| | | 1 | | using ArturRios.Data.Relational.Core.DependencyInjection; |
| | | 2 | | using ArturRios.Heimdall.Command.Services; |
| | | 3 | | using ArturRios.Heimdall.WebApi.Security; |
| | | 4 | | using ArturRios.Util.WebApi.Configuration; |
| | | 5 | | using ArturRios.Util.WebApi.Security.Extensions; |
| | | 6 | | using Serilog; |
| | | 7 | | |
| | | 8 | | namespace ArturRios.Heimdall.WebApi; |
| | | 9 | | |
| | | 10 | | public static class GoogleSignInRegistrationExtensions |
| | | 11 | | { |
| | | 12 | | /// <summary> |
| | | 13 | | /// Chooses how UC-25 verifies a Google ID token (FR-GO-11, NFR-13). With Google client IDs |
| | | 14 | | /// configured, tokens are validated against Google; without them, every token is refused, so |
| | | 15 | | /// an unconfigured deployment answers 401 rather than trusting a token no one checked. |
| | | 16 | | /// </summary> |
| | | 17 | | /// <remarks> |
| | | 18 | | /// The third branch exists for the functional suite, which cannot override a DI registration |
| | | 19 | | /// (<c>WebApiTest<T></c> exposes neither its factory nor a settable gateway) and must |
| | | 20 | | /// still reach the flows behind verification. It is guarded twice — never in Production, and |
| | | 21 | | /// never without an explicitly set signing secret — and is checked before the real verifier so |
| | | 22 | | /// a test environment cannot accidentally run both. See <see cref="LocalGoogleIdTokenVerifier" />. |
| | | 23 | | /// </remarks> |
| | | 24 | | public static IServiceCollection AddGoogleSignIn(this IServiceCollection services, IHostEnvironment environment) |
| | | 25 | | { |
| | 973 | 26 | | var options = GoogleSignInOptions.FromEnvironment(); |
| | | 27 | | |
| | 973 | 28 | | services.AddSingleton(options); |
| | | 29 | | |
| | 973 | 30 | | if (!environment.IsProduction() && options.TestSigningConfigured) |
| | | 31 | | { |
| | 973 | 32 | | Log.Warning( |
| | 973 | 33 | | "Google ID tokens will be verified against a local signing secret ({Variable}), not " + |
| | 973 | 34 | | "against Google. This is for automated tests only", |
| | 973 | 35 | | GoogleSignInOptions.TestSigningSecretVariable); |
| | | 36 | | |
| | 973 | 37 | | services.AddScoped<IGoogleIdTokenVerifier, LocalGoogleIdTokenVerifier>(); |
| | | 38 | | |
| | 973 | 39 | | return services; |
| | | 40 | | } |
| | | 41 | | |
| | 0 | 42 | | if (!options.GoogleConfigured) |
| | | 43 | | { |
| | 0 | 44 | | Log.Warning( |
| | 0 | 45 | | "No Google client is configured ({Variable}); Google sign-in (UC-25) will refuse " + |
| | 0 | 46 | | "every token", |
| | 0 | 47 | | GoogleSignInOptions.ClientIdsVariable); |
| | | 48 | | |
| | 0 | 49 | | services.AddScoped<IGoogleIdTokenVerifier, UnconfiguredGoogleIdTokenVerifier>(); |
| | | 50 | | |
| | 0 | 51 | | return services; |
| | | 52 | | } |
| | | 53 | | |
| | 0 | 54 | | services.AddScoped<IGoogleIdTokenVerifier, GoogleIdTokenVerifier>(); |
| | | 55 | | |
| | 0 | 56 | | return services; |
| | | 57 | | } |
| | | 58 | | } |