hamid
3a51305343
- six REST endpoints (auth/request_otp, verify_otp, refresh, logout, me, me/select_role) wrapping the existing JWE/TOTP/RBAC engine - usr.UserSessions with refresh-token rotation + stolen-token (replay) detection → revoke-all + 401; logout rotates the security stamp - users extended: gender, national_id (enc, NULL until KYC), shahkar_verified_at (auto-reset on phone change), phone_hash UNIQUE, is_active, deleted_at + soft-delete filter; phone/email/national_id encrypted at rest via IFieldEncryptor value converter - user_roles grant/revoke audit trail + global revoked filter; 7 roles seeded; admin sub-roles never self-assignable (403) - ISmsSender seam (mock logs the OTP code) replaces the TODO log lines - OperationResult/BaseController learned enveloped 401/403 - auth knobs as platform_configs rows (resend/attempts/session TTL) - migration IdentitySessionsAndUserExtensions applied to the dev DB - 24 new tests incl. Baya.Test.Api (WebApplicationFactory over SQLite); 47 total green, zero new build warnings; swagger snapshot + contract (identity-auth.md), handoff, report, mocks-registry updated Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
32 lines
1.3 KiB
C#
32 lines
1.3 KiB
C#
using System.ComponentModel.DataAnnotations;
|
|
using Asp.Versioning;
|
|
using Baya.Application.Features.Identity.Commands.SelectRole;
|
|
using Baya.Application.Features.Identity.Queries.GetMe;
|
|
using Baya.Application.Models.Identity;
|
|
using Baya.WebFramework.Attributes;
|
|
using Baya.WebFramework.BaseController;
|
|
using Mediator;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
|
|
namespace Baya.Web.Api.Controllers.V1;
|
|
|
|
[ApiVersion("1")]
|
|
[ApiController]
|
|
[Route("api/v{version:apiVersion}/[controller]")]
|
|
[Authorize]
|
|
[Display(Description = "The signed-in user's identity, roles and role selection")]
|
|
public sealed class MeController(ISender sender) : BaseController
|
|
{
|
|
[HttpGet]
|
|
[ProducesOkApiResponseType<MeResult>]
|
|
public async Task<IActionResult> GetMe(CancellationToken cancellationToken)
|
|
=> OperationResult(await sender.Send(new GetMeQuery(), cancellationToken));
|
|
|
|
/// <remarks>Role claims live inside the access token — after selecting a role the client should
|
|
/// refresh its tokens to pick the new role up.</remarks>
|
|
[HttpPost("[action]")]
|
|
[ProducesOkApiResponseType<MeResult>]
|
|
public async Task<IActionResult> SelectRole(SelectRoleCommand command, CancellationToken cancellationToken)
|
|
=> OperationResult(await sender.Send(command, cancellationToken));
|
|
} |