From 10868018fb0143746ab767879cd1a57d3dee8d0b Mon Sep 17 00:00:00 2001 From: Derek Holloway Date: Thu, 7 Aug 2025 23:22:53 -0700 Subject: [PATCH] Update to use Auth.Mistox.Com --- .vscode/tasks.json | 1 + database/mistox.sql | 39 --- src/MistoxWebsite.Client/src/app/app.html | 17 +- .../src/app/app.routes.ts | 21 +- src/MistoxWebsite.Client/src/app/app.ts | 35 ++- .../src/app/models/Account.ts | 14 +- .../src/app/models/Product.ts | 2 +- .../src/app/models/WebsiteData.ts | 2 +- .../forgotpassword.component.html | 23 -- .../forgotpassword.component.ts | 55 ---- .../pages/account/login/login.component.html | 35 --- .../pages/account/login/login.component.ts | 57 ---- .../account/logout/logout.component.html | 0 .../pages/account/logout/logout.component.ts | 27 -- .../account/register/register.component.html | 35 --- .../account/register/register.component.ts | 85 ----- .../resetpassword.component.html | 29 -- .../resetpassword/resetpassword.component.ts | 69 ---- .../account/settings/settings.component.html | 0 .../account/settings/settings.component.ts | 29 -- .../verifyemail/verifyemail.component.html | 8 - .../verifyemail/verifyemail.component.ts | 54 ---- .../pages/legal/about/about.component.html | 28 -- .../app/pages/legal/about/about.component.ts | 19 -- .../store/admin/edititem/edit.component.ts | 4 +- .../store/admin/newitem/new.component.ts | 2 +- .../store/catalog/catalog.component.html | 6 +- .../src/app/services/Authentication.ts | 61 +--- .../Controllers/AuthenticationController.cs | 294 ++---------------- .../Controllers/MistoxControllerBase.cs | 31 +- .../Controllers/ProductController.cs | 4 +- .../Entities/DatabaseObjects.cs | 10 +- .../MistoxWebsite.Server.csproj | 1 + src/MistoxWebsite.Server/Program.cs | 110 ++++++- .../Services/DatabaseService/Account.cs | 160 ---------- 35 files changed, 216 insertions(+), 1151 deletions(-) delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/forgotpassword/forgotpassword.component.html delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/forgotpassword/forgotpassword.component.ts delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/login/login.component.html delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/login/login.component.ts delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/logout/logout.component.html delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/logout/logout.component.ts delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/register/register.component.html delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/register/register.component.ts delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/resetpassword/resetpassword.component.html delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/resetpassword/resetpassword.component.ts delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/settings/settings.component.html delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/settings/settings.component.ts delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/verifyemail/verifyemail.component.html delete mode 100644 src/MistoxWebsite.Client/src/app/pages/account/verifyemail/verifyemail.component.ts delete mode 100644 src/MistoxWebsite.Client/src/app/pages/legal/about/about.component.html delete mode 100644 src/MistoxWebsite.Client/src/app/pages/legal/about/about.component.ts delete mode 100755 src/MistoxWebsite.Server/Services/DatabaseService/Account.cs diff --git a/.vscode/tasks.json b/.vscode/tasks.json index f10308d..a0ae14b 100644 --- a/.vscode/tasks.json +++ b/.vscode/tasks.json @@ -22,6 +22,7 @@ }, "args": [ "build", + "--configuration=development", "--base-href=http://localhost:5000" ], "problemMatcher": "$msCompile" diff --git a/database/mistox.sql b/database/mistox.sql index cb19208..fff0eef 100755 --- a/database/mistox.sql +++ b/database/mistox.sql @@ -1,20 +1,6 @@ CREATE DATABASE IF NOT EXISTS `mistox`; USE `mistox`; -CREATE TABLE IF NOT EXISTS `Account` ( - `ID` int(11) NOT NULL AUTO_INCREMENT, - `UserName` varchar(60) DEFAULT NULL, - `Email` varchar(60) DEFAULT NULL, - `EmailVerified` tinyint(4) DEFAULT NULL, - `PasswordHash` varchar(100) DEFAULT NULL, - `FailedPasswordLock` tinyint(4) DEFAULT NULL, - `PasswordAttempts` int(11) DEFAULT NULL, - `CurrentPasswordAttempts` int(11) DEFAULT NULL, - `Role` varchar(45) DEFAULT NULL, - `EmailToken` varchar(45) DEFAULT NULL, - PRIMARY KEY (`ID`) -) AUTO_INCREMENT=1; - CREATE TABLE IF NOT EXISTS `Product` ( `ID` int(11) NOT NULL AUTO_INCREMENT, `Name` varchar(45) DEFAULT NULL, @@ -60,29 +46,4 @@ CREATE TABLE IF NOT EXISTS `Receipt` ( `TaxAmount` int(11) DEFAULT NULL, `TotalCost` int(11) DEFAULT NULL, PRIMARY KEY (`AccountID`,`ProductID`,`ReceiptID`) -); - -INSERT INTO Account ( - ID, - UserName, - Email, - EmailVerified, - PasswordHash, - FailedPasswordLock, - PasswordAttempts, - CurrentPasswordAttempts, - Role, - EmailToken -) VALUES ( - 1, - 'admin', - 'admin@mistox.com', - 1, - '$2a$11$0UeWLLqTXe3FG161QVuI0OQJ9rulspUpMG581DI6KSzDXBbFKd00S', - 1, - 1, - 5, - 0, - 'Admin', - '' ); \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/app.html b/src/MistoxWebsite.Client/src/app/app.html index 7834107..ad13f46 100644 --- a/src/MistoxWebsite.Client/src/app/app.html +++ b/src/MistoxWebsite.Client/src/app/app.html @@ -41,13 +41,18 @@
-
- - +
+ +
-
- - +
+ + + + + + +
diff --git a/src/MistoxWebsite.Client/src/app/app.routes.ts b/src/MistoxWebsite.Client/src/app/app.routes.ts index 53efab3..5d19334 100644 --- a/src/MistoxWebsite.Client/src/app/app.routes.ts +++ b/src/MistoxWebsite.Client/src/app/app.routes.ts @@ -1,28 +1,11 @@ import { Routes } from '@angular/router'; -import { ForgotPasswordComponent } from './pages/account/forgotpassword/forgotpassword.component'; -import { LoginComponent } from './pages/account/login/login.component'; -import { RegisterComponent } from './pages/account/register/register.component'; import { MistComponent } from './pages/project/mist/mist.component'; import { CatalogComponent } from './pages/store/catalog/catalog.component'; -import { AboutComponent } from './pages/legal/about/about.component'; -import { SettingsComponent } from './pages/account/settings/settings.component'; -import { LogoutComponent } from './pages/account/logout/logout.component'; -import { ResetPasswordComponent } from './pages/account/resetpassword/resetpassword.component'; -import { VerifyEmailComponent } from './pages/account/verifyemail/verifyemail.component'; import { NewItemComponent } from './pages/store/admin/newitem/new.component'; import { EditItemComponent } from './pages/store/admin/edititem/edit.component'; export const routes: Routes = [ - // Account stuff - { path: "account/forgotpassword", component: ForgotPasswordComponent }, - { path: "account/resetpassword", component: ResetPasswordComponent }, - { path: "account/verifyemail", component: VerifyEmailComponent }, - { path: "account/login", component: LoginComponent }, - { path: "account/logout", component: LogoutComponent }, - { path: "account/register", component: RegisterComponent }, - { path: "account/settings", component: SettingsComponent }, - // Projects { path: "project/mist", component: MistComponent }, @@ -32,7 +15,5 @@ export const routes: Routes = [ // AdminPages { path: "store/admin/new", component: NewItemComponent }, { path: "store/admin/edit", component: EditItemComponent }, - - // Legal - { path: "about", component: AboutComponent }, + ] \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/app.ts b/src/MistoxWebsite.Client/src/app/app.ts index 2471b2e..7230ee5 100644 --- a/src/MistoxWebsite.Client/src/app/app.ts +++ b/src/MistoxWebsite.Client/src/app/app.ts @@ -1,7 +1,8 @@ -import { Component, ElementRef, ViewChild } from '@angular/core'; -import { Router, RouterOutlet } from '@angular/router'; +import { Component, ElementRef, isDevMode, ViewChild } from '@angular/core'; +import { ActivatedRoute, Router, RouterOutlet } from '@angular/router'; import { Authentication } from './services/Authentication'; -import { CommonModule } from '@angular/common'; +import { CommonModule, Location } from '@angular/common'; +import { HttpClient } from '@angular/common/http'; @Component({ selector: 'app-root', @@ -11,12 +12,38 @@ import { CommonModule } from '@angular/common'; }) export class App { + devMode: boolean = false; + @ViewChild('homeLink') homeLink!: ElementRef; @ViewChild('mistLink') mistLink!: ElementRef; @ViewChild('storeLink') storeLink!: ElementRef; @ViewChild('aboutLink') aboutLink!: ElementRef; - constructor(public auth: Authentication, private router: Router){} + constructor( private http: HttpClient, public auth: Authentication, private router: Router, private route: ActivatedRoute, private location: Location){ + this.devMode = isDevMode(); + + this.route.queryParams.subscribe(params => { + const loginToken = params['LoginToken']; + console.log("LoginToken : " + loginToken); + if (loginToken){ + this.http.post( "api/account/loginticket", JSON.stringify(loginToken), { headers: {'Content-Type': 'application/json'} } ).subscribe({ + next: data => { + auth.getLoginState(); + const pathWithoutQuery = this.location.path().split('?')[0]; + this.location.replaceState(pathWithoutQuery); + }, + error: err => { + auth.getLoginState(); + const pathWithoutQuery = this.location.path().split('?')[0]; + this.location.replaceState(pathWithoutQuery); + } + }) + }else{ + auth.getLoginState(); + } + }); + + } ngAfterViewInit(){ let ViewLinks = [ this.homeLink, this.mistLink, this.storeLink, this.aboutLink ]; diff --git a/src/MistoxWebsite.Client/src/app/models/Account.ts b/src/MistoxWebsite.Client/src/app/models/Account.ts index 3ae7944..4440194 100644 --- a/src/MistoxWebsite.Client/src/app/models/Account.ts +++ b/src/MistoxWebsite.Client/src/app/models/Account.ts @@ -1,15 +1,7 @@ -import { WebSiteData } from "./WebsiteData"; - export class Account { - public id: number = -1; + public id: number | null = null; public userName: string = ""; public email: string = ""; - public emailVerified: boolean = false; - public passwordHash: string = ""; - public siteData: WebSiteData = new WebSiteData(); - public error: string = ""; - - constructor(init?: Partial) { - Object.assign(this, init); - } + public role: string = ""; + public dataServer: string = ""; } \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/models/Product.ts b/src/MistoxWebsite.Client/src/app/models/Product.ts index 1904aab..98fca5c 100644 --- a/src/MistoxWebsite.Client/src/app/models/Product.ts +++ b/src/MistoxWebsite.Client/src/app/models/Product.ts @@ -1,5 +1,5 @@ export class Product { - public id: number = -1; + public id: number | null = null; public name: string = ""; public description: string = ""; public curShowingIMG: number = 0; diff --git a/src/MistoxWebsite.Client/src/app/models/WebsiteData.ts b/src/MistoxWebsite.Client/src/app/models/WebsiteData.ts index bf00e26..775ca0e 100644 --- a/src/MistoxWebsite.Client/src/app/models/WebsiteData.ts +++ b/src/MistoxWebsite.Client/src/app/models/WebsiteData.ts @@ -1,5 +1,5 @@ export class WebSiteData { - public accountID: number = -1; + public accountID: number | null = null; public failedPasswordLock: boolean = false; public passwordAttempts: number = 5; public currentPasswordAttempts: number = 0; diff --git a/src/MistoxWebsite.Client/src/app/pages/account/forgotpassword/forgotpassword.component.html b/src/MistoxWebsite.Client/src/app/pages/account/forgotpassword/forgotpassword.component.html deleted file mode 100644 index c0e6404..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/forgotpassword/forgotpassword.component.html +++ /dev/null @@ -1,23 +0,0 @@ -
-
- -

