Merge pull request #86 from kdeng00/deprecate_asymmetric_keys

Deprecating asymmetric keys. Closes #84

.github/workflows/dotnet.yml

@@ -0,0 +1,25 @@
+name: .NET
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v2
+      with:
+        dotnet-version: 6.0.x
+    - name: Restore dependencies
+      run: dotnet restore
+    - name: Build
+      run: dotnet build --no-restore
+    - name: Test
+      run: dotnet test --no-build --verbosity normal

Controllers/Managers/TokenManager.cs

@@ -5,7 +5,6 @@ using System.Security.Claims;
 using System.Security.Cryptography;
 using System.Threading.Tasks;
 using System.IdentityModel.Tokens.Jwt;
-using System.Security.Claims;
 using System.Text;
 
 using JWT;
@@ -30,10 +29,10 @@ namespace Icarus.Controllers.Managers
         #region Fields
         private string _clientId;
         private string _clientSecret;
-        private string _privateKeyPath;
+        private string _privateKeyPath = string.Empty;
-        private string _privateKey;
+        private string _privateKey = string.Empty;
-        private string _publicKeyPath;
+        private string _publicKeyPath = string.Empty;
-        private string _publicKey;
+        private string _publicKey = string.Empty;
         private string _audience;
         private string _grantType;
         private string _url;
@@ -89,6 +88,7 @@ namespace Icarus.Controllers.Managers
         }
 
 
+        [Obsolete("Asymmetric key signing for tokens have been deprecated")]
         public LoginResult LogIn(User user)
         {
             var tokenResult = new TokenTierOne();
@@ -123,6 +123,8 @@ namespace Icarus.Controllers.Managers
             tokenResult.TokenType = "Jwt";
 
             var payload = Payload();
+            payload.Add(new System.Security.Claims.Claim("user_id", user.UserID.ToString(), ClaimValueTypes.Integer));
+
             var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["JWT:Secret"]));
             var signIn = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
             var token = new JwtSecurityToken(
@@ -151,6 +153,7 @@ namespace Icarus.Controllers.Managers
             };
         }
 
+        [Obsolete("Asymmetric key signing for tokens have been deprecated")]
         public bool IsTokenValid(string scope, string accessToken)
         {
             var result = false;
@@ -171,7 +174,8 @@ namespace Icarus.Controllers.Managers
             return result;
         }
 
-        public Token? DecodeToken(string accessToken)
+        [Obsolete("Asymmetric key signing for tokens have been deprecated")]
+        public Token DecodeToken(string accessToken)
         {
             var rsaParams = GetRSAPublic(_publicKey);
             Token tok = null;
@@ -263,6 +267,7 @@ namespace Icarus.Controllers.Managers
             return claim;
         }
 
+        [Obsolete("Asymmetric key signing for tokens have been deprecated")]
         private string CreateToken(List<Claim> claims, string privateKey)
         {
             var token = string.Empty;
@@ -322,6 +327,7 @@ namespace Icarus.Controllers.Managers
             return token;
         }
 
+        [Obsolete("Asymmetric key signing for tokens have been deprecated")]
         private RSAParameters GetRSAPublic(string publicKey)
         {
             using (var tr = new System.IO.StringReader(publicKey))
@@ -361,12 +367,6 @@ namespace Icarus.Controllers.Managers
             _audience = _config["Auth0:ApiIdentifier"];
             _grantType = "client_credentials";
             _url = $"https://{_config["Auth0:Domain"]}";
-            _privateKeyPath = _config["RSAKeys:PrivateKeyPath"];
-            _publicKeyPath = _config["RSAKeys:PublicKeyPath"];
-            _privateKey = System.IO.File.ReadAllText(_privateKeyPath);
-            _publicKey = System.IO.File.ReadAllText(_publicKeyPath);
-
-            PrintCredentials();
         }
 
         #region Testing Methods

Controllers/v1/ArtistController.cs

@@ -53,11 +53,6 @@ namespace Icarus.Controllers.V1
         [HttpGet("{id}")]
         public IActionResult GetArtist(int id)
         {
-            if (!IsTokenValid("read:artists"))
-            {
-                return StatusCode(401, "Not allowed");
-            }
-
             Artist artist = new Artist
             {
                 ArtistID = id

Controllers/v1/BaseController.cs

@@ -18,6 +18,7 @@ namespace Icarus.Controllers.V1
 
         #region Methods
         [ApiExplorerSettings(IgnoreApi = true)]
+        [Obsolete("Asymmetric key signing for tokens have been deprecated")]
         protected string ParseBearerTokenFromHeader()
         {
             var token = string.Empty;
@@ -39,6 +40,7 @@ namespace Icarus.Controllers.V1
         } 
 
         [ApiExplorerSettings(IgnoreApi = true)]
+        [Obsolete("Asymmetric key signing for tokens have been deprecated")]
         protected bool IsTokenValid(string scope)
         {
             var token = ParseBearerTokenFromHeader();
@@ -48,4 +50,4 @@ namespace Icarus.Controllers.V1
         }
         #endregion
     }
-}
+}

Icarus.csproj

@@ -20,7 +20,7 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="MySql.EntityFrameworkCore" Version="5.0.8" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.2" />
     <PackageReference Include="NLog.Web.AspNetCore" Version="4.14.0" />
     <PackageReference Include="Portable.BouncyCastle" Version="1.9.0" />
     <PackageReference Include="RestSharp" Version="106.15.0" />

appsettings.Development.json

@@ -12,10 +12,6 @@
 	  "ClientId": "",
 	  "ClientSecret": ""
   },
-  "RSAKeys": {
-    "PrivateKeyPath": "",
-    "PublicKeyPath": ""
-  },
   "JWT": {
     "Issuer": "",
     "Audience": "",

appsettings.json

@@ -12,10 +12,6 @@
 	  "ClientId": "",
 	  "ClientSecret": ""
   },
-  "RSAKeys": {
-    "PrivateKeyPath": "",
-    "PublicKeyPath": ""
-  },
   "JWT": {
     "Issuer": "",
     "Audience": "",