Musify/backend/Hosts/Musify.StreamingGateway/Authentication/TicketValidator.cs

using System.Security.Cryptography;
using Microsoft.IdentityModel.JsonWebTokens;
using Microsoft.IdentityModel.Tokens;
using Musify.StreamingGateway.Configuration;

namespace Musify.StreamingGateway.Authentication
{
    public sealed record TicketValidationResult(string Prefix, long? MaxBytes)
    {
        public static readonly TicketValidationResult Invalid = new(string.Empty, null);

        public bool IsValid => Prefix.Length > 0;
    }

    public sealed class TicketValidator : IDisposable
    {
        private readonly RSA rsa;
        private readonly TokenValidationParameters validationParameters;
        private readonly JsonWebTokenHandler handler = new();

        public TicketValidator(StreamTicketValidationConfiguration configuration)
        {
            rsa = RSA.Create();
            rsa.ImportFromPem(File.ReadAllText(configuration.PublicKeyPath));

            validationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidIssuer = configuration.Issuer,
                ValidateAudience = true,
                ValidAudience = configuration.Audience,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new RsaSecurityKey(rsa),
                ValidAlgorithms = [SecurityAlgorithms.RsaSha256],
                ClockSkew = TimeSpan.FromSeconds(30),
            };
        }

        public async Task<TicketValidationResult> ValidateTicketAsync(string? token)
        {
            if (string.IsNullOrWhiteSpace(token))
                return TicketValidationResult.Invalid;

            var result = await handler.ValidateTokenAsync(token, validationParameters);
            if (!result.IsValid)
                return TicketValidationResult.Invalid;

            var prefix = result.ClaimsIdentity?.FindFirst("prefix")?.Value;
            if (string.IsNullOrEmpty(prefix))
                return TicketValidationResult.Invalid;

            var maxBytesClaim = result.ClaimsIdentity?.FindFirst("maxBytes")?.Value;
            var maxBytes = long.TryParse(maxBytesClaim, out var parsed) ? parsed : (long?)null;

            return new TicketValidationResult(prefix, maxBytes);
        }

        public void Dispose() => rsa.Dispose();
    }
}