Forgot Password

- -
- - -
- -
-
-
- -
-
-
- -
    -
  • {{ msg }}
    • -
-
-
\ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/forgotpassword/forgotpassword.component.ts b/src/MistoxWebsite.Client/src/app/pages/account/forgotpassword/forgotpassword.component.ts deleted file mode 100644 index 1a546a8..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/forgotpassword/forgotpassword.component.ts +++ /dev/null @@ -1,55 +0,0 @@ -import { Component } from '@angular/core'; -import { HttpClient, HttpHeaders, HttpParams } from '@angular/common/http'; -import { FormsModule } from '@angular/forms'; -import { Router, ActivatedRoute } from '@angular/router'; -import { Title } from '@angular/platform-browser'; -import { CommonModule } from '@angular/common'; - -@Component({ - selector: 'account-forgot', - templateUrl: './forgotpassword.component.html', - imports: [ FormsModule, CommonModule ] -}) -export class ForgotPasswordComponent { - email: string = ""; - errorMsgs: string[] = []; - returnURL: string = '/'; - - constructor( private http: HttpClient, private router: Router, private route: ActivatedRoute, private title: Title) { - this.title.setTitle("Forgot Password | Mistox"); - this.route.queryParams.subscribe(params => { - this.returnURL = params['returnURL'] || '/'; - }); - } - - sleep(ms: number) { - return new Promise(resolve => setTimeout(resolve, ms)); - } - - onSubmit() { - // Clear errors - this.errorMsgs = []; - - // Send to server and wait for response - this.errorMsgs.push("Waiting for response from server"); - const body = new HttpParams() - .set("Email", this.email) - const headers = new HttpHeaders({ - 'Content-Type': 'application/x-www-form-urlencoded', - }); - this.http.post( "api/account/sendresetpassword", body, { headers, responseType: "text" } ).subscribe({ - next: async (data) => { - if (data.trim() == "Success"){ - this.errorMsgs = ["Reset-password sent"]; - await this.sleep(3000); - this.router.navigate([this.returnURL]); - }else{ - this.errorMsgs = [data]; - } - }, - error: err => { - console.log("HTTP Error Signing In: ", err); - } - }); - } -} \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/login/login.component.html b/src/MistoxWebsite.Client/src/app/pages/account/login/login.component.html deleted file mode 100644 index 52431bb..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/login/login.component.html +++ /dev/null @@ -1,35 +0,0 @@ -
-
-

