phoenix/icarus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 33 Wiki Activity

Endpoint authorization

Browse Source 
Tokens are validated for some of the endpoints. Need to add other measures to rule out bogus tokens.
This commit is contained in:
Kun Deng
2022-08-26 18:01:29 -04:00
parent 2cc13ac9bb
commit d48716a54f
7 changed files with 221 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Controllers/Managers/SongManager.cs
+17 -5
View File
@@ -220,8 +220,9 @@ namespace Icarus.Controllers.Managers
song.SongDirectory = _tempDirectoryRoot;
song.DateCreated = DateTime.Now;
var tempPath = song.SongPath();
using (var filestream = new FileStream(song.SongPath(), FileMode.Create))
using (var filestream = new FileStream(tempPath, FileMode.Create))
{
_logger.Info("Saving song to temporary directory");
await songFile.CopyToAsync(filestream);
@@ -246,11 +247,22 @@ namespace Icarus.Controllers.Managers
using (var fileStream = new FileStream(filePath, FileMode.Create))
{
var songBytes = await System.IO.File.ReadAllBytesAsync(song.SongPath());
var songBytes = await System.IO.File.ReadAllBytesAsync(tempPath);
await System.IO.File.WriteAllBytesAsync(filePath, songBytes);
System.IO.File.Delete(song.SongPath());
song.SongDirectory = dirMgr.SongDirectory;
try
{
if (!System.IO.File.Exists(filePath))
{
await System.IO.File.WriteAllBytesAsync(filePath, songBytes);
System.IO.File.Delete(tempPath);
}
}
catch (Exception ex)
{
var msg = ex.Message;
_logger.Error($"An error occurred: {msg}");
}
// song.SongDirectory = dirMgr.SongDirectory;
_logger.Info("Song successfully saved to filesystem");
}
Controllers/Managers/TokenManager.cs
+63 -3
View File
@@ -20,13 +20,26 @@ using Icarus.Models;
namespace Icarus.Controllers.Managers
{
#region Classes
/**
{
"scope":"download:songs read:song_details upload:songs delete:songs read:albums read:artists update:songs stream:songs read:genre read:year download:cover_art",
"exp":1661616071,
"aud":"http://localhost:5002",
"iss":"http://localhost:5002",
"iat":1661529671
}
*/
public class TokenManager : BaseManager
{
#region Fields
private string _clientId;
private string _clientSecret;
private string _privateKeyPath;
private string _privateKey;
private string _publicKeyPath;
private string _publicKey;
private string _audience;
private string _grantType;
private string _url;
@@ -70,7 +83,7 @@ namespace Icarus.Controllers.Managers
_logger.Info("Deserializing response");
var tokenResult = JsonConvert
.DeserializeObject<Token>(response.Content);
.DeserializeObject<TokenTierOne>(response.Content);
_logger.Info("Response deserialized");
return new LoginResult
@@ -84,7 +97,7 @@ namespace Icarus.Controllers.Managers
public LoginResult LogIn(User user)
{
var tokenResult = new Token();
var tokenResult = new TokenTierOne();
tokenResult.TokenType = "Jwt";
var privateKey = ReadKeyContent(_privateKeyPath).Result;
@@ -110,6 +123,50 @@ namespace Icarus.Controllers.Managers
};
}
public bool IsTokenValid(string scope, string accessToken)
{
var result = false;
var token = DecodeToken(accessToken);
if (token == null)
{
return result;
}
result = (!token.TokenExpired() && token.ContainsScope(scope)) ? true : false;
// What would make a token valid?
