416 lines
16 KiB
C#
416 lines
16 KiB
C#
using Microsoft.EntityFrameworkCore;
|
||
using FutureMailAPI.Data;
|
||
using FutureMailAPI.Models;
|
||
using FutureMailAPI.DTOs;
|
||
using FutureMailAPI.Helpers;
|
||
using System.Security.Cryptography;
|
||
using System.Text.Json;
|
||
|
||
namespace FutureMailAPI.Services
|
||
{
|
||
public class OAuthService : IOAuthService
|
||
{
|
||
private readonly FutureMailDbContext _context;
|
||
private readonly ILogger<OAuthService> _logger;
|
||
private readonly IPasswordHelper _passwordHelper;
|
||
|
||
public OAuthService(FutureMailDbContext context, ILogger<OAuthService> logger, IPasswordHelper passwordHelper)
|
||
{
|
||
_context = context;
|
||
_logger = logger;
|
||
_passwordHelper = passwordHelper;
|
||
}
|
||
|
||
public async Task<ApiResponse<OAuthClientSecretDto>> CreateClientAsync(int userId, OAuthClientCreateDto createDto)
|
||
{
|
||
var clientId = GenerateRandomString(32);
|
||
var clientSecret = GenerateRandomString(64);
|
||
|
||
var client = new OAuthClient
|
||
{
|
||
ClientId = clientId,
|
||
ClientSecret = clientSecret,
|
||
Name = createDto.Name,
|
||
RedirectUris = JsonSerializer.Serialize(createDto.RedirectUris),
|
||
Scopes = JsonSerializer.Serialize(createDto.Scopes),
|
||
IsActive = true,
|
||
CreatedAt = DateTime.UtcNow,
|
||
UpdatedAt = DateTime.UtcNow
|
||
};
|
||
|
||
_context.OAuthClients.Add(client);
|
||
await _context.SaveChangesAsync();
|
||
|
||
var result = new OAuthClientSecretDto
|
||
{
|
||
ClientId = clientId,
|
||
ClientSecret = clientSecret
|
||
};
|
||
|
||
return ApiResponse<OAuthClientSecretDto>.SuccessResult(result, "OAuth客户端创建成功");
|
||
}
|
||
|
||
public async Task<ApiResponse<OAuthClientDto>> GetClientAsync(string clientId)
|
||
{
|
||
var client = await _context.OAuthClients
|
||
.FirstOrDefaultAsync(c => c.ClientId == clientId && c.IsActive);
|
||
|
||
if (client == null)
|
||
{
|
||
return ApiResponse<OAuthClientDto>.ErrorResult("客户端不存在");
|
||
}
|
||
|
||
var redirectUris = JsonSerializer.Deserialize<string[]>(client.RedirectUris) ?? Array.Empty<string>();
|
||
var scopes = JsonSerializer.Deserialize<string[]>(client.Scopes) ?? Array.Empty<string>();
|
||
|
||
var result = new OAuthClientDto
|
||
{
|
||
Id = client.Id,
|
||
ClientId = client.ClientId,
|
||
Name = client.Name,
|
||
RedirectUris = redirectUris,
|
||
Scopes = scopes,
|
||
IsActive = client.IsActive,
|
||
CreatedAt = client.CreatedAt,
|
||
UpdatedAt = client.UpdatedAt
|
||
};
|
||
|
||
return ApiResponse<OAuthClientDto>.SuccessResult(result);
|
||
}
|
||
|
||
public async Task<ApiResponse<OAuthAuthorizationResponseDto>> AuthorizeAsync(int userId, OAuthAuthorizationRequestDto request)
|
||
{
|
||
// 验证客户端
|
||
var client = await _context.OAuthClients
|
||
.FirstOrDefaultAsync(c => c.ClientId == request.ClientId && c.IsActive);
|
||
|
||
if (client == null)
|
||
{
|
||
return ApiResponse<OAuthAuthorizationResponseDto>.ErrorResult("无效的客户端ID");
|
||
}
|
||
|
||
// 验证重定向URI
|
||
var redirectUris = JsonSerializer.Deserialize<string[]>(client.RedirectUris) ?? Array.Empty<string>();
|
||
if (!redirectUris.Contains(request.RedirectUri))
|
||
{
|
||
return ApiResponse<OAuthAuthorizationResponseDto>.ErrorResult("无效的重定向URI");
