Implemented initial session token exchange.

eben-roux · eben-roux · commit 1844eef2854d · 2025-01-12T08:45:22.000+02:00
diff --git a/Shuttle.Access.Application/RegisterSessionParticipant.cs b/Shuttle.Access.Application/RegisterSessionParticipant.cs
@@ -146,7 +146,7 @@ async Task SaveAsync()
 
                 await _sessionTokenExchangeRepository.SaveAsync(sessionTokenExchange, context.CancellationToken);
 
-                message.WithSessionTokenExchangeUrl($"{message.KnownApplicationOptions!.SessionTokenExchangeUrl}/{sessionTokenExchange.ExchangeToken}");
+                message.WithSessionTokenExchangeUrl($"{message.KnownApplicationOptions!.SessionTokenExchangeUrl.TrimEnd('/')}/{sessionTokenExchange.ExchangeToken}");
             }
         }
     }
diff --git a/Shuttle.Access.Vue/package-lock.json b/Shuttle.Access.Vue/package-lock.json
diff --git a/Shuttle.Access.Vue/package.json b/Shuttle.Access.Vue/package.json
@@ -14,6 +14,7 @@
     "@mdi/font": "7.4.47",
     "@vuelidate/core": "^2.0.3",
     "@vuelidate/validators": "^2.0.4",
+    "@vueuse/core": "^12.4.0",
     "axios": "^1.7.9",
     "moment": "^2.30.1",
     "roboto-fontface": "*",
diff --git a/Shuttle.Access.Vue/src/access.d.ts b/Shuttle.Access.Vue/src/access.d.ts
@@ -128,7 +128,7 @@ export type SessionResponse = {
   result: string;
   token: string;
   tokenExpiryDate: string;
-  exchangeTokenUrl?: string;
+  sessionTokenExchangeUrl?: string;
 };
 
 export type SessionStoreState = {
@@ -137,5 +137,4 @@ export type SessionStoreState = {
   identityName?: string;
   token?: string;
   permissions: SessionPermission[];
-  applicationName?: string;
 };
diff --git a/Shuttle.Access.Vue/src/components/Navbar.vue b/Shuttle.Access.Vue/src/components/Navbar.vue
@@ -66,8 +66,6 @@ const items = computed(() => {
   const result: any[] = [];
 
   map.forEach((item: NavigationItem) => {
-    var add = false;
-
     if (!item.permission || sessionStore.hasPermission(item.permission)) {
       result.push({
         title: t(item.title),
diff --git a/Shuttle.Access.Vue/src/locales/en.json b/Shuttle.Access.Vue/src/locales/en.json
@@ -13,7 +13,6 @@
   "deactivated": "Deactivated",
   "exceptions": {
     "oauth-error": "An error occurred while attempting to authenticate with the OAuth provider: {error}",
-    "session-initialize": "Your session has expired.  Please sign in again.",
     "invalid-credentials": "Invalid credentials.",
     "insufficient-permission": "You do not have permission to access the requested view.  Please contact your system administrator if you require access."
   },
@@ -68,6 +67,7 @@
   "status": "Status",
   "submit": "Submit",
   "table-empty": "(no results)",
+  "token": "Token",
   "identity-required": "No identities have been registered.  You will be registered as an administrator.",
   "yes": "Yes"
 }
diff --git a/Shuttle.Access.Vue/src/main.ts b/Shuttle.Access.Vue/src/main.ts
@@ -20,24 +20,20 @@ app.use(router);
 
 registerPlugins(app);
 
-const alertStore = useAlertStore();
 const sessionStore = useSessionStore();
 
 if (window.location.pathname !== "/oauth") {
   await sessionStore.initialize().catch((error) => {
-    alertStore.add({
-      message: i18n.global.t("exceptions.session-initialize", {
-        error: error.toString(),
-      }),
-      type: "error",
-      name: "session-initialize",
-    });
-
-    router.push({ path: "/signin" });
+    if (!window.location.pathname.startsWith("/signin")) {
+      router.push({ path: "/signin" });
+    }
   });
 }
 
