Add SignalR Auth Refresh support to server and .NET client (#67111) (#67400)

Server-side:
- Add /refresh HTTP endpoint mapped alongside /negotiate
- Add tokenLifetimeSeconds to negotiate response (NegotiationResponse + NegotiateProtocol)
- Server re-authenticates on /refresh and updates connection's User and auth expiration
- Compute TTL from AuthenticationProperties.ExpiresUtc
- New virtual Hub.OnAuthRefreshedAsync() lifecycle hook

.NET Client-side:
- Add IAuthRefreshFeature interface in Connections.Abstractions
- HttpConnection implements IAuthRefreshFeature, POSTs to /refresh endpoint
- HubConnection.RefreshAuthAsync() discovers IAuthRefreshFeature via Features collection
- Auto-refresh timer schedules at: now + TTL - RefreshBeforeExpiration (default 5 min)

(cherry picked from commit 8835dfc)

Author: BrennanConroy

src/Servers/Connections.Abstractions/src/Features/IAuthenticationRefreshFeature.cs

@@ -0,0 +1,27 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Microsoft.AspNetCore.Connections.Features;
+
+/// <summary>
+/// Feature for refreshing authentication on a connection.
+/// When present, indicates the connection supports authentication token refresh.
+/// </summary>
+public interface IAuthenticationRefreshFeature
+{
+    /// <summary>
+    /// Gets the initial token lifetime as provided by the server during negotiation.
+    /// Null if the server did not provide a token lifetime.
+    /// </summary>
+    TimeSpan? InitialTokenLifetime { get; }
+
+    /// <summary>
+    /// Sends a refresh request to the server with new authentication credentials.
+    /// Returns the updated token lifetime, or null if not provided.
+    /// </summary>
+    Task<TimeSpan?> RefreshAuthenticationAsync(CancellationToken cancellationToken = default);
+}

src/Servers/Connections.Abstractions/src/Features/IConnectionUserRefreshFeature.cs

@@ -0,0 +1,29 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System;
+using System.Security.Claims;
+
+namespace Microsoft.AspNetCore.Connections.Features;
+
+/// <summary>
+/// A feature that allows callbacks to be notified when the user associated with the connection is refreshed,
+/// for example, via an authentication refresh.
+/// </summary>
+public interface IConnectionUserRefreshFeature
+{
+    /// <summary>
+    /// Registers a callback to be invoked after the <see cref="IConnectionUserFeature.User"/> has been refreshed.
+    /// </summary>
+    /// <param name="callback">The callback to invoke with the refreshed principal and associated <paramref name="state"/>.</param>
+    /// <param name="state">The state to pass to <paramref name="callback"/>.</param>
+    /// <returns>An <see cref="IDisposable"/> that can be disposed to unregister the callback.</returns>
+    /// <remarks>
+    /// Callbacks should be quick and avoid blocking; the callback is invoked on the thread that performed the update.
+    /// Exceptions thrown from callbacks are not propagated to the caller of the update.
+    /// The previous principal is intentionally not exposed because its underlying resources
+    /// (for example a <c>WindowsIdentity</c>'s <c>SafeHandle</c>) may be disposed when the
+    /// authentication-refresh request completes, making later access unsafe.
+    /// </remarks>
+    IDisposable OnUserRefreshed(Action<ClaimsPrincipal, object?> callback, object? state);
+}

src/Servers/Connections.Abstractions/src/PublicAPI/net10.0/PublicAPI.Unshipped.txt

@@ -1,2 +1,7 @@
 #nullable enable
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.InitialTokenLifetime.get -> System.TimeSpan?
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.RefreshAuthenticationAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<System.TimeSpan?>!
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature.OnUserRefreshed(System.Action<System.Security.Claims.ClaimsPrincipal!, object?>! callback, object? state) -> System.IDisposable!
 Microsoft.AspNetCore.Connections.Features.ITlsHandshakeFeature.Exception.get -> System.Exception?

src/Servers/Connections.Abstractions/src/PublicAPI/net11.0/PublicAPI.Unshipped.txt

@@ -1,2 +1,7 @@
 #nullable enable
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.InitialTokenLifetime.get -> System.TimeSpan?
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.RefreshAuthenticationAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<System.TimeSpan?>!
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature.OnUserRefreshed(System.Action<System.Security.Claims.ClaimsPrincipal!, object?>! callback, object? state) -> System.IDisposable!
 Microsoft.AspNetCore.Connections.Features.ITlsHandshakeFeature.Exception.get -> System.Exception?

src/Servers/Connections.Abstractions/src/PublicAPI/net462/PublicAPI.Unshipped.txt

@@ -1 +1,6 @@
 #nullable enable
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.InitialTokenLifetime.get -> System.TimeSpan?
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.RefreshAuthenticationAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<System.TimeSpan?>!
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature.OnUserRefreshed(System.Action<System.Security.Claims.ClaimsPrincipal!, object?>! callback, object? state) -> System.IDisposable!

src/Servers/Connections.Abstractions/src/PublicAPI/netstandard2.0/PublicAPI.Unshipped.txt

@@ -1 +1,6 @@
 #nullable enable
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.InitialTokenLifetime.get -> System.TimeSpan?
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.RefreshAuthenticationAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<System.TimeSpan?>!
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature.OnUserRefreshed(System.Action<System.Security.Claims.ClaimsPrincipal!, object?>! callback, object? state) -> System.IDisposable!

src/Servers/Connections.Abstractions/src/PublicAPI/netstandard2.1/PublicAPI.Unshipped.txt