Login

- -
- - -
- -
- - -
- -
-
- -
- -
-
- Stay Logged In - -
-
- Forgot Password -
-
-
- -
    -
  • {{ msg }}
    • -
-
-
\ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/login/login.component.ts b/src/MistoxWebsite.Client/src/app/pages/account/login/login.component.ts deleted file mode 100644 index d0e23a9..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/login/login.component.ts +++ /dev/null @@ -1,57 +0,0 @@ -import { Component } from '@angular/core'; -import { HttpClient } from '@angular/common/http'; -import { FormsModule } from '@angular/forms'; -import { Router, ActivatedRoute } from '@angular/router'; -import { Title } from '@angular/platform-browser'; -import { CommonModule } from '@angular/common'; -import { Authentication, SessionType } from '../../../services/Authentication'; - -@Component({ - selector: 'account-login', - templateUrl: './login.component.html', - imports: [ FormsModule, CommonModule ], - standalone: true -}) -export class LoginComponent { - UserName: string = ""; - Password: string = ""; - StayLoggedIn: boolean = false; - errorMsgs: string[] = []; - returnURL: string = '/'; - - constructor( private http: HttpClient, private router: Router, private route: ActivatedRoute, private title: Title, public auth: Authentication ) { - this.title.setTitle("Login | Mistox"); - this.route.queryParams.subscribe(params => { - this.returnURL = params['returnURL'] || '/'; - }); - } - - onSubmit() { - this.errorMsgs = []; - - if (!this.UserName) { - this.errorMsgs.push("The 'username' field is required"); - } - if (!this.Password) { - this.errorMsgs.push("The 'password' field is required"); - } - if (this.Password.length < 6) { - this.errorMsgs.push("Password must be at least 6 Characters long"); - } - if (this.errorMsgs.length > 0) { - return; - } - - this.errorMsgs.push("Waiting for response from server"); - this.auth.Login(this.UserName, this.Password, this.StayLoggedIn).subscribe( - data => { - if (data.error.length === 0){ - this.router.navigate([this.returnURL]); - }else{ - this.errorMsgs.pop(); - this.errorMsgs.push(data.error); - } - } - ) - } -} \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/logout/logout.component.html b/src/MistoxWebsite.Client/src/app/pages/account/logout/logout.component.html deleted file mode 100644 index e69de29..0000000 diff --git a/src/MistoxWebsite.Client/src/app/pages/account/logout/logout.component.ts b/src/MistoxWebsite.Client/src/app/pages/account/logout/logout.component.ts deleted file mode 100644 index 5d4c3b1..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/logout/logout.component.ts +++ /dev/null @@ -1,27 +0,0 @@ -import { Component } from '@angular/core'; -import { HttpClient } from '@angular/common/http'; -import { FormsModule } from '@angular/forms'; -import { Router, ActivatedRoute } from '@angular/router'; -import { Title } from '@angular/platform-browser'; -import { CommonModule } from '@angular/common'; -import { Authentication } from '../../../services/Authentication'; - -@Component({ - selector: 'account-logout', - templateUrl: './logout.component.html', - imports: [ FormsModule, CommonModule ], - standalone: true -}) -export class LogoutComponent { - errorMsgs: string[] = []; - returnURL: string = '/'; - - constructor( private http: HttpClient, private router: Router, private route: ActivatedRoute, private title: Title, public auth: Authentication ) { - this.title.setTitle("Logout | Mistox"); - } - - ngAfterViewInit(){ - this.auth.Logout(); - this.router.navigate(["/"]); - } -} \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/register/register.component.html b/src/MistoxWebsite.Client/src/app/pages/account/register/register.component.html deleted file mode 100644 index e324cff..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/register/register.component.html +++ /dev/null @@ -1,35 +0,0 @@ -
-
-

Register

- -
- - -
- -
- - -
- -
- - -
- -
- - -
- -
-
- -
-
- -
    -
  • {{ msg }}
    • -
-
-
\ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/register/register.component.ts b/src/MistoxWebsite.Client/src/app/pages/account/register/register.component.ts deleted file mode 100644 index 5a7b7aa..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/register/register.component.ts +++ /dev/null @@ -1,85 +0,0 @@ -import { Component } from '@angular/core'; -import { HttpClient, HttpHeaders, HttpParams } from '@angular/common/http'; -import { FormsModule } from '@angular/forms'; -import { Router, ActivatedRoute } from '@angular/router'; -import { Account } from '../../../models/Account'; -import { Title } from '@angular/platform-browser'; -import { CommonModule } from '@angular/common'; - -@Component({ - selector: 'account-register', - templateUrl: './register.component.html', - imports: [ FormsModule, CommonModule ] -}) -export class RegisterComponent { - userName: string = "" - email: string = ""; - passwordHash: string = ""; - passwordHash2: string = ""; - error: string = ""; - - errorMsgs: string[] = []; - returnURL: string = '/'; - - constructor( private http: HttpClient, private router: Router, private route: ActivatedRoute, private title: Title ) { - this.title.setTitle("Register | Mistox"); - this.route.queryParams.subscribe(params => { - this.returnURL = params['returnURL'] || '/'; - }); - } - - sleep(ms: number) { - return new Promise(resolve => setTimeout(resolve, ms)); - } - - onSubmit() { - // Clear errors - this.errorMsgs = []; - - // Validate data - const regex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/; - if (!regex.test(this.email)){ - this.errorMsgs.push("A valid email is required"); - } - if (!this.userName) { - this.errorMsgs.push("The 'username' field is required"); - } - if (!this.passwordHash) { - this.errorMsgs.push("The 'password' field is required"); - } - if (this.passwordHash.length < 6) { - this.errorMsgs.push("Password must be at least 6 Characters long"); - } - if (this.passwordHash !== this.passwordHash2){ - this.errorMsgs.push("Passwords don't match"); - } - if (this.errorMsgs.length > 0) { - return; - } - - // Send to server and wait for response - this.errorMsgs.push("Waiting for response from server"); - const body = new HttpParams() - .set("Email", this.email) - .set("UserName", this.userName) - .set("PasswordHash", this.passwordHash); - const headers = new HttpHeaders({ - 'Content-Type': 'application/x-www-form-urlencoded' - }); - this.http.post( "api/account/register", body, { headers } ).subscribe({ - next: async (data) => { - if (data.error.length === 0){ - this.errorMsgs = ["Account Created"]; - await this.sleep(3000); - this.router.navigate([this.returnURL]); - }else{ - this.errorMsgs = []; - this.errorMsgs.push(data.error); - } - }, - error: err => { - console.log("HTTP Error Signing In: ", err); - } - }); - } -} \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/resetpassword/resetpassword.component.html b/src/MistoxWebsite.Client/src/app/pages/account/resetpassword/resetpassword.component.html deleted file mode 100644 index 3c3a393..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/resetpassword/resetpassword.component.html +++ /dev/null @@ -1,29 +0,0 @@ -
-
- -