-if (window.location.pathname === "/") {
+if (
+  window.location.pathname === "/" ||
+  window.location.pathname === "/signin"
+) {
   router.push({ path: sessionStore.authenticated ? "/dashboard" : "/signin" });
 }
 
diff --git a/Shuttle.Access.Vue/src/router/index.ts b/Shuttle.Access.Vue/src/router/index.ts
@@ -41,7 +41,7 @@ const routes: Array<RouteRecordRaw> = [
     },
   },
   {
-    path: "/oauth/:",
+    path: "/oauth",
     name: "oauth",
     component: () => import("../views/OAuth.vue"),
   },
diff --git a/Shuttle.Access.Vue/src/stores/session.ts b/Shuttle.Access.Vue/src/stores/session.ts
@@ -24,9 +24,6 @@ export const useSessionStore = defineStore("session", {
     status(): string {
       return !this.token ? "not-signed-in" : "signed-in";
     },
-    applicationName(): string | undefined {
-      return this.applicationName;
-    },
   },
   actions: {
     async initialize() {
diff --git a/Shuttle.Access.Vue/src/views/OAuth.vue b/Shuttle.Access.Vue/src/views/OAuth.vue
@@ -49,6 +49,12 @@ onMounted(() => {
       var data = response.data;
       var params = { identityName: data.identityName };
 
+      if (response.data.sessionTokenExchangeUrl) {
+        window.location.replace(response.data.sessionTokenExchangeUrl);
+
+        return;
+      }
+
       if (data.result === "UnknownIdentity") {
         alertStore.add({
           message: data.registrationRequested ? t("messages.oauth-unknown-identity-registered", params) : t("messages.oauth-unknown-identity", params),
@@ -62,8 +68,6 @@ onMounted(() => {
       }
 
       router.push({ name: "dashboard" });
-
-      alertStore.remove("session-initialize");
     })
     .catch(error => {
       alertStore.add({
diff --git a/Shuttle.Access.Vue/src/views/Sessions.vue b/Shuttle.Access.Vue/src/views/Sessions.vue
@@ -17,6 +17,10 @@
         <v-btn :icon="mdiDeleteOutline" size="x-small"
           @click="confirmationStore.show({ item: item, onConfirm: remove })" v-tooltip:end="$t('remove')" />
       </template>
+      <template v-slot:item.token="{ item }">
+        <span class="font-mono">{{ item.token }}</span>
+        <v-btn v-if="isSupported" :icon="mdiContentCopy" size="x-small" @click="copy(item.token)" class="ml-2"></v-btn>
+      </template>
       <template #expanded-row="{ columns, item }">
         <tr>
           <td :colspan="columns.length">
@@ -45,8 +49,8 @@
 import api from "@/api";
 import { onMounted, ref } from "vue";
 import { useI18n } from "vue-i18n";
-import { mdiAccountMultipleMinusOutline, mdiDeleteOutline, mdiMagnify, mdiRefresh, mdiShieldOffOutline, mdiShieldOutline } from '@mdi/js';
-import { useRouter } from "vue-router";
+import { useClipboard, usePermission } from '@vueuse/core'
+import { mdiAccountMultipleMinusOutline, mdiContentCopy, mdiDeleteOutline, mdiMagnify, mdiRefresh, mdiShieldOffOutline, mdiShieldOutline } from '@mdi/js';
 import { useConfirmationStore } from "@/stores/confirmation";
 import { useSecureTableHeaders } from "@/composables/useSecureTableHeaders";
 import Permissions from "@/permissions";
@@ -59,10 +63,10 @@ const confirmationStore = useConfirmationStore();
 const sessionStore = useSessionStore();
 
 const { t } = useI18n({ useScope: 'global' });
-const router = useRouter();
 const busy: Ref<boolean> = ref(false);
 const search: Ref<string> = ref('')
 const expanded: Ref<string[]> = ref([])
+const { isSupported, copy } = useClipboard()
 
 const headers = useSecureTableHeaders([
   {
@@ -91,6 +95,10 @@ const headers = useSecureTableHeaders([
       return useDateTimeFormatter(item.expiryDate);
     }
   },
+  {
+    title: t("token"),
+    value: "token",
+  },
 ]);
 
 const items: Ref<Session[]> = ref([]);
diff --git a/Shuttle.Access.Vue/src/views/SignIn.vue b/Shuttle.Access.Vue/src/views/SignIn.vue
@@ -118,22 +118,13 @@ const signIn = async () => {
     applicationName: props.applicationName
   })
     .then((response: AxiosResponse<SessionResponse>) => {
-      if (props.applicationName) {
-        if (response.data.exchangeTokenUrl) {
-          window.location.replace(response.data.exchangeTokenUrl);
-        } else {
-          alertStore.add({
-            message: t("exceptions.invalid-credentials"),
-            type: "error",
-            name: "sign-in-exception"
-          });
-        }
+      if (response.data.sessionTokenExchangeUrl) {
+        window.location.replace(response.data.sessionTokenExchangeUrl);
+
         return;
-      };
+      }
 
