feat: login, general improvements and minor bugs

Author: ReneSchwarzer

src/WebExpress.WebCore.Test/Data/MockIdentityProvider.cs

@@ -1,6 +1,6 @@
-using WebExpress.WebCore.WebEndpoint;
-using WebExpress.WebCore.WebIdentity;
+using WebExpress.WebCore.WebIdentity;
 using WebExpress.WebCore.WebMessage;
+using WebExpress.WebCore.WebPage;
 
 namespace WebExpress.WebCore.Test.Data
 {
@@ -84,7 +84,7 @@ public void Logout(IRequest request)
         /// An object that represents the response to the login dialog, including authentication results and any
         /// relevant status information.
         /// </returns>
-        public IResponse CreateAuthenticationPrompt(IRequest request, IEndpointContext initiator, IIdentity identity)
+        public IResponse CreateAuthenticationPrompt(IRequest request, IPageContext initiator, IIdentity identity)
         {
             return null;
         }
@@ -106,7 +106,7 @@ public IResponse CreateAuthenticationPrompt(IRequest request, IEndpointContext i
         /// A response representing the forbidden page if this provider can handle the forbidden
         /// scenario; otherwise, <c>null</c>.
         /// </returns>
-        public IResponse CreateForbiddenPage(IRequest request, IEndpointContext initiator, IIdentity identity)
+        public IResponse CreateForbiddenPage(IRequest request, IPageContext initiator, IIdentity identity)
         {
             return null;
         }

src/WebExpress.WebCore.Test/Manager/UnitTestIdentityManager.cs

@@ -153,10 +153,10 @@ public void Login(string identityName, bool expected)
             var identity = MockIdentityFactory.GetIdentity(identityName);
 
             // act
-            var res = identityManager.Login(request, identity);
+            var res = identityManager.Login(identity, request);
 
             // validation
-            Assert.Equal(expected, res);
+            Assert.Equal(expected, res is not null);
         }
 
         /// <summary>
@@ -173,7 +173,7 @@ public void Logout(string identityName)
             var identityManager = componentHub.IdentityManager as IdentityManager;
             var request = UnitTestFixture.CreateRequestMock();
             var identity = MockIdentityFactory.GetIdentity(identityName);
-            identityManager.Login(request, identity);
+            identityManager.Login(identity, request);
 
             // act
             identityManager.Logout(request);
@@ -197,7 +197,7 @@ public void GetCurrentIdentity(string identityName)
             var identityManager = componentHub.IdentityManager as IdentityManager;
             var request = UnitTestFixture.CreateRequestMock();
             var identity = MockIdentityFactory.GetIdentity(identityName);
-            identityManager.Login(request, identity);
+            identityManager.Login(identity, request);
 
             // act
             var res = identityManager.GetCurrentIdentity(request);

src/WebExpress.WebCore.Test/TestRenderContext.cs

@@ -17,7 +17,7 @@ public class TestRenderContext : IRenderContext
         /// <summary>
         /// Gets the page context.
         /// </summary>
-        public IPageContext PageContext { get; protected set; }
+        public WebPage.IPageContext PageContext { get; protected set; }
 
         /// <summary>
         /// Gets the request.
@@ -30,7 +30,7 @@ public class TestRenderContext : IRenderContext
         /// <param name="endpoint">The endpoint associated with the rendering context.</param>
         /// <param name="pageContext">>The page context.</param>
         /// <param name="request">The request associated with the rendering context.</param>
-        public TestRenderContext(IEndpoint endpoint, IPageContext pageContext, IRequest request)
+        public TestRenderContext(IEndpoint endpoint, WebPage.IPageContext pageContext, IRequest request)
         {
             Endpoint = endpoint;
             PageContext = pageContext;

