.EntityFrameworkCore; |
| | | 12 | | |
| | | 13 | | namespace ArturRios.Heimdall.Command.Handlers; |
| | | 14 | | |
| | | 15 | | /// <summary> |
| | | 16 | | /// Handles <see cref="GoogleSignInCommand" /> (UC-25, FR-GO-03…FR-GO-13): verifies the Google ID |
| | | 17 | | /// token, confirms the target scope allows Google sign-in, then either creates a Google User from |
| | | 18 | | /// the token's claims (sign-up, FR-GO-09) or authenticates the one already registered for that |
| | | 19 | | /// Google account in that scope (sign-in, FR-GO-10), and issues an authentication token claiming |
| | | 20 | | /// the <c>User</c> role. |
| | | 21 | | /// </summary> |
| | | 22 | | /// <remarks> |
| | | 23 | | /// The endpoint is anonymous, so it is careful about what a rejection reveals: AF-25a, AF-25d |
| | | 24 | | /// and AF-25g share <see cref="AuthMessages.GoogleAuthenticationFailed" /> and AF-25b answers |
| | | 25 | | /// alike for a missing, deleted, and disabled scope. AF-25c is named separately — the caller has |
| | | 26 | | /// proved the address is theirs, so being told it is taken tells them only about themselves — |
| | | 27 | | /// and that proof is why AF-25f comes first: a token whose address Google does not vouch for is |
| | | 28 | | /// refused before the address is compared with anything. |
| | | 29 | | /// </remarks> |
| | 87 | 30 | | public class GoogleSignInCommandHandler( |
| | 87 | 31 | | IGoogleIdTokenVerifier tokenVerifier, |
| | 87 | 32 | | IAsyncReadOnlyRepository<Scope, long> scopeReader, |
| | 87 | 33 | | IAsyncReadOnlyRepository<Person, long> personReader, |
| | 87 | 34 | | IAsyncReadOnlyRepository<GoogleUser, long> googleUserReader, |
| | 87 | 35 | | IAsyncRepository<GoogleUser, long> googleUserWriter, |
| | 87 | 36 | | IAuthTokenIssuer tokenIssuer, |
| | 87 | 37 | | IAtomicWrites atomicWrites) |
| | | 38 | | : ICommandHandlerAsync<GoogleSignInCommand, GoogleSignInCommandOutput> |
| | | 39 | | { |
| | | 40 | | public async Task<DataOutput<GoogleSignInCommandOutput?>> HandleAsync(GoogleSignInCommand command, CancellationToken |
| | | 41 | | { |
| | 91 | 42 | | var output = DataOutput<GoogleSignInCommandOutput?>.New; |
| | | 43 | | |
| | | 44 | | // UC-25 step 3 (AF-25a, FR-GO-11, NFR-13): verify signature, issuer, audience, and expiry |
| | | 45 | | // before any claim is trusted. Runs before the scope is read, as the specification's sequence |
| | | 46 | | // diagram does — an unverified caller learns nothing about which scopes exist. This is also |
| | | 47 | | // what answers a request that omitted the token entirely, so UC-25 needs no 400 flow. |
| | 91 | 48 | | var payload = await tokenVerifier.VerifyAsync(command.IdToken); |
| | | 49 | | |
| | 91 | 50 | | if (payload is null) |
| | | 51 | | { |
| | 4 | 52 | | return output.WithError(AuthMessages.GoogleAuthenticationFailed); |
| | | 53 | | } |
| | | 54 | | |
| | | 55 | | // AF-25g (FR-GO-20): a caller that names a nonce is owed a token issued for its own sign-in |
| | | 56 | | // attempt, so one carrying another nonce, or none, is refused as an unverifiable token is. |
| | | 57 | | // Ordinal: the nonce is an opaque value the client chose. A request without one compares |
| | | 58 | | // nothing; the server issued no nonce, so this binds the client's attempt, not the token. |
| | 87 | 59 | | if (!string.IsNullOrEmpty(command.Nonce) && |
| | 87 | 60 | | !string.Equals(payload.Nonce, command.Nonce, StringComparison.Ordinal)) |