       router.push({ name: "dashboard" });
-
-      alertStore.remove("session-initialize");
     })
     .catch(error => {
       alertStore.add({
@@ -151,7 +142,7 @@ const oauthAuthenticate = (name: string) => {
   busy.value = true;
 
   api
-    .get("v1/oauth/authenticate/" + name)
+    .get(`v1/oauth/authenticate/${name}${props.applicationName ? `/${props.applicationName}` : ""}`)
     .then((response) => {
       window.location.replace(response?.data?.authorizationUrl);
     })
@@ -196,8 +187,6 @@ const fetchApplication = async () => {
 onMounted(async () => {
   await refreshOAuthProviders();
 
-  sessionStore.$state.applicationName = props.applicationName;
-
   if (props.applicationName) {
     await fetchApplication();
   }
diff --git a/Shuttle.Access.WebApi/Endpoints/OAuthEndpoints.cs b/Shuttle.Access.WebApi/Endpoints/OAuthEndpoints.cs
@@ -1,7 +1,9 @@
 ﻿using System.Text;
 using Asp.Versioning;
 using Asp.Versioning.Builder;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
+using Microsoft.Identity.Client;
 using Shuttle.Access.Application;
 using Shuttle.Access.Messages.v1;
 using Shuttle.Core.Contract;
@@ -48,7 +50,7 @@ public static WebApplication MapOAuthEndpoints(this WebApplication app, ApiVersi
             .WithApiVersionSet(versionSet)
             .MapToApiVersion(apiVersion1);
 
-        app.MapGet("/v{version:apiVersion}/oauth/authenticate/{providerName}", async (ILogger<OAuthService> logger, IOptions<OAuthOptions> oauthOptions, IOAuthService oauthService, string providerName) =>
+        app.MapGet("/v{version:apiVersion}/oauth/authenticate/{providerName}/{applicationName?}", async (ILogger<OAuthService> logger, IOptions<AccessOptions> accessOptions, IOptions<OAuthOptions> oauthOptions, IOAuthService oauthService, string providerName, string? applicationName) =>
             {
                 if (string.IsNullOrWhiteSpace(providerName))
                 {
@@ -57,9 +59,21 @@ public static WebApplication MapOAuthEndpoints(this WebApplication app, ApiVersi
 
                 logger.LogDebug($"[oauth/register] : provider = '{providerName}'");
 
-                var grant = await oauthService.RegisterAsync(providerName);
+                var data = new Dictionary<string, string>();
 
-                logger.LogDebug($"[oauth/registered] : grant id = '{grant.Id}' / provider = '{providerName}'");
+                if (!string.IsNullOrWhiteSpace(applicationName))
+                {
+                    if (Guard.AgainstNull(accessOptions.Value).KnownApplications.FirstOrDefault(item => item.Name.Equals(applicationName, StringComparison.InvariantCultureIgnoreCase)) == null)
+                    {
+                        return Results.BadRequest($"Unknown application name '{applicationName}'.");
+                    }
+
+                    data.Add("ApplicationName", applicationName);
+                }
+
+                var grant = await oauthService.RegisterAsync(providerName, data);
+
+                logger.LogDebug($"[oauth/registered] : grant id = '{grant.Id}' / provider = '{providerName}' / application name = '{(string.IsNullOrWhiteSpace(applicationName) ? string.Empty : applicationName)}'");
 
                 var oauthOptionsValue = Guard.AgainstNull(Guard.AgainstNull(oauthOptions).Value);
                 var oauthProviderOptions = oauthOptionsValue.GetProviderOptions(providerName);
@@ -93,8 +107,7 @@ public static WebApplication MapOAuthEndpoints(this WebApplication app, ApiVersi
 
         app.MapGet("/v{version:apiVersion}/oauth/session/{state}/{code}", async (ILogger<OAuthService> logger, IOptions<AccessOptions> accessOptions, IOptions<OAuthOptions> oauthOptions, IOAuthService oauthService, IOAuthGrantRepository oauthGrantRepository, IDatabaseContextFactory databaseContextFactory, IMediator mediator, string state, string code) =>
             {
-                if (string.IsNullOrWhiteSpace(state) ||
-                    !Guid.TryParse(state, out var requestId))
+                if (string.IsNullOrWhiteSpace(state) || !Guid.TryParse(state, out var requestId))
                 {
                     return Results.BadRequest();
                 }
@@ -119,6 +132,20 @@ public static WebApplication MapOAuthEndpoints(this WebApplication app, ApiVersi
 
                 var registerSession = new RegisterSession(email).UseDirect();
 