@@ -1 +1,6 @@
 #nullable enable
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.InitialTokenLifetime.get -> System.TimeSpan?
+Microsoft.AspNetCore.Connections.Features.IAuthenticationRefreshFeature.RefreshAuthenticationAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) -> System.Threading.Tasks.Task<System.TimeSpan?>!
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature
+Microsoft.AspNetCore.Connections.Features.IConnectionUserRefreshFeature.OnUserRefreshed(System.Action<System.Security.Claims.ClaimsPrincipal!, object?>! callback, object? state) -> System.IDisposable!

src/SignalR/clients/csharp/Client.Core/src/AuthenticationRefreshOptions.cs

@@ -0,0 +1,105 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace Microsoft.AspNetCore.SignalR.Client;
+
+/// <summary>
+/// Configures automatic authentication token refresh for a <see cref="HubConnection"/>.
+/// </summary>
+public sealed class AuthenticationRefreshOptions
+{
+    /// <summary>
+    /// Enables automatic token refresh before the server-reported token expiration.
+    /// Default is <c>true</c>.
+    /// </summary>
+    /// <remarks>
+    /// When enabled, the client schedules a refresh based on the <c>tokenLifetimeSeconds</c>
+    /// reported by the server in the negotiate (and subsequent refresh) responses. If the server
+    /// does not report a token lifetime, no automatic refresh is scheduled regardless of this setting;
+    /// the application may still call <see cref="HubConnection.RefreshAuthenticationAsync"/> manually.
+    /// </remarks>
+    public bool EnableAutoRefresh { get; set; } = true;
+
+    /// <summary>
+    /// How far before the server-reported token expiration the client should refresh.
+    /// The client schedules refresh at: <c>now + tokenLifetimeSeconds - RefreshBeforeExpiration</c>.
+    /// Default is 5 minutes.
+    /// </summary>
+    public TimeSpan RefreshBeforeExpiration
+    {
+        get;
+        set
+        {
+            if (value < TimeSpan.Zero)
+            {
+                throw new ArgumentOutOfRangeException(nameof(value), value, "The value must be zero or greater.");
+            }
+
+            field = value;
+        }
+    } = TimeSpan.FromMinutes(5);
+
+    /// <summary>
+    /// Optional callback invoked after a successful authentication refresh.
+    /// </summary>
+    public Func<AuthenticationRefreshedContext, Task>? OnAuthenticationRefreshed { get; set; }
+
+    /// <summary>
+    /// Optional callback invoked when an authentication refresh attempt fails.
+    /// </summary>
+    public Func<AuthenticationRefreshFailedContext, Task>? OnAuthenticationRefreshFailed { get; set; }
+}
+
+/// <summary>
+/// Context passed to <see cref="AuthenticationRefreshOptions.OnAuthenticationRefreshed"/> after a successful refresh.
+/// </summary>
+public sealed class AuthenticationRefreshedContext
+{
+    internal AuthenticationRefreshedContext(HubConnection hubConnection, TimeSpan? newTokenLifetime)
+    {
+        HubConnection = hubConnection;
+        NewTokenLifetime = newTokenLifetime;
+        RefreshedAt = DateTimeOffset.UtcNow;
+    }
+
+    /// <summary>
+    /// Gets the <see cref="HubConnection"/> whose authentication was refreshed.
+    /// </summary>
+    public HubConnection HubConnection { get; }
+
+    /// <summary>
+    /// Gets the new token lifetime reported by the server, or <c>null</c> if not provided.
+    /// </summary>
+    public TimeSpan? NewTokenLifetime { get; }
+
+    /// <summary>
+    /// Gets the time at which the refresh completed.
+    /// </summary>
+    public DateTimeOffset RefreshedAt { get; }
+}
+
+/// <summary>
+/// Context passed to <see cref="AuthenticationRefreshOptions.OnAuthenticationRefreshFailed"/> when a refresh attempt fails.
+/// </summary>
+public sealed class AuthenticationRefreshFailedContext
+{
+    internal AuthenticationRefreshFailedContext(HubConnection hubConnection, Exception exception)
+    {
+        HubConnection = hubConnection;
+        Exception = exception;
+    }
+
+    /// <summary>
+    /// Gets the <see cref="HubConnection"/> on which the refresh attempt failed.
+    /// </summary>
+    public HubConnection HubConnection { get; }
+
+    /// <summary>
+    /// Gets the exception that caused the refresh attempt to fail.
+    /// </summary>
+    public Exception Exception { get; }
+}

src/SignalR/clients/csharp/Client.Core/src/HubConnection.Log.cs

@@ -340,5 +340,17 @@ public static void ErrorHandshakeTimedOut(ILogger logger, TimeSpan handshakeTime
 
         [LoggerMessage(94, LogLevel.Error, "Failed to bind argument received in stream '{StreamId}'.", EventName = "StreamBindingFailure")]
         public static partial void StreamBindingFailure(ILogger logger, string? streamId, Exception exception);
+
+        [LoggerMessage(95, LogLevel.Debug, "Starting authentication token refresh.", EventName = "AuthenticationRefreshStarting")]
+        public static partial void AuthenticationRefreshStarting(ILogger logger);
+
+        [LoggerMessage(96, LogLevel.Debug, "Authentication token refresh completed. New TTL: {TokenLifetime}.", EventName = "AuthenticationRefreshCompleted")]
+        public static partial void AuthenticationRefreshCompleted(ILogger logger, TimeSpan? tokenLifetime);
+
+        [LoggerMessage(97, LogLevel.Error, "Authentication token refresh failed.", EventName = "AuthenticationRefreshFailed")]
+        public static partial void AuthenticationRefreshFailed(ILogger logger, Exception exception);
+
+        [LoggerMessage(98, LogLevel.Error, "Authentication refresh user callback threw an exception.", EventName = "AuthenticationRefreshCallbackFailed")]
+        public static partial void AuthenticationRefreshCallbackFailed(ILogger logger, Exception exception);
     }
 }