|
||
}
|
||
|
||
// 验证范围
|
||
var clientScopes = JsonSerializer.Deserialize<string[]>(client.Scopes) ?? Array.Empty<string>();
|
||
var requestedScopes = request.Scope.Split(' ', StringSplitOptions.RemoveEmptyEntries);
|
||
|
||
foreach (var scope in requestedScopes)
|
||
{
|
||
if (!clientScopes.Contains(scope))
|
||
{
|
||
return ApiResponse<OAuthAuthorizationResponseDto>.ErrorResult($"无效的范围: {scope}");
|
||
}
|
||
}
|
||
|
||
// 生成授权码
|
||
var code = GenerateRandomString(64);
|
||
var authorizationCode = new OAuthAuthorizationCode
|
||
{
|
||
Code = code,
|
||
ClientId = client.Id,
|
||
UserId = userId,
|
||
RedirectUri = request.RedirectUri,
|
||
Scopes = request.Scope,
|
||
IsUsed = false,
|
||
ExpiresAt = DateTime.UtcNow.AddMinutes(10), // 授权码10分钟后过期
|
||
CreatedAt = DateTime.UtcNow
|
||
};
|
||
|
||
_context.OAuthAuthorizationCodes.Add(authorizationCode);
|
||
await _context.SaveChangesAsync();
|
||
|
||
var result = new OAuthAuthorizationResponseDto
|
||
{
|
||
Code = code,
|
||
State = request.State
|
||
};
|
||
|
||
return ApiResponse<OAuthAuthorizationResponseDto>.SuccessResult(result);
|
||
}
|
||
|
||
public async Task<ApiResponse<OAuthTokenResponseDto>> ExchangeCodeForTokenAsync(OAuthTokenRequestDto request)
|
||
{
|
||
// 验证客户端
|
||
var client = await GetClientByCredentialsAsync(request.ClientId, request.ClientSecret);
|
||
if (client == null)
|
||
{
|
||
return ApiResponse<OAuthTokenResponseDto>.ErrorResult("无效的客户端凭据");
|
||
}
|
||
|
||
// 验证授权码
|
||
var authCode = await _context.OAuthAuthorizationCodes
|
||
.Include(c => c.Client)
|
||
.Include(c => c.User)
|
||
.FirstOrDefaultAsync(c => c.Code == request.Code && c.ClientId == client.Id);
|
||
|
||
if (authCode == null || authCode.IsUsed || authCode.ExpiresAt < DateTime.UtcNow)
|
||
{
|
||
return ApiResponse<OAuthTokenResponseDto>.ErrorResult("无效的授权码");
|
||
}
|
||
|
||
// 验证重定向URI
|
||
if (authCode.RedirectUri != request.RedirectUri)
|
||
{
|
||
return ApiResponse<OAuthTokenResponseDto>.ErrorResult("重定向URI不匹配");
|
||
}
|
||
|
||
// 标记授权码为已使用
|
||
authCode.IsUsed = true;
|
||
await _context.SaveChangesAsync();
|
||
|
||
// 生成访问令牌和刷新令牌
|
||
var accessToken = GenerateRandomString(64);
|
||
var refreshToken = GenerateRandomString(64);
|
||
|
||
var scopes = !string.IsNullOrEmpty(request.Scope) ? request.Scope : authCode.Scopes;
|
||
|
||
var oauthAccessToken = new OAuthAccessToken
|
||
{
|
||
Token = accessToken,
|
||
ClientId = client.Id,
|
||
UserId = authCode.UserId,
|
||
Scopes = scopes,
|
||
IsRevoked = false,
|
||
ExpiresAt = DateTime.UtcNow.AddHours(1), // 访问令牌1小时后过期
|
||
CreatedAt = DateTime.UtcNow
|
||
};
|
||
|
||
var oauthRefreshToken = new OAuthRefreshToken
|
||
{
|
||
Token = refreshToken,
|
||
ClientId = client.Id,
|
||
UserId = authCode.UserId,
|
||
IsUsed = false,
|
||
ExpiresAt = DateTime.UtcNow.AddDays(30), // 刷新令牌30天后过期
|
||
CreatedAt = DateTime.UtcNow
|
||
};
|
||
|
||
_context.OAuthAccessTokens.Add(oauthAccessToken);
|
||
_context.OAuthRefreshTokens.Add(oauthRefreshToken);
|
||
await _context.SaveChangesAsync();
|
||
|
||
var result = new OAuthTokenResponseDto
|
||
{
|
||
AccessToken = accessToken,
|
||
TokenType = "Bearer",
|
||
ExpiresIn = 3600, // 1小时