| | | 61 | | { |
| | 7 | 62 | | return output.WithError(AuthMessages.GoogleAuthenticationFailed); |
| | | 63 | | } |
| | | 64 | | |
| | | 65 | | // FR-GO-21 (AF-25a): a Google ID token is accepted once. Its use is recorded now — once it is |
| | | 66 | | // known to be valid and before anything is read, created or issued on its strength — by one |
| | | 67 | | // insert that also finds an earlier use, so a second presentation, however soon or however |
| | | 68 | | // concurrent, is refused exactly as an invalid token is and leaves nothing behind. |
| | 80 | 69 | | if (!await atomicWrites.TryRecordGoogleIdTokenUseAsync( |
| | 80 | 70 | | GoogleIdTokenUse.KeyOf(payload.TokenId, command.IdToken), payload.ExpiresAt ?? DateTime.UtcNow)) |
| | | 71 | | { |
| | 7 | 72 | | return output.WithError(AuthMessages.GoogleAuthenticationFailed); |
| | | 73 | | } |
| | | 74 | | |
| | | 75 | | // UC-25 step 4 (AF-25b, FR-GO-03/FR-GO-13): the scope must exist, be active, and have the |
| | | 76 | | // setting UC-24 writes switched on. The alternative flow names all three conditions as one |
| | | 77 | | // outcome, so the filter answers for all three. |
| | 73 | 78 | | var scope = await scopeReader.Query() |
| | 73 | 79 | | .FirstOrDefaultAsync(x => |
| | 73 | 80 | | x.PublicId == command.ScopeId && !x.IsDeleted && x.GoogleSignInEnabled); |
| | | 81 | | |
| | 73 | 82 | | if (scope is null) |
| | | 83 | | { |
| | 6 | 84 | | return output.WithError(AuthMessages.GoogleSignInUnavailable); |
| | | 85 | | } |
| | | 86 | | |
| | | 87 | | // UC-25 step 5: look the account up by Google's 'sub' within the scope (FR-GO-08). The lookup |
| | | 88 | | // deliberately omits an !IsDeleted filter: AF-25d exists to reject a logically deleted Google |
| | | 89 | | // User, so it must be found first — the same reason UC-11's person lookup omits one. |
| | 67 | 90 | | var googleUser = await googleUserReader.Query() |
| | 67 | 91 | | .FirstOrDefaultAsync(x => x.ScopeId == scope.Id && x.GoogleId == payload.Subject); |
| | | 92 | | |
| | 67 | 93 | | if (googleUser is null) |
| | | 94 | | { |
| | | 95 | | // UC-25 step 6 (sign-up). |
| | 44 | 96 | | var signUp = await SignUpAsync(payload, scope, output); |
| | | 97 | | |
| | 44 | 98 | | if (signUp.googleUser is null) |
| | | 99 | | { |
| | 16 | 100 | | return signUp.failure!; |
| | | 101 | | } |
| | | 102 | | |
| | 28 | 103 | | googleUser = signUp.googleUser; |
| | | 104 | | } |
| | | 105 | | // NFR-20: an anonymised account is nobody's any more, and its Google subject is no longer |
| | | 106 | | // stored, so the lookup should never find one; this guards the day that assumption breaks. |
| | 23 | 107 | | else if (googleUser.AnonymisedAt is not null) |
| | | 108 | | { |
| | 1 | 109 | | return output.WithError(AuthMessages.GoogleAuthenticationFailed); |
| | | 110 | | } |
| | | 111 | | // NFR-24 (UC-44 step 4): processing is restricted, so the account may not authenticate for |
| | | 112 | | // anything but its subject's own rights over the record — the same subject-rights-only |
| | | 113 | | // token UC-11 issues a restricted person, for the same reason: without it nobody could lift |
| | | 114 | | // their own restriction (UC-45) once their earlier tokens had expired. Checked before |
| | | 115 | | // deletion, because a suspended subject keeps those rights until the record is anonymised. |
| | | 116 | | // Nothing is refreshed from the ID token first: that would be processing the record. |
