hamid
3a51305343
- six REST endpoints (auth/request_otp, verify_otp, refresh, logout, me, me/select_role) wrapping the existing JWE/TOTP/RBAC engine - usr.UserSessions with refresh-token rotation + stolen-token (replay) detection → revoke-all + 401; logout rotates the security stamp - users extended: gender, national_id (enc, NULL until KYC), shahkar_verified_at (auto-reset on phone change), phone_hash UNIQUE, is_active, deleted_at + soft-delete filter; phone/email/national_id encrypted at rest via IFieldEncryptor value converter - user_roles grant/revoke audit trail + global revoked filter; 7 roles seeded; admin sub-roles never self-assignable (403) - ISmsSender seam (mock logs the OTP code) replaces the TODO log lines - OperationResult/BaseController learned enveloped 401/403 - auth knobs as platform_configs rows (resend/attempts/session TTL) - migration IdentitySessionsAndUserExtensions applied to the dev DB - 24 new tests incl. Baya.Test.Api (WebApplicationFactory over SQLite); 47 total green, zero new build warnings; swagger snapshot + contract (identity-auth.md), handoff, report, mocks-registry updated Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
22 lines
894 B
C#
22 lines
894 B
C#
using Baya.Domain.Entities.User;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using Microsoft.EntityFrameworkCore.Metadata.Builders;
|
|
|
|
namespace Baya.Infrastructure.Persistence.Configuration.UserConfig;
|
|
|
|
internal class UserRoleConfig:IEntityTypeConfiguration<UserRole>
|
|
{
|
|
public void Configure(EntityTypeBuilder<UserRole> builder)
|
|
{
|
|
|
|
builder.HasOne(u => u.User).WithMany(u => u.UserRoles).HasForeignKey(u => u.UserId);
|
|
builder.HasOne(u => u.Role).WithMany(u => u.Users).HasForeignKey(u => u.RoleId);
|
|
builder.HasOne<User>().WithMany().HasForeignKey(u => u.GrantedById);
|
|
|
|
// Revoked grants are history, not membership: hiding them here makes every role read
|
|
// (Identity's GetRoles, the JWT claims factory, /me) respect revocation automatically.
|
|
builder.HasQueryFilter(ur => ur.RevokedAt == null);
|
|
|
|
builder.ToTable("UserRoles","usr");
|
|
}
|
|
} |