|
||
RefreshToken = refreshToken,
|
||
Scope = scopes
|
||
};
|
||
|
||
return ApiResponse<OAuthTokenResponseDto>.SuccessResult(result);
|
||
}
|
||
|
||
public async Task<ApiResponse<OAuthTokenResponseDto>> RefreshTokenAsync(OAuthTokenRequestDto request)
|
||
{
|
||
// 验证客户端
|
||
var client = await GetClientByCredentialsAsync(request.ClientId, request.ClientSecret);
|
||
if (client == null)
|
||
{
|
||
return ApiResponse<OAuthTokenResponseDto>.ErrorResult("无效的客户端凭据");
|
||
}
|
||
|
||
// 验证刷新令牌
|
||
var refreshToken = await _context.OAuthRefreshTokens
|
||
.Include(t => t.Client)
|
||
.Include(t => t.User)
|
||
.FirstOrDefaultAsync(t => t.Token == request.RefreshToken && t.ClientId == client.Id);
|
||
|
||
if (refreshToken == null || refreshToken.IsUsed || refreshToken.ExpiresAt < DateTime.UtcNow)
|
||
{
|
||
return ApiResponse<OAuthTokenResponseDto>.ErrorResult("无效的刷新令牌");
|
||
}
|
||
|
||
// 标记旧刷新令牌为已使用
|
||
refreshToken.IsUsed = true;
|
||
|
||
// 撤销旧访问令牌
|
||
var oldAccessTokens = await _context.OAuthAccessTokens
|
||
.Where(t => t.UserId == refreshToken.UserId && t.ClientId == client.Id && !t.IsRevoked)
|
||
.ToListAsync();
|
||
|
||
foreach (var token in oldAccessTokens)
|
||
{
|
||
token.IsRevoked = true;
|
||
}
|
||
|
||
// 生成新的访问令牌和刷新令牌
|
||
var newAccessToken = GenerateRandomString(64);
|
||
var newRefreshToken = GenerateRandomString(64);
|
||
|
||
var scopes = !string.IsNullOrEmpty(request.Scope) ? request.Scope : "";
|
||
|
||
var newOAuthAccessToken = new OAuthAccessToken
|
||
{
|
||
Token = newAccessToken,
|
||
ClientId = client.Id,
|
||
UserId = refreshToken.UserId,
|
||
Scopes = scopes,
|
||
IsRevoked = false,
|
||
ExpiresAt = DateTime.UtcNow.AddHours(1), // 访问令牌1小时后过期
|
||
CreatedAt = DateTime.UtcNow
|
||
};
|
||
|
||
var newOAuthRefreshToken = new OAuthRefreshToken
|
||
{
|
||
Token = newRefreshToken,
|
||
ClientId = client.Id,
|
||
UserId = refreshToken.UserId,
|
||
IsUsed = false,
|
||
ExpiresAt = DateTime.UtcNow.AddDays(30), // 刷新令牌30天后过期
|
||
CreatedAt = DateTime.UtcNow
|
||
};
|
||
|
||
_context.OAuthAccessTokens.Add(newOAuthAccessToken);
|
||
_context.OAuthRefreshTokens.Add(newOAuthRefreshToken);
|
||
await _context.SaveChangesAsync();
|
||
|
||
var result = new OAuthTokenResponseDto
|
||
{
|
||
AccessToken = newAccessToken,
|
||
TokenType = "Bearer",
|
||
ExpiresIn = 3600, // 1小时
|
||
RefreshToken = newRefreshToken,
|
||
Scope = scopes
|
||
};
|
||
|
||
return ApiResponse<OAuthTokenResponseDto>.SuccessResult(result);
|
||
}
|
||
|
||
public async Task<ApiResponse<bool>> RevokeTokenAsync(string token)
|
||
{
|
||
var accessToken = await _context.OAuthAccessTokens
|
||
.FirstOrDefaultAsync(t => t.Token == token);
|
||
|
||
if (accessToken == null)
|
||
{
|
||
return ApiResponse<bool>.ErrorResult("令牌不存在");
|
||
}
|
||
|
||
accessToken.IsRevoked = true;
|
||
await _context.SaveChangesAsync();
|
||
|
||
return ApiResponse<bool>.SuccessResult(true, "令牌已撤销");
|
||
}
|
||
|
||
public async Task<ApiResponse<bool>> ValidateTokenAsync(string token)
|
||
{
|
||
var accessToken = await _context.OAuthAccessTokens
|
||
.FirstOrDefaultAsync(t => t.Token == token && !t.IsRevoked && t.ExpiresAt > DateTime.UtcNow);
|
||
|
||
if (accessToken == null)