| | 22 | 117 | | else if (googleUser.ProcessingRestrictedAt is not null) |
| | | 118 | | { |
| | 3 | 119 | | var rightsOnly = await tokenIssuer.IssueSubjectRightsOnlyAsync( |
| | 3 | 120 | | googleUser.PublicId, (int)Roles.User, securityStamp: null); |
| | | 121 | | |
| | 3 | 122 | | return output |
| | 3 | 123 | | .WithData(new GoogleSignInCommandOutput |
| | 3 | 124 | | { |
| | 3 | 125 | | Token = rightsOnly.Token, |
| | 3 | 126 | | ExpiresAt = rightsOnly.ExpiresAt, |
| | 3 | 127 | | EmailVerified = googleUser.EmailVerified, |
| | 3 | 128 | | ProcessingRestricted = true |
| | 3 | 129 | | }) |
| | 3 | 130 | | .WithMessage(AuthMessages.SubjectRightsOnlySignIn); |
| | | 131 | | } |
| | | 132 | | // UC-25 step 7 (AF-25d, FR-GO-12): the account exists but has been logically deleted. |
| | 19 | 133 | | else if (googleUser.IsDeleted) |
| | | 134 | | { |
| | 3 | 135 | | return output.WithError(AuthMessages.GoogleAuthenticationFailed); |
| | | 136 | | } |
| | | 137 | | |
| | | 138 | | // FR-GO-19: the row was populated from the token at sign-up (FR-GO-09) and never touched |
| | | 139 | | // again, so a Google account verified after its first sign-in here kept a stale flag. The |
| | | 140 | | // token just verified is the fresher truth, so the column is brought back into line — a |
| | | 141 | | // no-op on a sign-up, where the two already agree by construction, and a no-op when the |
| | | 142 | | // token carries no email_verified claim at all. |
| | 44 | 143 | | if (!await RefreshEmailVerifiedAsync(googleUser, payload)) |
| | | 144 | | { |
| | | 145 | | // Deleted, restricted or anonymised since the checks above: answered as AF-25d answers a |
| | | 146 | | // deleted account. A restricted one gets its subject-rights-only token on the next attempt. |
| | 1 | 147 | | return output.WithError(AuthMessages.GoogleAuthenticationFailed); |
| | | 148 | | } |
| | | 149 | | |
| | | 150 | | // UC-25 step 8 (FR-GO-04): the token claims the Google User's PublicId, the User role — a |
| | | 151 | | // Google account is never a ScopeAdmin or SystemAdmin — and the one scope it belongs to. |
| | | 152 | | // Internal bigint Ids never reach a token (NFR-15), and OwnedScopeIds is empty because |
| | | 153 | | // ownership is a ScopeAdmin concept. No security stamp (FR-AU-11): a Google User has no |
| | | 154 | | // credential here that could change, so there is nothing for one to revoke on. |
| | 43 | 155 | | var token = await tokenIssuer.IssueAsync(new AuthTokenSubject( |
| | 43 | 156 | | googleUser.PublicId, |
| | 43 | 157 | | string.IsNullOrWhiteSpace(googleUser.Name) ? googleUser.Email : googleUser.Name, |
| | 43 | 158 | | (int)Roles.User, |
| | 43 | 159 | | scope.PublicId, |
| | 43 | 160 | | [], |
| | 43 | 161 | | SecurityStamp: null)); |
| | | 162 | | |
| | 43 | 163 | | return output |
| | 43 | 164 | | .WithData(new GoogleSignInCommandOutput |
| | 43 | 165 | | { |
| | 43 | 166 | | // The stored flag, which the refresh above has already brought into line with the |
| | 43 | 167 | | // token whenever the token had something to say. Reporting the row rather than the |
| | 43 | 168 | | // claim keeps the response answerable when the claim is absent, without the |
| | 43 | 169 | | // published field having to become nullable. |
| | 43 | 170 | | Token = token.Token, ExpiresAt = token.ExpiresAt, EmailVerified = googleUser.EmailVerified |
| | 43 | 171 | | }) |
| | 43 | 172 | | .WithMessage(AuthMessages.GoogleSignInSuccessful); |
| | 91 | 173 | | } |