// 1. The expiration date must be before the current date
// 2. The desired scope must be part of the scopes within the access token
// 3. Must be able to be decoded
return result;
}
public Token? DecodeToken(string accessToken)
{
var rsaParams = GetRSAPublic(_publicKey);
Token tok = null;
using (var rsa = new RSACryptoServiceProvider())
{
rsa.ImportParameters(rsaParams);
IJsonSerializer serializer = new JsonNetSerializer();
IDateTimeProvider provider = new UtcDateTimeProvider();
IJwtValidator validator = new JwtValidator(serializer, provider);
IBase64UrlEncoder urlEncoder = new JwtBase64UrlEncoder();
var algorithm = new JWT.Algorithms.RS256Algorithm(rsa);
IJwtDecoder decoder = new JwtDecoder(serializer, validator, urlEncoder, algorithm);
var json = decoder.Decode(accessToken);
tok = JsonConvert.DeserializeObject<Token>(json);
}
return tok;
}
private string AllScopes()
{
@@ -269,6 +326,8 @@ namespace Icarus.Controllers.Managers
_url = $"https://{_config["Auth0:Domain"]}";
_privateKeyPath = _config["RSAKeys:PrivateKeyPath"];
_publicKeyPath = _config["RSAKeys:PublicKeyPath"];
_privateKey = System.IO.File.ReadAllText(_privateKeyPath);
_publicKey = System.IO.File.ReadAllText(_publicKeyPath);
PrintCredentials();
}
@@ -299,7 +358,7 @@ namespace Icarus.Controllers.Managers
[JsonProperty("grant_type")]
public string GrantType { get; set; }
}
private class Token
private class TokenTierOne
{
[JsonProperty("access_token")]
public string AccessToken { get; set; }
@@ -310,4 +369,5 @@ namespace Icarus.Controllers.Managers
}
#endregion
}
#endregion
}
Controllers/v1/SongController.cs
+33 -1
View File
@@ -43,10 +43,40 @@ namespace Icarus.Controllers.V1
#endregion
#region Methods
private string ParseBearerTokenFromHeader()
{
var token = string.Empty;
const string tokenType = "Bearer";
var req = Request;
var auth = req.Headers.Authorization;
var val = auth.ToString();
if (val.Contains(tokenType) && val.Split(" ").Count() > 1)
{
var split = val.Split(" ");
token = split[1];
}
return token;
}
#region HTTP Endpoints
[HttpGet]
[Authorize("read:song_details")]
// [Authorize("read:song_details")]
public IActionResult Get()
{
var token = ParseBearerTokenFromHeader();
var tokMgr = new TokenManager(_config);
if (!tokMgr.IsTokenValid("read:song_details", token))
{
return StatusCode(401, "Not allowed");
}
List<Song> songs = new List<Song>();
Console.WriteLine("Attemtping to retrieve songs");
_logger.LogInformation("Attempting to retrieve songs");
@@ -100,5 +130,7 @@ namespace Icarus.Controllers.V1
return Ok(songRes);
}
#endregion
#endregion
}
}
Controllers/v1/SongDataController.cs
+30 -1
View File
@@ -47,6 +47,27 @@ namespace Icarus.Controllers.V1
#endregion
private string ParseBearerTokenFromHeader()
{
var token = string.Empty;
const string tokenType = "Bearer";
const string otherTokenType = "Jwt";
var req = Request;
var auth = req.Headers.Authorization;
var val = auth.ToString();
if (val.Contains(tokenType) && val.Split(" ").Count() > 1 ||
val.Contains(otherTokenType) && val.Split(" ").Count() > 1)
{
var split = val.Split(" ");
token = split[1];
}
return token;
}
[HttpGet("download/{id}")]
[Route("private-scoped")]
@@ -112,9 +133,17 @@ namespace Icarus.Controllers.V1
//
[HttpPost("upload/with/data")]
[Route("private-scoped")]
[Authorize("upload:songs")]
// [Authorize("upload:songs")]
public async Task<IActionResult> Post ([FromForm] UploadSongWithDataForm up)
{
var token = ParseBearerTokenFromHeader();
var tokMgr = new TokenManager(_config);
if (!tokMgr.IsTokenValid("upload:songs", token))
{
return StatusCode(401, "Not allowed");
}
try
{
if (up.SongData.Length > 0 && up.CoverArtData.Length > 0 && !string.IsNullOrEmpty(up.SongFile))
Controllers/v1/SongStreamController.cs
+31 -1
View File
@@ -13,6 +13,7 @@ using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Logging;
using Icarus.Models;
using Icarus.Controllers.Managers;
using Icarus.Database.Contexts;
namespace Icarus.Controllers.V1
@@ -42,11 +43,40 @@ namespace Icarus.Controllers.V1
#endregion
private string ParseBearerTokenFromHeader()
{
var token = string.Empty;
const string tokenType = "Bearer";
var req = Request;
var auth = req.Headers.Authorization;
var val = auth.ToString();
if (val.Contains(tokenType) && val.Split(" ").Count() > 1)
{
var split = val.Split(" ");
token = split[1];
}
return token;
}
#region HTTP endpoints
[HttpGet("{id}")]
[Authorize("stream:songs")]
// [Authorize("stream:songs")]
public async Task<IActionResult> Get(int id)
{
var token = ParseBearerTokenFromHeader();
var tokMgr = new TokenManager(_config);
/**
if (!tokMgr.IsTokenValid("stream:songs", token))
{
return StatusCode(401, "Not allowed");
}
*/
var context = new SongContext(_config.GetConnectionString("DefaultConnection"));
var song = context.Songs.FirstOrDefault(sng => sng.SongID == id);