Reset Password

-

User: {{ UserName }}

- -
- - -
- -
- - -
- -
-
-
- -
-
-
- -
    -
  • {{ msg }}
    • -
-
-
\ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/resetpassword/resetpassword.component.ts b/src/MistoxWebsite.Client/src/app/pages/account/resetpassword/resetpassword.component.ts deleted file mode 100644 index 7cb2467..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/resetpassword/resetpassword.component.ts +++ /dev/null @@ -1,69 +0,0 @@ -import { Component } from '@angular/core'; -import { HttpClient, HttpHeaders, HttpParams } from '@angular/common/http'; -import { FormsModule } from '@angular/forms'; -import { Router, ActivatedRoute } from '@angular/router'; -import { Title } from '@angular/platform-browser'; -import { CommonModule } from '@angular/common'; - -@Component({ - selector: 'account-reset', - templateUrl: './resetpassword.component.html', - imports: [ FormsModule, CommonModule ] -}) -export class ResetPasswordComponent { - - UserName: string = ""; - ResetPwd: string = ""; - Password: string = ""; - PassworR: string = ""; - - errorMsgs: string[] = []; - - constructor( private http: HttpClient, private router: Router, private route: ActivatedRoute, private title: Title ) { - this.title.setTitle("Reset Password | Mistox"); - this.route.queryParams.subscribe(params => { - this.UserName = params['UserName'] || ''; - this.ResetPwd = params['ResetPwd'] || ''; - }); - } - - sleep(ms: number) { - return new Promise(resolve => setTimeout(resolve, ms)); - } - - onSubmit() { - if (this.Password != this.PassworR){ - this.errorMsgs.push("Passwords must match"); - } - if (this.Password.length < 6){ - this.errorMsgs.push("Password must be at least 6 Characters long"); - } - if (this.errorMsgs.length == 0){ - // Send to server and wait for response - this.errorMsgs.push("Waiting for response from server"); - const body = new HttpParams() - .set("UserName", this.UserName) - .set("NewPassword", this.Password) - .set("ResetToken", this.ResetPwd); - const headers = new HttpHeaders({ - 'Content-Type': 'application/x-www-form-urlencoded' - }); - this.http.post( "api/account/resetpassword", body, { headers } ).subscribe({ - next: async (data) => { - if (data == true){ - this.errorMsgs = ["Password reset successfully"]; - await this.sleep(3000); - this.router.navigate(["/account/login"]); - }else{ - this.errorMsgs = ["An error has ocurred"]; - await this.sleep(3000); - this.router.navigate(["/account/sendresetpassword"]); - } - }, - error: err => { - console.log("HTTP Error Signing In: ", err); - } - }); - } - } -} \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/settings/settings.component.html b/src/MistoxWebsite.Client/src/app/pages/account/settings/settings.component.html deleted file mode 100644 index e69de29..0000000 diff --git a/src/MistoxWebsite.Client/src/app/pages/account/settings/settings.component.ts b/src/MistoxWebsite.Client/src/app/pages/account/settings/settings.component.ts deleted file mode 100644 index de3b951..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/settings/settings.component.ts +++ /dev/null @@ -1,29 +0,0 @@ -import { Component } from '@angular/core'; -import { HttpClient } from '@angular/common/http'; -import { FormsModule } from '@angular/forms'; -import { Router, ActivatedRoute } from '@angular/router'; -import { Account } from '../../../models/Account'; -import { Title } from '@angular/platform-browser'; -import { CommonModule } from '@angular/common'; - -@Component({ - selector: 'account-settings', - templateUrl: './settings.component.html', - imports: [ FormsModule, CommonModule ] -}) -export class SettingsComponent { - user!: Account; - errorMsgs: string[] = []; - returnURL: string = '/'; - - constructor( private http: HttpClient, private router: Router, private route: ActivatedRoute, private title: Title ) { - this.title.setTitle("Settings | Mistox"); - this.route.queryParams.subscribe(params => { - this.returnURL = params['returnURL'] || '/'; - }); - } - - onSubmit() { - - } -} \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/verifyemail/verifyemail.component.html b/src/MistoxWebsite.Client/src/app/pages/account/verifyemail/verifyemail.component.html deleted file mode 100644 index a8a8ddc..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/verifyemail/verifyemail.component.html +++ /dev/null @@ -1,8 +0,0 @@ -
-
- -

Verifying Email

-

{{ Result }}

- -
-
\ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/account/verifyemail/verifyemail.component.ts b/src/MistoxWebsite.Client/src/app/pages/account/verifyemail/verifyemail.component.ts deleted file mode 100644 index 044a57c..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/account/verifyemail/verifyemail.component.ts +++ /dev/null @@ -1,54 +0,0 @@ -import { Component } from '@angular/core'; -import { HttpClient, HttpHeaders, HttpParams } from '@angular/common/http'; -import { FormsModule } from '@angular/forms'; -import { Router, ActivatedRoute } from '@angular/router'; -import { Title } from '@angular/platform-browser'; -import { CommonModule } from '@angular/common'; - -@Component({ - selector: 'account-verifyemail', - templateUrl: './verifyemail.component.html', - imports: [ FormsModule, CommonModule ] -}) -export class VerifyEmailComponent { - - UserName: string = ""; - Guid: string = ""; - Result: string = ""; - - constructor( private http: HttpClient, private router: Router, private route: ActivatedRoute, private title: Title ) { - this.title.setTitle("Verify Email | Mistox"); - this.route.queryParams.subscribe(params => { - this.UserName = params['UserName'] || ''; - this.Guid = params['Guid'] || ''; - }); - } - - sleep(ms: number) { - return new Promise(resolve => setTimeout(resolve, ms)); - } - - async onSubmit() { - // Send to server and wait for response - const body = new HttpParams() - .set("UserName", this.UserName) - .set("EmailToken", this.Guid); - const headers = new HttpHeaders({ - 'Content-Type': 'application/x-www-form-urlencoded' - }); - this.http.post( "api/account/verifyemail", body, { headers } ).subscribe({ - next: async (data) => { - if (data == true){ - this.Result = "Verified Email Successfully"; - }else{ - this.Result = "Email was not able to be verified please resend email"; - } - await this.sleep(3000); - this.router.navigate(["/"]); - }, - error: err => { - console.log("HTTP Error Signing In: ", err); - } - }); - } -} \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/legal/about/about.component.html b/src/MistoxWebsite.Client/src/app/pages/legal/about/about.component.html deleted file mode 100644 index e84c4c4..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/legal/about/about.component.html +++ /dev/null @@ -1,28 +0,0 @@ -
-
-

Welcome to Mistox LLC. A project and hobby of Derek Holloway.

-
-

I am an indi-developer who has been making small projects since I was 13. I originally learned lua and spent 4 years mastering it. Then I moved onto C# which is my preferred language

-

My programming catalog consist of C#, Lua, SQL, C++, C, and JavaScript in the order of knowledge from best to passiable.

-

Im currently in college for computer sciences and should honestly be doing that instead of this but I find working on this website and hobby games to be way more enjoyable.

-
-

I would love to learn how to use Blender in order to make all the models for my games but with the amount of work ive already made for myself im going to hold off for now.

-

This website and everything on it are the long countless hours of my time and motivation to create something that I can be proud of and share that with the world.

-

So if you would like to support me as a small creator please feel free to leave a donation from on the store page. It would means a lot to me.

-
-

For the nerds out there, this website is a blazor webassembly app, hosted on an ubuntu webserver, with a mysql backend.

-

All the passwords are encrypted using bcrypt for your safety and all the data is only allowed through SSL.

-

After you make your account. All the data in the database is easily accessable through the account settings and

-

you can delete your account at any time. Including all your data with it so there is no risk.

-

I wont show ads and never will and I refuse to use trackers on this site.

-
-
-

If you have any questions, concerns, or would like to suggest a feature, bug-fix, or request to help. Please feel

-

free to reach out to me at derek@mistox.net

- - - Buy Me a Coffee at ko-fi.com - - -
-
\ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/legal/about/about.component.ts b/src/MistoxWebsite.Client/src/app/pages/legal/about/about.component.ts deleted file mode 100644 index 633ccb3..0000000 --- a/src/MistoxWebsite.Client/src/app/pages/legal/about/about.component.ts +++ /dev/null @@ -1,19 +0,0 @@ -import { Component } from '@angular/core'; -import { HttpClient } from '@angular/common/http'; -import { FormsModule } from '@angular/forms'; -import { Router, ActivatedRoute } from '@angular/router'; -import { Title } from '@angular/platform-browser'; -import { CommonModule } from '@angular/common'; - -@Component({ - selector: 'legal-about', - templateUrl: './about.component.html', - imports: [ FormsModule, CommonModule ] -}) -export class AboutComponent { - - constructor( private http: HttpClient, private router: Router, private route: ActivatedRoute, private title: Title ) { - this.title.setTitle("About | Mistox"); - }; - -} \ No newline at end of file diff --git a/src/MistoxWebsite.Client/src/app/pages/store/admin/edititem/edit.component.ts b/src/MistoxWebsite.Client/src/app/pages/store/admin/edititem/edit.component.ts index 272fefc..9b42933 100644 --- a/src/MistoxWebsite.Client/src/app/pages/store/admin/edititem/edit.component.ts +++ b/src/MistoxWebsite.Client/src/app/pages/store/admin/edititem/edit.component.ts @@ -32,13 +32,13 @@ export class EditItemComponent { } // If user is not Admin -> route home - if (auth.loggedInUser.siteData.role != "Admin"){ + if (auth.loggedInUser.role != "Admin"){ router.navigate(["/"]); } // Load product const formData = new FormData(); - formData.append("productID", this.newItem.id.toString()); + formData.append("productID", this.newItem.id!.toString()); this.http.post( "api/product/get", formData ).subscribe({ next: async (data) => { this.newItem = data; diff --git a/src/MistoxWebsite.Client/src/app/pages/store/admin/newitem/new.component.ts b/src/MistoxWebsite.Client/src/app/pages/store/admin/newitem/new.component.ts index 2171eb7..f54a60e 100644 --- a/src/MistoxWebsite.Client/src/app/pages/store/admin/newitem/new.component.ts +++ b/src/MistoxWebsite.Client/src/app/pages/store/admin/newitem/new.component.ts @@ -28,7 +28,7 @@ export class NewItemComponent { } // If user is not Admin -> route home - if (auth.loggedInUser.siteData.role != "Admin"){ + if (auth.loggedInUser.role != "Admin"){ router.navigate(["/"]); } }; diff --git a/src/MistoxWebsite.Client/src/app/pages/store/catalog/catalog.component.html b/src/MistoxWebsite.Client/src/app/pages/store/catalog/catalog.component.html index ee11ebb..2388fd8 100644 --- a/src/MistoxWebsite.Client/src/app/pages/store/catalog/catalog.component.html +++ b/src/MistoxWebsite.Client/src/app/pages/store/catalog/catalog.component.html @@ -15,16 +15,16 @@