| | | 174 | | |
| | | 175 | | /// <summary> |
| | | 176 | | /// FR-GO-19: writes the verified token's <c>email_verified</c> back to the stored row when |
| | | 177 | | /// the two disagree, so a returning Google User's flag does not stay frozen at whatever it |
| | | 178 | | /// was on their first sign-in. Nothing is written when they already agree, keeping the |
| | | 179 | | /// ordinary sign-in path read-only, and nothing is written when the token carries no such |
| | | 180 | | /// claim — silence is not an assertion that the address is unverified, so a caller whose |
| | | 181 | | /// client asked for a token without the <c>email</c> scope keeps whatever is stored. |
| | | 182 | | /// </summary> |
| | | 183 | | /// <remarks> |
| | | 184 | | /// The flag and <c>UpdatedAt</c> alone, by a targeted write made only while the account may |
| | | 185 | | /// still sign in as the checks before it found it — not deleted, restricted or anonymised |
| | | 186 | | /// (#205). A whole-row save of the copy read would write those back as read, reviving an |
| | | 187 | | /// account deleted in between. <c>false</c> means the account changed in between, and the |
| | | 188 | | /// sign-in is refused. |
| | | 189 | | /// </remarks> |
| | | 190 | | private async Task<bool> RefreshEmailVerifiedAsync(GoogleUser googleUser, GoogleIdTokenPayload payload) |
| | | 191 | | { |
| | 44 | 192 | | if (payload.EmailVerified is not { } claimed || googleUser.EmailVerified == claimed) |
| | | 193 | | { |
| | 38 | 194 | | return true; |
| | | 195 | | } |
| | | 196 | | |
| | 6 | 197 | | return await atomicWrites.TryRefreshEmailVerifiedAsync(googleUser, claimed, DateTime.UtcNow); |
| | 44 | 198 | | } |
| | | 199 | | |
| | | 200 | | /// <summary> |
| | | 201 | | /// UC-25 step 6 (FR-GO-09): first sign-in with this Google account in this scope, so the |
| | | 202 | | /// Google User is created from the verified claims (FR-GO-05) once Google vouches for the |
| | | 203 | | /// address (AF-25f) and it is confirmed free (AF-25c). |
| | | 204 | | /// </summary> |
| | | 205 | | /// <returns> |
| | | 206 | | /// The created Google User, or the failure output to return instead. A tuple rather than an |
| | | 207 | | /// exception because handlers in this project report failures on the |
| | | 208 | | /// <see cref="DataOutput{T}" />. |
| | | 209 | | /// </returns> |
| | | 210 | | private async Task<(GoogleUser? googleUser, DataOutput<GoogleSignInCommandOutput?>? failure)> |
| | | 211 | | SignUpAsync( |
| | | 212 | | GoogleIdTokenPayload payload, Scope scope, DataOutput<GoogleSignInCommandOutput?> output) |
| | | 213 | | { |
| | | 214 | | // AF-25a: a token issued without the `email` scope carries no address to create the account |
| | | 215 | | // from. Answered as an invalid token, before the address is read for anything, and first of |
| | | 216 | | // all so that a token with no address cannot ask what AF-25f or AF-25c would say about one. |
| | 44 | 217 | | if (string.IsNullOrWhiteSpace(payload.Email)) |
| | | 218 | | { |
| | 3 | 219 | | return (null, output.WithError(AuthMessages.GoogleAuthenticationFailed)); |
| | | 220 | | } |
| | | 221 | | |
| | | 222 | | // AF-25f (FR-GO-07): only an address Google vouches for may take a place in the scope. An |
| | | 223 | | // absent claim proves nothing, so it is refused with a false one. First, so that a token for |
| | | 224 | | // an unproven address cannot ask whether the address is taken either. |