|
||
{
|
||
return ApiResponse<bool>.ErrorResult("无效的令牌");
|
||
}
|
||
|
||
return ApiResponse<bool>.SuccessResult(true);
|
||
}
|
||
|
||
public async Task<OAuthAccessToken?> GetAccessTokenAsync(string token)
|
||
{
|
||
return await _context.OAuthAccessTokens
|
||
.Include(t => t.Client)
|
||
.Include(t => t.User)
|
||
.FirstOrDefaultAsync(t => t.Token == token && !t.IsRevoked && t.ExpiresAt > DateTime.UtcNow);
|
||
}
|
||
|
||
public async Task<OAuthClient?> GetClientByCredentialsAsync(string clientId, string clientSecret)
|
||
{
|
||
if (string.IsNullOrEmpty(clientSecret))
|
||
{
|
||
// 公开客户端，只验证客户端ID
|
||
return await _context.OAuthClients
|
||
.FirstOrDefaultAsync(c => c.ClientId == clientId && c.IsActive);
|
||
}
|
||
|
||
// 机密客户端，验证客户端ID和密钥
|
||
return await _context.OAuthClients
|
||
.FirstOrDefaultAsync(c => c.ClientId == clientId && c.ClientSecret == clientSecret && c.IsActive);
|
||
}
|
||
|
||
public async Task<ApiResponse<OAuthTokenResponseDto>> LoginAsync(OAuthLoginDto loginDto)
|
||
{
|
||
// 验证客户端
|
||
var client = await GetClientByCredentialsAsync(loginDto.ClientId, loginDto.ClientSecret);
|
||
if (client == null)
|
||
{
|
||
return ApiResponse<OAuthTokenResponseDto>.ErrorResult("无效的客户端凭据");
|
||
}
|
||
|
||
// 验证用户凭据
|
||
var user = await _context.Users
|
||
.FirstOrDefaultAsync(u => (u.Email == loginDto.UsernameOrEmail || u.Nickname == loginDto.UsernameOrEmail));
|
||
|
||
if (user == null)
|
||
{
|
||
return ApiResponse<OAuthTokenResponseDto>.ErrorResult("用户名或密码错误");
|
||
}
|
||
|
||
// 验证密码
|
||
if (!_passwordHelper.VerifyPassword(loginDto.Password, user.PasswordHash))
|
||
{
|
||
return ApiResponse<OAuthTokenResponseDto>.ErrorResult("用户名或密码错误");
|
||
}
|
||
|
||
// 生成访问令牌和刷新令牌
|
||
var accessToken = GenerateRandomString(64);
|
||
var refreshToken = GenerateRandomString(64);
|
||
|
||
var oauthAccessToken = new OAuthAccessToken
|
||
{
|
||
Token = accessToken,
|
||
ClientId = client.Id,
|
||
UserId = user.Id,
|
||
Scopes = loginDto.Scope,
|
||
IsRevoked = false,
|
||
ExpiresAt = DateTime.UtcNow.AddHours(1), // 访问令牌1小时后过期
|
||
CreatedAt = DateTime.UtcNow
|
||
};
|
||
|
||
var oauthRefreshToken = new OAuthRefreshToken
|
||
{
|
||
Token = refreshToken,
|
||
ClientId = client.Id,
|
||
UserId = user.Id,
|
||
IsUsed = false,
|
||
ExpiresAt = DateTime.UtcNow.AddDays(30), // 刷新令牌30天后过期
|
||
CreatedAt = DateTime.UtcNow
|
||
};
|
||
|
||
_context.OAuthAccessTokens.Add(oauthAccessToken);
|
||
_context.OAuthRefreshTokens.Add(oauthRefreshToken);
|
||
await _context.SaveChangesAsync();
|
||
|
||
var result = new OAuthTokenResponseDto
|
||
{
|
||
AccessToken = accessToken,
|
||
TokenType = "Bearer",
|
||
ExpiresIn = 3600, // 1小时
|
||
RefreshToken = refreshToken,
|
||
Scope = loginDto.Scope
|
||
};
|
||
|
||
return ApiResponse<OAuthTokenResponseDto>.SuccessResult(result);
|
||
}
|
||
|
||
private string GenerateRandomString(int length)
|
||
{
|
||
const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
|
||
var random = new Random();
|
||
var result = new char[length];
|
||
|
||
for (int i = 0; i < length; i++)
|
||
{
|
||
result[i] = chars[random.Next(chars.Length)];
|
||
}
|
||
|
||
return new string(result);
|
||
}
|
||
}
|
||
} |