${{ (product.cost/100).toFixed(2) }}

-
+
-
-
+
diff --git a/src/MistoxWebsite.Client/src/app/services/Authentication.ts b/src/MistoxWebsite.Client/src/app/services/Authentication.ts index ca3b9ae..ed676de 100644 --- a/src/MistoxWebsite.Client/src/app/services/Authentication.ts +++ b/src/MistoxWebsite.Client/src/app/services/Authentication.ts @@ -1,84 +1,39 @@ import { Injectable } from "@angular/core"; import { Account } from "../models/Account"; import { BehaviorSubject, Observable } from "rxjs"; -import { HttpClient, HttpHeaders, HttpParams } from "@angular/common/http"; +import { HttpClient } from "@angular/common/http"; @Injectable({ providedIn: 'root' }) export class Authentication{ - private _user = new BehaviorSubject(this.getUserFromStorage()); + private _user = new BehaviorSubject( new Account ); user$ = this._user.asObservable(); constructor( private http: HttpClient){ } - Login(UserName: string, Password: string, StayLoggedIn: boolean): Observable { - - const body = new HttpParams() - .set("UserName", UserName) - .set("PasswordHash", Password) - .set("StayLoggedIn", StayLoggedIn ); - const headers = new HttpHeaders({ - 'Content-Type': 'application/x-www-form-urlencoded' - }); - - let sub = this.http.post( "api/account/login", body, { headers } ); + getLoginState(): Observable { + let sub = this.http.post( "api/account/loginState", {}, {} ); sub.subscribe({ next: data => { - if (data.error.length === 0){ - this._user.next(data); - this.setUserToStorage(data, StayLoggedIn == true ? SessionType.Forever : SessionType.Session); - } + this._user.next(data); }, error: err => { - console.log("HTTP Error Signing In: ", err); + console.log("No login state found: ", err.error); } }); return sub; } Logout(){ - this.http.post( "api/account/logout", {}, { responseType: 'json' } ).subscribe( ); this._user.next( new Account ); - this.delUserFromStorage(); + return this.http.post( "api/account/logout", {}, { responseType: 'json' } ); } get isLoggedIn(): boolean { - return this._user.value.id != -1 ? true : false; + return this._user.value.id != null ? true : false; } get loggedInUser(): Account { return this._user.value; } - - private getUserFromStorage(): Account { - const foreverUser = localStorage.getItem('user'); - const sessionUser = sessionStorage.getItem('user'); - let user = null; - if (foreverUser != null){ - user = JSON.parse(foreverUser) - } else if (sessionUser != null){ - user = JSON.parse(sessionUser) - } else { - user = new Account(); - user.id = -1; - } - return user; - } - private setUserToStorage(user: Account, session: SessionType): void { - if (session == SessionType.Forever){ - localStorage.setItem('user', JSON.stringify(user)); - }else if(session == SessionType.Session){ - sessionStorage.setItem('user', JSON.stringify(user)); - } - } - private delUserFromStorage(): void { - localStorage.removeItem('user'); - sessionStorage.removeItem('user'); - } - -} - -export enum SessionType { - Forever, - Session } \ No newline at end of file diff --git a/src/MistoxWebsite.Server/Controllers/AuthenticationController.cs b/src/MistoxWebsite.Server/Controllers/AuthenticationController.cs index 96b2e58..e2dc61e 100755 --- a/src/MistoxWebsite.Server/Controllers/AuthenticationController.cs +++ b/src/MistoxWebsite.Server/Controllers/AuthenticationController.cs @@ -1,284 +1,48 @@ -using Microsoft.AspNetCore.Authentication; -using Microsoft.AspNetCore.Authentication.Cookies; -using Microsoft.AspNetCore.Mvc; -using System.Security.Claims; -using MistoxWebsite.Server.Services; +using Microsoft.AspNetCore.Mvc; using MistoxWebsite.Server.Services.DatabaseService; using MistoxWebsite.Server.Entities; +using System.Text.Json; +using System.Text; namespace MistoxWebsite.Server.Controllers { [ApiController] [Route("api/account/")] public class AuthenticationController : MistoxControllerBase { - EmailService _emailContext; + public AuthenticationController(DatabaseService db) : base(db) { } - public AuthenticationController(DatabaseService db, EmailService emailContext) : base(db) { - _emailContext = emailContext; + [HttpPost("loginstate")] + public ActionResult LoginState() { + if (isLoggedIn()) { + return Ok(getLoggedInUser()); + } + return NotFound("Not logged in"); } - [Route("login")] - [HttpPost] - public async Task> Login([FromForm] string UserName, [FromForm] string PasswordHash, [FromForm] bool StayLoggedIn) { - try { - Account? test = await _databaseService.GetAccount(UserName.ToLower()); - if (test != null) { - if (test.EmailVerified == true) { - if (test.FailedPasswordLock) { - if (test.CurrentPasswordAttempts >= test.PasswordAttempts) { - return new Account() { Error = "Too many failed password attempts. Please reset your password" }; - } - } - if (BCrypt.Net.BCrypt.Verify(PasswordHash, test.PasswordHash)) { - test.CurrentPasswordAttempts = 0; - await _databaseService.SetAccount(test); - - List claims = new List() { - new Claim("ID", test.ID.ToString()) - }; - - await HttpContext.SignInAsync( - CookieAuthenticationDefaults.AuthenticationScheme, - new ClaimsPrincipal(new ClaimsIdentity(claims, "Auth")), - new AuthenticationProperties { - ExpiresUtc = DateTime.UtcNow.AddYears(30), // Add 30 years with sliding on - IsPersistent = StayLoggedIn, // Is set from the StayLoggedIn - } - ); - return test; - } - else { - test.CurrentPasswordAttempts += 1; - await _databaseService.SetAccount(test); - return new Account() { Error = "Wrong password" }; - } - } - else { - await SendVerify(test.UserName); - return new Account() { Error = "A new verify email has been sent. \n Note only 1 email send every 5 mintes" }; - } + [HttpPost("loginticket")] + public async Task LoginTicket([FromBody] string LoginToken) { + using (HttpClient client = new HttpClient()) { + var payload = new { ticket = LoginToken }; + StringContent jsonPayload = new StringContent(JsonSerializer.Serialize(payload), Encoding.UTF8, "application/json"); + HttpResponseMessage JWTResponse = await client.PostAsync("https://auth.mistox.com/api/auth/token", jsonPayload); + if (JWTResponse.IsSuccessStatusCode) { + string JWT = await JWTResponse.Content.ReadAsStringAsync(); + signIn(JWT); + return Ok(); + } else { + string error = await JWTResponse.Content.ReadAsStringAsync(); + return NotFound(error); } - return new Account() { Error = "User doesn't exist" }; - } catch (Exception ex) { - return new Account() { Error = ex.Message }; } } - [Route("register")] - [HttpPost] - public async Task> Register([FromForm] string Email, [FromForm] string UserName, [FromForm] string PasswordHash) { - try { - if (await _databaseService.GetAccount(UserName.ToLower()) == null) { - if (await _databaseService.GetAccount(Email.ToLower()) == null) { - Account? created = new Account() { - UserName = UserName.ToLower(), - Email = Email.ToLower(), - EmailVerified = false, - PasswordHash = BCrypt.Net.BCrypt.HashPassword(PasswordHash), - }; - await _databaseService.SetAccount(created); - created = await _databaseService.GetAccount(Email.ToLower()); - if (created != null) { - await SendVerify(created.UserName); - return created; - } - return new Account() { Error = "Unknown Error" }; - } - else { - return new Account() { Error = "Email is already in use" }; - } - } - else { - return new Account() { Error = "UserName is taken" }; - } - } catch (Exception ex) { - Console.WriteLine("Error: " + ex.Message); - return new Account() { Error = ex.Message }; - } - - } - - [Route("changepassword")] - [HttpPost] - public async Task> ChangePassword([FromForm] string OldPassword, [FromForm] string NewPassword) { - try { - if (isLoggedIn()) { - Account user = await getLoggedInUser(); - if (BCrypt.Net.BCrypt.Verify(OldPassword, user.PasswordHash)) { - user.PasswordHash = BCrypt.Net.BCrypt.HashPassword(NewPassword); - user.CurrentPasswordAttempts = 0; - await _databaseService.SetAccount(user); - return true; - } - } - return false; - } catch { - return false; - } - } - - [Route("toggleaccountlock")] - [HttpPost] - public async Task> ToggleAccountLock([FromForm] bool AccountLock) { - try { - if (isLoggedIn()) { - Account user = await getLoggedInUser(); - user.FailedPasswordLock = AccountLock; - user.CurrentPasswordAttempts = 0; - await _databaseService.SetAccount(user); - return "Account Lock Status Updated"; - } - return "Unknown Error Occurred"; - } catch (Exception ex) { - return ex.Message; - } - } - - [Route("get")] - [HttpPost] - public async Task> Get() { - try { - if (isLoggedIn()) { - return await getLoggedInUser(); - } - return Ok(); - } catch { - return Ok(); - } - } - - [Route("logout")] - [HttpPost] - public async Task Logout() { - await HttpContext.SignOutAsync(); - } - - [Route("sendverifyemail")] - [HttpPost] - public async Task> SendVerify([FromForm] string UserName) { - try { - string key = "v" + UserName; - // Stop from sending multiple emails quickly - if (_emailContext._SentEmails.ContainsKey(key)) { - DateTime PreviousSentTime = _emailContext._SentEmails.GetValueOrDefault(key); - if (PreviousSentTime.AddMinutes(5) > DateTime.Now) { - return "Cannot sent another verify email until 5 minutes has elapsed "; - } - else { - _emailContext._SentEmails.Remove(key); - } - } - Account? test = await _databaseService.GetAccount(UserName.ToLower()); - if (test != null) { - test.EmailToken = Guid.NewGuid().ToString(); - await _databaseService.SetAccount(test); - - string EmailContents = EmailService.VerifyEmailEmail; - EmailContents = Substitue(EmailContents, "@UserName", UserName); - EmailContents = Substitue(EmailContents, "@UserName", UserName); - EmailContents = Substitue(EmailContents, "@VerifyPassword", test.EmailToken); - - string result = _emailContext.Send(test.Email, EmailService.VerifyEmailSubject, EmailContents); - _emailContext._SentEmails.Add(key, DateTime.Now); - return result; - } - return "Account not found"; - } catch (Exception) { - return "The connection couldn't be established to the email server"; - } - } - - [Route("verifyemail")] - [HttpPost] - public async Task> VerifyEmail([FromForm] string UserName, [FromForm] string EmailToken) { - try { - Account? test = await _databaseService.GetAccount(UserName.ToLower()); - if (test != null) { - if (!string.IsNullOrEmpty(test.EmailToken) && test.EmailToken == EmailToken) { - test.EmailToken = ""; - test.EmailVerified = true; - await _databaseService.SetAccount(test); - return true; - } - } - return false; - } catch { - return false; - } - } - - [Route("sendresetpassword")] - [HttpPost] - public async Task> ResetPassword([FromForm] string Email) { - try { - string key = "p" + Email.ToLower(); - // Stop from sending multiple emails quickly - if (_emailContext._SentEmails.ContainsKey(key)) { - DateTime PreviousSentTime = _emailContext._SentEmails.GetValueOrDefault(key); - if (PreviousSentTime.AddMinutes(5) > DateTime.Now) { - return "Cannot sent another reset requests until 5 minutes has elapsed"; - } - else { - _emailContext._SentEmails.Remove(key); - } - } - Account? test = await _databaseService.GetAccount(Email.ToLower()); - if (test != null) { - test.EmailToken = Guid.NewGuid().ToString(); - await _databaseService.SetAccount(test); - - string EmailContents = EmailService.ResetPasswordEmail; - EmailContents = Substitue(EmailContents, "@UserName", test.UserName); - EmailContents = Substitue(EmailContents, "@UserName", test.UserName); - EmailContents = Substitue(EmailContents, "@ResetPassWord", test.EmailToken); - - string result = _emailContext.Send(test.Email, EmailService.VerifyEmailSubject, EmailContents); - _emailContext._SentEmails.Add(key, DateTime.Now); - return result; - } - return "Account Not Found"; - } catch (Exception e) { - Console.WriteLine("EmailService Error: " + e.ToString()); - return "The connection couldn't be established to the email server"; - } - - } - - [Route("resetpassword")] - [HttpPost] - public async Task> ResetPwdVerify([FromForm] string UserName, [FromForm] string NewPassword, [FromForm] string ResetToken) { - try { - Account? test = await _databaseService.GetAccount(UserName.ToLower()); - if (test != null && !string.IsNullOrEmpty(test.EmailToken)) { - if (!string.IsNullOrEmpty(test.EmailToken) && test.EmailToken == ResetToken) { - test.CurrentPasswordAttempts = 0; - test.EmailToken = ""; - test.PasswordHash = BCrypt.Net.BCrypt.HashPassword(NewPassword); - await _databaseService.SetAccount(test); - return true; - } - } - return false; - } catch { - return false; - } - } - - [Route("delete")] - [HttpPost] - public async Task> delete([FromForm] string Password) { - try { - if (isLoggedIn()) { - Account user = await getLoggedInUser(); - if (BCrypt.Net.BCrypt.Verify(Password, user.PasswordHash)) { - await _databaseService.DeleteAccount(user.ID); - return true; - } - } - return false; - } catch { - return false; + [HttpGet("logout")] + public ActionResult Logout() { + if (isLoggedIn()) { + signOut(); + return Redirect("/"); } + return NotFound("Not logged in"); } } diff --git a/src/MistoxWebsite.Server/Controllers/MistoxControllerBase.cs b/src/MistoxWebsite.Server/Controllers/MistoxControllerBase.cs index 1fb2aad..2ff03d5 100644 --- a/src/MistoxWebsite.Server/Controllers/MistoxControllerBase.cs +++ b/src/MistoxWebsite.Server/Controllers/MistoxControllerBase.cs @@ -1,4 +1,5 @@ using Microsoft.AspNetCore.Mvc; +using System.Security.Claims; using MistoxWebsite.Server.Entities; using MistoxWebsite.Server.Services.DatabaseService; @@ -12,6 +13,19 @@ namespace MistoxWebsite.Server.Controllers { _databaseService = databaseService; } + public