| | 41 | 225 | | if (payload.EmailVerified is not true) |
| | | 226 | | { |
| | 6 | 227 | | return (null, output.WithError(AuthMessages.GoogleEmailNotVerified)); |
| | | 228 | | } |
| | | 229 | | |
| | 35 | 230 | | var email = payload.Email.ToLower(); |
| | | 231 | | |
| | | 232 | | // AF-25c (FR-GO-07): the address must be free within the scope, considered jointly with the |
| | | 233 | | // scope's User persons. Two reads rather than one because the rule spans two tables — the |
| | | 234 | | // unique index on (scope_id, lower(email)) only covers the Google User half. Compared |
| | | 235 | | // case-insensitively (LOWER() in SQL), matching CreateUserCommandHandler. |
| | | 236 | | // |
| | | 237 | | // Logically deleted Google Users count as taking the address, deliberately and unlike the |
| | | 238 | | // person half below. That index does not exclude them either, so a check that did would |
| | | 239 | | // answer "free" and then fail on the insert — a persistence error in place of AF-25c's 409, |
| | | 240 | | // for a caller who could never get past it. FR-GO-12 keeps a deleted row addressable rather |
| | | 241 | | // than erasing it, so the address it holds stays taken until UC-29 removes the row for good. |
| | 35 | 242 | | var takenByGoogleUser = await googleUserReader.Query() |
| | 35 | 243 | | .AnyAsync(x => x.ScopeId == scope.Id && x.Email.ToLower() == email); |
| | | 244 | | |
| | 35 | 245 | | if (takenByGoogleUser) |
| | | 246 | | { |
| | 5 | 247 | | return (null, output.WithError(AuthMessages.EmailAlreadyExists)); |
| | | 248 | | } |
| | | 249 | | |
| | 30 | 250 | | var takenByPerson = await personReader.Query().AnyAsync(person => |
| | 30 | 251 | | !person.IsDeleted && person.Email.ToLower() == email && |
| | 30 | 252 | | person.ScopeMembership != null && person.ScopeMembership.ScopeId == scope.Id); |
| | | 253 | | |
| | 30 | 254 | | if (takenByPerson) |
| | | 255 | | { |
| | 2 | 256 | | return (null, output.WithError(AuthMessages.EmailAlreadyExists)); |
| | | 257 | | } |
| | | 258 | | |
| | | 259 | | // FR-GO-05/06: every field comes from the verified token, and the row is bound to the one |
| | | 260 | | // scope the sign-in was initiated in. Name and picture are optional on the token — a caller |
| | | 261 | | // who granted only the email scope still gets an account, with the fields left empty. The |
| | | 262 | | // address is verified: AF-25f admitted nothing else. |
| | 28 | 263 | | var newGoogleUser = new GoogleUser |
| | 28 | 264 | | { |
| | 28 | 265 | | GoogleId = payload.Subject, |
| | 28 | 266 | | Name = payload.Name ?? string.Empty, |
| | 28 | 267 | | Email = payload.Email, |
| | 28 | 268 | | EmailVerified = true, |
| | 28 | 269 | | ProfilePictureUrl = payload.PictureUrl, |
| | 28 | 270 | | ScopeId = scope.Id |
| | 28 | 271 | | }; |
| | | 272 | | |
| | | 273 | | // NFR-23: recorded here as everywhere else. UC-25 creates an identity without any |
| | | 274 | | // administrator involved, so it is the path where an unrecorded basis would be easiest to |
| | | 275 | | // end up with and hardest to notice. |
| | 28 | 276 | | LegalBasisRecorder.Record(newGoogleUser, scope, DateTime.UtcNow); |
| | | 277 | | |
| | 28 | 278 | | var creation = await googleUserWriter.CreateAsync(newGoogleUser); |
| | | 279 | | |
| | 28 | 280 | | return creation.Success |
| | 28 | 281 | | ? (newGoogleUser, null) |
| | 28 | 282 | | : (null, output.WithErrors(creation.Errors)); |
| | 44 | 283 | | } |
| | | 284 | | } |