Proxy

Infrastructure/Services/ServicesDependencyInjection.cs

@@ -71,6 +71,20 @@ namespace Musify.Infrastructure.Services
             return serviceDescriptors;
         }
 
+        public static IServiceCollection AddStreamTicketService(this IServiceCollection serviceDescriptors, IConfiguration configuration)
+        {
+            serviceDescriptors
+                .AddOptionsWithValidateOnStart<StreamTicketConfiguration>()
+                .Bind(configuration.GetRequiredSection(StreamTicketConfiguration.SectionName))
+                .ValidateDataAnnotations();
+
+            serviceDescriptors.AddSingleton(serviceProvider =>
+                serviceProvider.GetRequiredService<IOptions<StreamTicketConfiguration>>().Value);
+
+            serviceDescriptors.AddSingleton<IStreamTicketService, StreamTicketService>();
+            return serviceDescriptors;
+        }
+
         public static IServiceCollection AddAudioTranscoder(this IServiceCollection serviceDescriptors, IConfiguration configuration)
         {
             serviceDescriptors

Infrastructure/Services/StreamTicketService.cs

@@ -0,0 +1,52 @@
+using System.Security.Cryptography;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.Tokens;
+using Musify.Application.Contracts;
+using Musify.Infrastructure.Configuration;
+
+namespace Musify.Infrastructure.Services
+{
+    public sealed class StreamTicketService : IStreamTicketService, IDisposable
+    {
+        private readonly StreamTicketConfiguration configuration;
+        private readonly RSA rsa;
+        private readonly SigningCredentials signingCredentials;
+        private readonly JsonWebTokenHandler tokenHandler = new();
+
+        public StreamTicketService(StreamTicketConfiguration configuration)
+        {
+            this.configuration = configuration;
+
+            rsa = RSA.Create();
+            rsa.ImportFromPem(File.ReadAllText(configuration.PrivateKeyPath));
+
+            var key = new RsaSecurityKey(rsa);
+            signingCredentials = new SigningCredentials(key, SecurityAlgorithms.RsaSha256);
+        }
+
+        public StreamTicket IssueTicket(Guid userId, string keyPrefix)
+        {
+            var now = DateTimeOffset.UtcNow;
+
+            var descriptor = new SecurityTokenDescriptor
+            {
+                Issuer = configuration.Issuer,
+                Audience = configuration.Audience,
+                IssuedAt = now.UtcDateTime,
+                NotBefore = now.UtcDateTime,
+                Expires = now.AddSeconds(configuration.TicketTtlSeconds).UtcDateTime,
+                Claims = new Dictionary<string, object>
+                {
+                    ["sub"] = userId.ToString(),
+                    ["prefix"] = keyPrefix,
+                },
+                SigningCredentials = signingCredentials,
+            };
+
+            var token = tokenHandler.CreateToken(descriptor);
+            return new StreamTicket(token, configuration.TicketTtlSeconds);
+        }
+
+        public void Dispose() => rsa.Dispose();
+    }
+}