src/WebExpress.WebCore/HttpServer.cs

@@ -23,6 +23,7 @@
 using WebExpress.WebCore.WebEndpoint;
 using WebExpress.WebCore.WebLog;
 using WebExpress.WebCore.WebMessage;
+using WebExpress.WebCore.WebPage;
 using WebExpress.WebCore.WebParameter;
 using WebExpress.WebCore.WebSitemap;
 using WebExpress.WebCore.WebSocket;
@@ -495,8 +496,7 @@ private static IResponse CreateStatusPage<TResponse>(string message, IRequest re
             var applicationManager = WebEx.ComponentHub.ApplicationManager;
             var route = new RouteEndpoint(request.Uri.PathSegments)?.ToString();
             var applicationContext = applicationManager.Applications
-                   .Where(x => route.StartsWith(x.Route.ToString()))
-                   .FirstOrDefault();
+                .FirstOrDefault(x => route.StartsWith(x.Route.ToString()));
 
             if (searchResult != null)
             {
@@ -647,23 +647,16 @@ public async Task ProcessRequestAsync(IHttpContext httpContext)
                 return;
             }
 
-            // try to authenticate if no identity exists
-            if (identity is null)
-            {
-                identity = _componentHub.IdentityManager.Authenticate(httpContext.Request, applicationContext);
-                _componentHub.IdentityManager.Login(httpContext.Request, identity);
-            }
-
             // check again
             if (!_componentHub.IdentityManager.CheckAccess(identity, searchResult.EndpointContext))
             {
                 // if the user is authenticated but lacks the required permissions, show the forbidden page
-                if (identity is not null)
+                if (identity is not null && searchResult.EndpointContext is IPageContext)
                 {
                     var forbiddenResponse = _componentHub.IdentityManager.CreateForbiddenResponse
                     (
                         httpContext.Request,
-                        searchResult.EndpointContext,
+                        searchResult.EndpointContext as IPageContext,
                         identity
                     );
 
@@ -672,19 +665,47 @@ public async Task ProcessRequestAsync(IHttpContext httpContext)
                         await responseSender.SendAsync(httpContext, forbiddenResponse);
                         return;
                     }
+                    else
+                    {
+                        forbiddenResponse = CreateStatusPage<ResponseForbidden>
+                        (
+                            new StatusMessage("You do not have permission to access this resource.").Message,
+                            httpContext.Request,
+                            searchResult
+                        );
+
+                        await responseSender.SendAsync(httpContext, forbiddenResponse);
+                        return;
+                    }
                 }
+                else if (identity is not null)
+                {
+                    var forbiddenResponse = new ResponseForbidden(new StatusMessage("You do not have permission to access this resource."));
 
-                // if the user is not authenticated, show the login prompt
-                var loginResponse = _componentHub.IdentityManager.CreateAuthenticationPrompt
-                (
-                    httpContext.Request,
-                    searchResult.EndpointContext,
-                    identity
-                );
+                    await responseSender.SendAsync(httpContext, forbiddenResponse);
+                    return;
+                }
+                else if (searchResult.EndpointContext is IPageContext pageContext)
+                {
+                    // if the user is not authenticated, show the login prompt
+                    var loginResponse = _componentHub.IdentityManager.CreateAuthenticationPrompt
+                    (
+                        httpContext.Request,
+                        searchResult.EndpointContext as IPageContext,
+                        identity
+                    );
 
-                if (loginResponse is not null)
+                    if (loginResponse is not null)
+                    {
+                        await responseSender.SendAsync(httpContext, loginResponse);
+                        return;
+                    }
+                }
+                else
                 {
-                    await responseSender.SendAsync(httpContext, loginResponse);
+                    var unauthorizedResponse = new ResponseUnauthorized(new StatusMessage("Authentication required. Provide a valid access token."));
+
+                    await responseSender.SendAsync(httpContext, unauthorizedResponse);
                     return;
                 }
             }

src/WebExpress.WebCore/WebIdentity/IIdentityManager.cs

@@ -4,6 +4,8 @@
 using WebExpress.WebCore.WebComponent;
 using WebExpress.WebCore.WebEndpoint;
 using WebExpress.WebCore.WebMessage;
+using WebExpress.WebCore.WebPage;
+using WebExpress.WebCore.WebSession.Model;
 
 namespace WebExpress.WebCore.WebIdentity
 {
@@ -13,8 +15,8 @@ namespace WebExpress.WebCore.WebIdentity
     public interface IIdentityManager : IComponentManager
     {
         /// <summary>
-        /// Returns all permissions.
-        /// </Gets>
+        /// Gets all permissions.
+        /// </summary>
         IEnumerable<IIdentityPermissionContext> Permissions { get; }
 