void signIn(string JWT) { + Response.Cookies.Append("mistox_session", JWT, new CookieOptions { + Secure = true, + HttpOnly = true, + SameSite = SameSiteMode.Strict, + Expires = DateTime.UtcNow.AddDays(7) + }); + } + + public void signOut() { + Response.Cookies.Delete("mistox_session"); + } + public bool isLoggedIn() { if (User.Identity != null && User.Identity.IsAuthenticated) { return true; @@ -20,16 +34,19 @@ namespace MistoxWebsite.Server.Controllers { } public int getLoggedInUserID() { - return Convert.ToInt32(User.FindFirst("ID")?.Value); + return Convert.ToInt32(User.FindFirstValue(ClaimTypes.NameIdentifier)); } - public async Task getLoggedInUser() { + public Account getLoggedInUser() { try { - Account? test = await _databaseService.GetAccount(getLoggedInUserID()); - if (test != null) { - return test; - } - return new Account(); + Account building = new Account { + ID = Convert.ToInt32(User.FindFirstValue(ClaimTypes.NameIdentifier)), + UserName = User.FindFirstValue(ClaimTypes.Name)!.ToString(), + Email = User.FindFirstValue(ClaimTypes.Email)!.ToString(), + Role = User.FindFirstValue(ClaimTypes.Role)!.ToString(), + DataServer = User.FindFirstValue(ClaimTypes.UserData)!.ToString() + }; + return building; } catch { return new Account(); } diff --git a/src/MistoxWebsite.Server/Controllers/ProductController.cs b/src/MistoxWebsite.Server/Controllers/ProductController.cs index 364fd0e..64b86c0 100755 --- a/src/MistoxWebsite.Server/Controllers/ProductController.cs +++ b/src/MistoxWebsite.Server/Controllers/ProductController.cs @@ -14,7 +14,7 @@ namespace MistoxWebsite.Server.Controllers { public async Task> CreateProduct([FromForm] Product obj, [FromForm] IFormFile[] images) { try { if (isLoggedIn()) { - Account user = await getLoggedInUser(); + Account user = getLoggedInUser(); if (user.Role == "Admin") { List building = new List(); foreach (var file in images) { @@ -70,7 +70,7 @@ namespace MistoxWebsite.Server.Controllers { public async Task> DeleteProduct([FromForm] int productID) { try { if (isLoggedIn()) { - Account user = await getLoggedInUser(); + Account user = getLoggedInUser(); if (user.Role == "Admin") { await _databaseService.DeleteProduct(productID); return true; diff --git a/src/MistoxWebsite.Server/Entities/DatabaseObjects.cs b/src/MistoxWebsite.Server/Entities/DatabaseObjects.cs index 6809d73..e83ac27 100755 --- a/src/MistoxWebsite.Server/Entities/DatabaseObjects.cs +++ b/src/MistoxWebsite.Server/Entities/DatabaseObjects.cs @@ -3,17 +3,11 @@ namespace MistoxWebsite.Server.Entities { public class Account { - public int ID { get; set; } // PK + public int? ID { get; set; } // PK public string UserName { get; set; } = ""; public string Email { get; set; } = ""; - public bool EmailVerified { get; set; } = false; - public string PasswordHash { get; set; } = ""; - public bool FailedPasswordLock { get; set; } = false; - public int PasswordAttempts { get; set; } = 5; - public int CurrentPasswordAttempts { get; set; } = 0; public string Role { get; set; } = "Generic"; - public string EmailToken { get; set; } = ""; - public string Error { get; set; } = ""; + public string DataServer { get; set; } = ""; } public class Product { diff --git a/src/MistoxWebsite.Server/MistoxWebsite.Server.csproj b/src/MistoxWebsite.Server/MistoxWebsite.Server.csproj index 621ce3d..c14307e 100755 --- a/src/MistoxWebsite.Server/MistoxWebsite.Server.csproj +++ b/src/MistoxWebsite.Server/MistoxWebsite.Server.csproj @@ -11,6 +11,7 @@ + diff --git a/src/MistoxWebsite.Server/Program.cs b/src/MistoxWebsite.Server/Program.cs index 1418cc5..f1cde2c 100755 --- a/src/MistoxWebsite.Server/Program.cs +++ b/src/MistoxWebsite.Server/Program.cs @@ -1,4 +1,10 @@ +using System.IdentityModel.Tokens.Jwt; +using System.Security.Claims; +using System.Security.Cryptography; +using System.Threading.RateLimiting; using Microsoft.AspNetCore.Authentication.Cookies; +using Microsoft.AspNetCore.Authentication.JwtBearer; +using Microsoft.IdentityModel.Tokens; using MistoxWebsite.Server.Controllers.Payment; using MistoxWebsite.Server.Services; using MistoxWebsite.Server.Services.DatabaseService; @@ -78,25 +84,97 @@ if (IPayment._PaymentType == PaymentType.StripeIntent) { IPayment._EndpointSecret = string.IsNullOrEmpty(StripeEndpointKey) ? "" : StripeEndpointKey; } -// Authentication Service -builder.Services.AddAuthentication( options => { - options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme; -} ).AddCookie(options => { - options.Cookie.HttpOnly = true; - options.Cookie.SecurePolicy = CookieSecurePolicy.Always; - options.Cookie.SameSite = SameSiteMode.Strict; - options.LoginPath = "/account/login"; - options.LogoutPath = "/account/logout"; - options.SlidingExpiration = true; +//////////////////////////////// +/////// Auth Service //////// +//////////////////////////////// + +RsaSecurityKey? PublicKey = null; +using (HttpClient client = new HttpClient()) { + while (PublicKey == null) { + HttpResponseMessage PublicKeyResponse = await client.GetAsync("https://auth.mistox.com/api/auth/publickey"); + if (PublicKeyResponse.IsSuccessStatusCode) { + string publicKey = await PublicKeyResponse.Content.ReadAsStringAsync(); + RSA rsa = RSA.Create(); + rsa.ImportFromPem(publicKey); + PublicKey = new RsaSecurityKey(rsa); + } else { + await Task.Delay(2000); // sleep the main thread for 2 seconds before sending another request. Prevent DDOS of my own equiptment + } + } +} + +builder.Services.AddAuthentication(options => { + options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme; + options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme; +}).AddJwtBearer(options => { + options.TokenValidationParameters = new TokenValidationParameters { + ValidateIssuer = true, + ValidateAudience = true, + ValidateLifetime = true, + ValidateIssuerSigningKey = true, + ValidIssuer = "https://auth.mistox.com", + ValidAudience = "mistox-llc-auth-token", + IssuerSigningKey = PublicKey, + ClockSkew = TimeSpan.FromMinutes(1) + }; + options.Events = new JwtBearerEvents { + OnMessageReceived = context => { + context.Token = context.Request.Cookies["mistox_session"]; + return Task.CompletedTask; + }, + OnTokenValidated = context => { + var jwtToken = context.SecurityToken as JwtSecurityToken; + if (jwtToken != null) { + var exp = jwtToken.ValidTo; + var now = DateTime.UtcNow; + if ((exp - now) < TimeSpan.FromDays(3)) { + // Impliment token refresh + } + } + return Task.CompletedTask; + } + }; }); -builder.Services.AddCors( o => o.AddDefaultPolicy( builder => { - builder.