Admin
695f4378c6
- Document every endpoint's responses (Produces<T>/status codes/validation) so the generated OpenAPI/Scalar docs carry response schemas and status codes instead of empty responses - Cache recently-synced user ids (IMemoryCache, 15 min) in the JWT TokenValidated handler so user provisioning no longer hits the DB on every authenticated request - Add ProblemDetails + UseExceptionHandler for consistent RFC7807 errors - Add ToCreatedResult ErrorOr helper and use it in the create endpoints - Normalize the playlists route to lowercase (/playlists) Verified: booted the Api against RabbitMQ + Postgres in Docker and inspected /openapi/v1.json — operations now expose response schemas/status codes and the route is /playlists. Build: 0 warnings, 0 errors.
67 lines
2.3 KiB
C#
67 lines
2.3 KiB
C#
using Mediator;
|
|
using Microsoft.AspNetCore.Authentication.JwtBearer;
|
|
using Microsoft.Extensions.Caching.Memory;
|
|
using Musify.Application.Users;
|
|
using System.Security.Claims;
|
|
|
|
namespace Musify.Api.Authentication;
|
|
|
|
public sealed class JwtBearerEventsHandler(
|
|
IMediator mediator,
|
|
IMemoryCache cache,
|
|
ILogger<JwtBearerEventsHandler> logger) : JwtBearerEvents
|
|
{
|
|
private static readonly TimeSpan UserSyncCacheTtl = TimeSpan.FromMinutes(15);
|
|
|
|
public override async Task TokenValidated(TokenValidatedContext tokenValidatedContext)
|
|
{
|
|
var principal = tokenValidatedContext.Principal!;
|
|
|
|
var rawId = principal.FindFirstValue(ClaimTypes.NameIdentifier);
|
|
if (!long.TryParse(rawId, out var userId))
|
|
{
|
|
logger.LogWarning("Token subject '{Subject}' is not a numeric id; skipping user provisioning", rawId);
|
|
return;
|
|
}
|
|
|
|
var cacheKey = $"user-synced:{userId}";
|
|
if (cache.TryGetValue(cacheKey, out _))
|
|
return;
|
|
|
|
var username = principal.FindFirstValue(ClaimTypes.Name)
|
|
?? principal.FindFirstValue("preferred_username")
|
|
?? principal.FindFirstValue(ClaimTypes.Email)
|
|
?? rawId!;
|
|
|
|
var firstName = principal.FindFirstValue(ClaimTypes.GivenName);
|
|
var lastName = principal.FindFirstValue(ClaimTypes.Surname);
|
|
var profilePictureUrl = principal.FindFirstValue("picture");
|
|
|
|
try
|
|
{
|
|
await mediator.Send(
|
|
new SyncUserCommand(userId, username, firstName, lastName, profilePictureUrl),
|
|
tokenValidatedContext.HttpContext.RequestAborted);
|
|
|
|
cache.Set(cacheKey, true, UserSyncCacheTtl);
|
|
}
|
|
catch (Exception exception)
|
|
{
|
|
logger.LogError(exception, "Failed to sync user {UserId} during token validation", userId);
|
|
}
|
|
}
|
|
|
|
public override Task AuthenticationFailed(AuthenticationFailedContext context)
|
|
{
|
|
logger.LogWarning(context.Exception, "JWT authentication failed");
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
public override Task Challenge(JwtBearerChallengeContext context)
|
|
{
|
|
if (context.AuthenticateFailure is not null)
|
|
logger.LogWarning("JWT challenge: {Error} - {Description}", context.Error, context.ErrorDescription);
|
|
return Task.CompletedTask;
|
|
}
|
|
}
|