         /// <summary>
@@ -39,7 +41,7 @@ public interface IIdentityManager : IComponentManager
         /// An object that represents the response to the login dialog, including authentication results and any
         /// relevant status information.
         /// </returns>
-        IResponse CreateAuthenticationPrompt(IRequest request, IEndpointContext initiator, IIdentity identity = null);
+        IResponse CreateAuthenticationPrompt(IRequest request, IPageContext initiator, IIdentity identity = null);
 
         /// <summary>
         /// Creates a forbidden response page for the specified request when the authenticated
@@ -59,29 +61,15 @@ public interface IIdentityManager : IComponentManager
         /// A response representing the forbidden page if a registered identity provider can handle the 
         /// forbidden scenario; otherwise, <c>null</c>.
         /// </returns>
-        IResponse CreateForbiddenResponse(IRequest request, IEndpointContext initiator, IIdentity identity);
-
-        /// <summary>
-        /// Attempts to authenticate the specified request within the given application context.
-        /// </summary>
-        /// <param name="request">
-        /// The request to be authenticated. Must not be null.
-        /// </param>
-        /// <param name="applicationContext">
-        /// The application context in which the authentication is performed. Must not be null.
-        /// </param>
-        /// <returns>
-        /// An identity representing the authenticated user if authentication is successful; otherwise, null.
-        /// </returns>
-        IIdentity Authenticate(IRequest request, IApplicationContext applicationContext);
+        IResponse CreateForbiddenResponse(IRequest request, IPageContext initiator, IIdentity identity);
 
         /// <summary>
         /// Login an identity.
         /// </summary>
-        /// <param name="request">The request.</param>
         /// <param name="identity">The identity.</param>
-        /// <returns>True if successful, false otherwise.</returns>
-        bool Login(IRequest request, IIdentity identity);
+        /// <param name="request">The request.</param>
+        /// <returns>The session of the logged-in identity, or null if the login process failed.</returns>
+        Session Login(IIdentity identity, IRequest request);
 
         /// <summary>
         /// Logout an identity.

src/WebExpress.WebCore/WebIdentity/IIdentityProvider.cs

@@ -1,6 +1,6 @@
 using System.Collections.Generic;
-using WebExpress.WebCore.WebEndpoint;
 using WebExpress.WebCore.WebMessage;
+using WebExpress.WebCore.WebPage;
 
 namespace WebExpress.WebCore.WebIdentity
 {
@@ -20,26 +20,6 @@ public interface IIdentityProvider
         /// </summary>
         IEnumerable<IIdentityGroup> GetGroups();
 
-        /// <summary>
-        /// Authenticates the specified request and returns the associated identity.
-        /// </summary>
-        /// <param name="request">
-        /// The request to authenticate. Cannot be null.
-        /// </param>
-        /// <returns>
-        /// An identity representing the authenticated user if authentication is successful; otherwise, null.
-        /// </returns>
-        IIdentity Authenticate(IRequest request);
-
-        /// <summary>
-        /// Logs out the specified request by clearing any authentication state
-        /// managed by this identity provider.
-        /// </summary>
-        /// <param name="request">
-        /// The request whose authentication state should be cleared. Cannot be null.
-        /// </param>
-        void Logout(IRequest request);
-
         /// <summary>
         /// Displays a login dialog using the specified request and identity information.
         /// </summary>
@@ -57,7 +37,7 @@ public interface IIdentityProvider
         /// An object that represents the response to the login dialog, including authentication results and any
         /// relevant status information.
         /// </returns>
-        IResponse CreateAuthenticationPrompt(IRequest request, IEndpointContext initiator, IIdentity identity);
+        IResponse CreateAuthenticationPrompt(IRequest request, IPageContext initiator, IIdentity identity);
 