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader(); // No CORS -} ) ); +//////////////////////////////// +/// Rate Limiting Service //// +//////////////////////////////// + +List allowedOrigins = new List{ "https://mistox.com", "https://www.mistox.com" }; +if (builder.Environment.IsDevelopment()) { + allowedOrigins.Add("http://localhost:5000"); +} + +builder.Services.AddCors(options => { + options.AddDefaultPolicy(policy => { + policy.WithOrigins(allowedOrigins.ToArray()) + .AllowAnyHeader() + .AllowAnyMethod() + .AllowCredentials(); + }); +}); + +builder.Services.AddRateLimiter(options => { + options.AddPolicy("PerUserPolicy", httpContext => { + var userId = httpContext.User.FindFirst(ClaimTypes.NameIdentifier)?.Value + ?? $"ip:{httpContext.Connection.RemoteIpAddress}"; + + return RateLimitPartition.GetTokenBucketLimiter(userId, key => new TokenBucketRateLimiterOptions { + TokenLimit = 10, // max 10 requests + QueueProcessingOrder = QueueProcessingOrder.OldestFirst, + QueueLimit = 0, + ReplenishmentPeriod = TimeSpan.FromSeconds(15), + TokensPerPeriod = 2, + AutoReplenishment = true + }); + }); +}); + +//////////////////////////////// +///// ASPNET Core Function ///// +//////////////////////////////// -// Pages Service builder.Services.AddControllers(); -builder.Services.AddRazorPages(); var app = builder.Build(); @@ -108,6 +186,8 @@ if( !app.Environment.IsDevelopment() ) { app.UseDefaultFiles(); app.UseStaticFiles(); +app.UseRateLimiter(); + app.UseCors(); app.UseRouting(); diff --git a/src/MistoxWebsite.Server/Services/DatabaseService/Account.cs b/src/MistoxWebsite.Server/Services/DatabaseService/Account.cs deleted file mode 100755 index 8181b53..0000000 --- a/src/MistoxWebsite.Server/Services/DatabaseService/Account.cs +++ /dev/null @@ -1,160 +0,0 @@ -using MistoxWebsite.Server.Entities; -using MySql.Data.MySqlClient; -using System.Data; -using System.Data.Common; - -namespace MistoxWebsite.Server.Services.DatabaseService { - public partial class DatabaseService { - - public async Task GetAccount( string UserNameOrEmail ) { - Account? account = null; - using( MySqlConnection connection = GetConnection() ) { - connection.Open(); - string command = @" - SELECT * - FROM Account - WHERE UserName = @UorE OR Email = @UorE; - "; - - MySqlCommand cmd = new MySqlCommand(command, connection); - cmd.Parameters.AddWithValue("@UorE", UserNameOrEmail); - - using( DbDataReader reader = await cmd.ExecuteReaderAsync() ) { - while( await reader.ReadAsync() ) { - if( reader == null ) { - break; - } - - int _id = reader.GetInt32("ID"); - string _username = reader.GetString("UserName"); - string _email = reader.GetString("Email"); - bool _emailVerified = reader.GetBoolean("EmailVerified"); - string _passwordhash = reader.GetString("PasswordHash"); - bool _failedpasswordlock = reader.GetBoolean( "FailedPasswordLock" ); - int _passwordattempts = reader.GetInt32( "PasswordAttempts" ); - int _curpasswordattempts = reader.GetInt32( "CurrentPasswordAttempts" ); - string _role = reader.GetString( "Role" ); - string _emailtoken = reader.GetString( "EmailToken" ); - - account = new Account() { - ID = _id, - UserName = _username, - Email = _email, - EmailVerified = _emailVerified, - PasswordHash = _passwordhash, - CurrentPasswordAttempts = _curpasswordattempts, - PasswordAttempts = _passwordattempts, - EmailToken = _emailtoken, - FailedPasswordLock = _failedpasswordlock, - Role = _role, - }; - } - } - } - return account; - } - - public async Task GetAccount( int ID ) { - Account? account = null; - using( MySqlConnection connection = GetConnection() ) { - connection.Open(); - string command = @" - SELECT * - FROM Account - WHERE ID = @ID; - "; - - MySqlCommand cmd = new MySqlCommand(command, connection); - cmd.Parameters.AddWithValue("@ID", ID); - - using( DbDataReader reader = await cmd.ExecuteReaderAsync() ) { - while( await reader.ReadAsync() ) { - if( reader == null ) { - break; - } - int _id = reader.GetInt32("ID"); - string _username = reader.GetString("UserName"); - string _email = reader.GetString("Email"); - bool _emailVerified = reader.GetBoolean("EmailVerified"); - string _passwordhash = reader.GetString("PasswordHash"); - bool _failedpasswordlock = reader.GetBoolean( "FailedPasswordLock" ); - int _passwordattempts = reader.GetInt32( "PasswordAttempts" ); - int _curpasswordattempts = reader.GetInt32( "CurrentPasswordAttempts" ); - string _role = reader.GetString( "Role" ); - string _emailtoken = reader.GetString( "EmailToken" ); - - account = new Account() { - ID = _id, - UserName = _username, - Email = _email, - EmailVerified = _emailVerified, - PasswordHash = _passwordhash, - CurrentPasswordAttempts = _passwordattempts, - PasswordAttempts = _passwordattempts, - EmailToken = _emailtoken, - FailedPasswordLock = _failedpasswordlock, - Role = _role, - }; - } - } - } - return account; - } - - public async Task SetAccount( Account Profile ) { - using( MySqlConnection connection = GetConnection() ) { - connection.Open(); - - string command = @" - INSERT INTO Account - (ID,UserName,Email,EmailVerified,PasswordHash,FailedPasswordLock,PasswordAttempts,CurrentPasswordAttempts,Role,EmailToken) - VALUES - (@ID,@UserName,@Email,@EmailVerified,@PasswordHash,@FailedPasswordLock,@PasswordAttempts,@CurrentPasswordAttempts,@Role,@EmailToken) - ON DUPLICATE KEY UPDATE - UserName = @UserName, - Email = @Email, - EmailVerified = @EmailVerified, - PasswordHash = @PasswordHash, - FailedPasswordLock = @FailedPasswordLock, - PasswordAttempts = @PasswordAttempts, - CurrentPasswordAttempts = @CurrentPasswordAttempts, - Role = @Role, - EmailToken = @EmailToken; - "; - - MySqlCommand cmd = new MySqlCommand( command , connection); - cmd.Parameters.AddWithValue("@ID", Profile.ID); - cmd.Parameters.AddWithValue("@UserName", Profile.UserName); - cmd.Parameters.AddWithValue("@Email", Profile.Email); - cmd.Parameters.AddWithValue("@EmailVerified", Profile.EmailVerified); - cmd.Parameters.AddWithValue("@PasswordHash", Profile.PasswordHash); - cmd.Parameters.AddWithValue("@FailedPasswordLock", Profile.FailedPasswordLock); - cmd.Parameters.AddWithValue("@PasswordAttempts", Profile.PasswordAttempts); - cmd.Parameters.AddWithValue("@CurrentPasswordAttempts", Profile.CurrentPasswordAttempts); - cmd.Parameters.AddWithValue("@Role", Profile.Role); - cmd.Parameters.AddWithValue("@EmailToken", Profile.EmailToken); - - await cmd.ExecuteNonQueryAsync(); - } - } - - public async Task DeleteAccount( int ID ) { - using( MySqlConnection connection = GetConnection() ) { - MySqlCommand cmd; - connection.Open(); - - string command = @" - DELETE FROM Account WHERE ID = @ID; - DELETE FROM AccountInventory WHERE AccountID = @ID; - DELETE FROM ProjectMistData WHERE AccountID = @ID; - DELETE FROM Cart WHERE AccountID = @ID; - "; - cmd = new MySqlCommand( command, connection ); - cmd.Parameters.AddWithValue("@ID", ID); - - await cmd.ExecuteNonQueryAsync(); - } - } - - } -}