+                if (grant.HasData("ApplicationName"))
+                {
+                    var applicationName = grant.GetData("ApplicationName");
+
+                    var knownApplicationOptions = Guard.AgainstNull(accessOptions.Value).KnownApplications.FirstOrDefault(item => item.Name.Equals(applicationName, StringComparison.InvariantCultureIgnoreCase));
+
+                    if (knownApplicationOptions == null)
+                    {
+                        return Results.BadRequest($"Unknown application name '{applicationName}'.");
+                    }
+
+                    registerSession.WithKnownApplicationOptions(knownApplicationOptions);
+                }
+
                 using (new DatabaseContextScope())
                 await using (databaseContextFactory.Create())
                 {
@@ -152,6 +179,7 @@ public static WebApplication MapOAuthEndpoints(this WebApplication app, ApiVersi
                     sessionResponse.Token = registerSession.Session.Token;
                     sessionResponse.TokenExpiryDate = registerSession.Session.ExpiryDate;
                     sessionResponse.Permissions = registerSession.Session.Permissions.ToList();
+                    sessionResponse.SessionTokenExchangeUrl = registerSession.SessionTokenExchangeUrl;
                 }
 
                 return Results.Ok(sessionResponse);
diff --git a/Shuttle.Access.WebApi/Endpoints/SessionEndpoints.cs b/Shuttle.Access.WebApi/Endpoints/SessionEndpoints.cs
@@ -183,6 +183,11 @@ public static WebApplication MapSessionEndpoints(this WebApplication app, ApiVer
 
                     await sessionTokenExchangeRepository.RemoveAsync(token);
 
+                    if (sessionTokenExchange.HasExpired)
+                    {
+                        return Results.BadRequest();
+                    }
+
                     var session = (await sessionQuery.SearchAsync(new DataAccess.Session.Specification().WithToken(sessionTokenExchange.SessionToken).IncludePermissions())).FirstOrDefault();
 
                     return session == null
@@ -213,7 +218,6 @@ public static WebApplication MapSessionEndpoints(this WebApplication app, ApiVer
 
         return app;
     }
-
     private static async Task<IResult> RegisterSession(IDatabaseContextFactory databaseContextFactory, IMediator mediator, Application.RegisterSession registerSession)
     {
         using (new DatabaseContextScope())
diff --git a/Shuttle.Access.WebApi/appsettings.json b/Shuttle.Access.WebApi/appsettings.json
@@ -36,7 +36,7 @@
         {
           "Name": "Recall",
           "Title": "Shuttle.Recall.WebApi",
-          "Description": "Some description",
+          "Description": "Provides endpoints that allow retrieving primitive events from a Sql Server event store.",
           "SessionTokenExchangeUrl": "http://localhost:3001/session/"
         }
       ]
diff --git a/Shuttle.Access/AccessOptionsValidator.cs b/Shuttle.Access/AccessOptionsValidator.cs
diff --git a/Shuttle.Access/SessionTokenExchange.cs b/Shuttle.Access/SessionTokenExchange.cs

Original file line number	Diff line number	Diff line change
`@@ -146,7 +146,7 @@ async Task SaveAsync()`
`146`	`146`
`147`	`147`	`await _sessionTokenExchangeRepository.SaveAsync(sessionTokenExchange, context.CancellationToken);`
`148`	`148`
`149`		`- message.WithSessionTokenExchangeUrl($"{message.KnownApplicationOptions!.SessionTokenExchangeUrl}/{sessionTokenExchange.ExchangeToken}");`
	`149`	`+ message.WithSessionTokenExchangeUrl($"{message.KnownApplicationOptions!.SessionTokenExchangeUrl.TrimEnd('/')}/{sessionTokenExchange.ExchangeToken}");`
`150`	`150`	`}`
`151`	`151`	`}`
`152`	`152`	`}`
Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ const routes: Array<RouteRecordRaw> = [`
`41`	`41`	`},`
`42`	`42`	`},`
`43`	`43`	`{`
`44`		`- path: "/oauth/:",`
	`44`	`+ path: "/oauth",`
`45`	`45`	`name: "oauth",`
`46`	`46`	`component: () => import("../views/OAuth.vue"),`
`47`	`47`	`},`