| | | 1 | | using System.Security.Claims; |
| | | 2 | | using System.Text.Encodings.Web; |
| | | 3 | | using Microsoft.AspNetCore.Authentication; |
| | | 4 | | using Microsoft.Extensions.Logging; |
| | | 5 | | using Microsoft.Extensions.Options; |
| | | 6 | | |
| | | 7 | | namespace Intentum.AspNetCore.Auth; |
| | | 8 | | |
| | | 9 | | /// <summary> |
| | | 10 | | /// Authentication handler that validates API keys from the X-Api-Key header or query parameter. |
| | | 11 | | /// </summary> |
| | | 12 | | public sealed class ApiKeyAuthenticationHandler : AuthenticationHandler<ApiKeyAuthenticationOptions> |
| | | 13 | | { |
| | | 14 | | public const string SchemeName = "ApiKey"; |
| | | 15 | | private const string ApiKeyHeaderName = "X-Api-Key"; |
| | | 16 | | private const string ApiKeyQueryName = "api_key"; |
| | | 17 | | |
| | | 18 | | public ApiKeyAuthenticationHandler( |
| | | 19 | | IOptionsMonitor<ApiKeyAuthenticationOptions> options, |
| | | 20 | | ILoggerFactory logger, |
| | | 21 | | UrlEncoder encoder) |
| | 0 | 22 | | : base(options, logger, encoder) |
| | 0 | 23 | | { |
| | 0 | 24 | | } |
| | | 25 | | |
| | | 26 | | protected override Task<AuthenticateResult> HandleAuthenticateAsync() |
| | 0 | 27 | | { |
| | 0 | 28 | | if (!TryGetApiKey(out var apiKey)) |
| | 0 | 29 | | return Task.FromResult(AuthenticateResult.NoResult()); |
| | | 30 | | |
| | 0 | 31 | | var validKey = Options.ValidKeys.FirstOrDefault(k => k.Key == apiKey); |
| | 0 | 32 | | if (validKey == null) |
| | 0 | 33 | | return Task.FromResult(AuthenticateResult.Fail("Invalid API key")); |
| | | 34 | | |
| | 0 | 35 | | var claims = new List<Claim> |
| | 0 | 36 | | { |
| | 0 | 37 | | new(ClaimTypes.Name, validKey.Name), |
| | 0 | 38 | | new(ClaimTypes.NameIdentifier, validKey.Key), |
| | 0 | 39 | | }; |
| | 0 | 40 | | foreach (var role in validKey.Roles) |
| | 0 | 41 | | claims.Add(new Claim(ClaimTypes.Role, role)); |
| | | 42 | | |
| | 0 | 43 | | var identity = new ClaimsIdentity(claims, SchemeName); |
| | 0 | 44 | | var principal = new ClaimsPrincipal(identity); |
| | 0 | 45 | | var ticket = new AuthenticationTicket(principal, SchemeName); |
| | | 46 | | |
| | 0 | 47 | | return Task.FromResult(AuthenticateResult.Success(ticket)); |
| | 0 | 48 | | } |
| | | 49 | | |
| | | 50 | | private bool TryGetApiKey(out string apiKey) |
| | 0 | 51 | | { |
| | 0 | 52 | | apiKey = ""; |
| | | 53 | | |
| | 0 | 54 | | if (Request.Headers.TryGetValue(ApiKeyHeaderName, out var headerValue) && |
| | 0 | 55 | | !string.IsNullOrWhiteSpace(headerValue)) |
| | 0 | 56 | | { |
| | 0 | 57 | | apiKey = headerValue.ToString(); |
| | 0 | 58 | | return true; |
| | | 59 | | } |
| | | 60 | | |
| | 0 | 61 | | if (Request.Query.TryGetValue(ApiKeyQueryName, out var queryValue) && |
| | 0 | 62 | | !string.IsNullOrWhiteSpace(queryValue)) |
| | 0 | 63 | | { |
| | 0 | 64 | | apiKey = queryValue.ToString(); |
| | 0 | 65 | | return true; |
| | | 66 | | } |
| | | 67 | | |
| | 0 | 68 | | return false; |
| | 0 | 69 | | } |
| | | 70 | | } |
| | | 71 | | |
| | | 72 | | /// <summary> |
| | | 73 | | /// Options for API key authentication. |
| | | 74 | | /// </summary> |
| | | 75 | | public sealed class ApiKeyAuthenticationOptions : AuthenticationSchemeOptions |
| | | 76 | | { |
| | | 77 | | public List<ApiKeyEntry> ValidKeys { get; set; } = []; |
| | | 78 | | } |
| | | 79 | | |
| | | 80 | | /// <summary> |
| | | 81 | | /// Represents a registered API key with associated name and roles. |
| | | 82 | | /// </summary> |
| | | 83 | | public sealed class ApiKeyEntry |
| | | 84 | | { |
| | | 85 | | public required string Key { get; init; } |
| | | 86 | | public required string Name { get; init; } |
| | | 87 | | public List<string> Roles { get; init; } = []; |
| | | 88 | | } |