         /// <summary>
         /// Creates a forbidden response page for the specified request when the authenticated
@@ -77,6 +57,6 @@ public interface IIdentityProvider
         /// A response representing the forbidden page if this provider can handle the forbidden
         /// scenario; otherwise, <c>null</c>.
         /// </returns>
-        IResponse CreateForbiddenPage(IRequest request, IEndpointContext initiator, IIdentity identity);
+        IResponse CreateForbiddenPage(IRequest request, IPageContext initiator, IIdentity identity);
     }
 }

src/WebExpress.WebCore/WebIdentity/IdentityManager.cs

@@ -12,6 +12,7 @@
 using WebExpress.WebCore.WebEndpoint;
 using WebExpress.WebCore.WebIdentity.Model;
 using WebExpress.WebCore.WebMessage;
+using WebExpress.WebCore.WebPage;
 using WebExpress.WebCore.WebPlugin;
 using WebExpress.WebCore.WebSession.Model;
 
@@ -385,7 +386,7 @@ private void OnAddApplication(object sender, IApplicationContext e)
         /// An object that represents the response to the login dialog, including authentication results 
         /// and any relevant status information.
         /// </returns>
-        public IResponse CreateAuthenticationPrompt(IRequest request, IEndpointContext initiator, IIdentity identity = null)
+        public IResponse CreateAuthenticationPrompt(IRequest request, IPageContext initiator, IIdentity identity = null)
         {
             if (_identityProviders.TryGetValue(initiator?.ApplicationContext, out var list))
             {
@@ -415,7 +416,7 @@ public IResponse CreateAuthenticationPrompt(IRequest request, IEndpointContext i
         /// A response representing the forbidden page if a registered identity provider can handle the 
         /// forbidden scenario; otherwise, <c>null</c>.
         /// </returns>
-        public IResponse CreateForbiddenResponse(IRequest request, IEndpointContext initiator, IIdentity identity)
+        public IResponse CreateForbiddenResponse(IRequest request, IPageContext initiator, IIdentity identity)
         {
             if (_identityProviders.TryGetValue(initiator?.ApplicationContext, out var list))
             {
@@ -434,48 +435,29 @@ public IResponse CreateForbiddenResponse(IRequest request, IEndpointContext init
             return null;
         }
 
-        /// <summary>
-        /// Attempts to authenticate the specified request within the given application context.
-        /// </summary>
-        /// <param name="request">The request to be authenticated. Must not be null.</param>
-        /// <param name="applicationContext">The application context in which the authentication is performed. Must not be null.</param>
-        /// <returns>An identity representing the authenticated user if authentication is successful; otherwise, null.</returns>
-        public IIdentity Authenticate(IRequest request, IApplicationContext applicationContext)
-        {
-            if (_identityProviders.TryGetValue(applicationContext, out var list))
-            {
-                foreach (var provider in list)
-                {
-                    var identity = provider.Authenticate(request);
-
-                    if (identity is not null)
-                    {
-                        return identity;
-                    }
-                }
-            }
-
-            return null;
-        }
-
         /// <summary>
         /// Login an identity.
         /// </summary>
-        /// <param name="request">The request.</param>
         /// <param name="identity">The identity.</param>
-        /// <returns>True if successful, false otherwise.</returns>
-        public bool Login(IRequest request, IIdentity identity)
+        /// <param name="request">The request.</param>
+        /// <returns>The session of the logged-in identity, or null if the login process failed.</returns>
+        public Session Login(IIdentity identity, IRequest request)
         {
             if (identity is null)
             {
-                return false;
+                return null;
             }
 
             var session = _componentHub.SessionManager.GetSession(request);
             var authentification = session.GetOrCreateProperty<SessionPropertyAuthentification>(identity);
 
             // verify that the identity was correctly bound to the session
-            return authentification.Identity == identity;
+            if (authentification.Identity != identity)
+            {
+                return null;
+            }
+
+            return session;
         }
 
         /// <summary>
@@ -484,15 +466,6 @@ public bool Login(IRequest request, IIdentity identity)
         /// <param name="request">The request.</param>
         public void Logout(IRequest request)
         {
-            // notify all registered identity providers so they can clear their own state
-            foreach (var list in _identityProviders.Values)
-            {
-                foreach (var provider in list)
-                {
-                    provider.Logout(request);
-                }
-            }
-
             var session = _componentHub.SessionManager.GetSession(request);
             session.RemoveProperty<SessionPropertyAuthentification>();
         }