Added basic auth checking code. First bit of code to protect an API call in the Employee controller.

2021-01-03 18:44:08 -06:00
parent 26ea8e8cbc
commit ddb42da7bb
15 changed files with 670 additions and 15 deletions
@@ -0,0 +1,125 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using System.Data;
+using System.Transactions;
+using System.Data.SqlClient;
+
+namespace SecureCore.Services
+{
+    public static class UserDataService
+    {
+        private static string ConnectionString = @"Server=DESKTOP-OEDDVKC\SQLEXPRESS;Database=main;Integrated Security=true;";
+
+        public static (string PasswordHash, string SaltHash) GetUserPasswordHash(string userName)
+        {
+            var userId = GetUserId(userName);
+
+            using(var connection = new SqlConnection(ConnectionString))
+            {
+                using(var command = new SqlCommand("SELECT [Password Hash], [Salt Hash] FROM Login WHERE [User Key] = @UserId", connection))
+                {
+                    command.Parameters.AddWithValue("UserId", userId);
+
+                    connection.Open();
+
+                    var reader = command.ExecuteReader();
+
+                    reader.Read();
+
+                    return (reader["Password Hash"].ToString(), reader["Salt Hash"].ToString());
+                }
+            }
+        }
+
+        public static int GetUserId(string userName)
+        {
+            using (var connection = new SqlConnection(ConnectionString))
+            {
+                using (var command = new SqlCommand("SELECT [User ID] FROM [User] WHERE Name = @UserName", connection))
+                {
+                    command.Parameters.AddWithValue("UserName", userName);
+
+                    connection.Open();
+
+                    return Convert.ToInt32(command.ExecuteScalar());
+                }
+            }
+        }
+
+        public static void WriteUserPasswordAndSalt(string password, string salt, int userId)
+        {
+            using (var connection = new SqlConnection(ConnectionString))
+            {
+                using (var command = new SqlCommand("INSERT INTO [Login]([Password Hash], [Salt Hash], [User Key]) VALUES (@PasswordHash, @SaltHash, @UserKey)", connection))
+                {
+                    command.Parameters.AddWithValue("PasswordHash", password);
+                    command.Parameters.AddWithValue("SaltHash", salt);
+                    command.Parameters.AddWithValue("UserKey", userId);
+
+                    connection.Open();
+
+                    command.ExecuteNonQuery();
+                }
+            }
+        }
+
+        public static void SetUserSessionToken(int userId, string sessionToken, DateTime expirationDate)
+        {
+            using (var connection = new SqlConnection(ConnectionString))
+            {
+                using (var command = new SqlCommand("INSERT INTO [Session]([Session Token], [Expiration Date], [User ID]) VALUES (@SessionToken, @ExpirationDate, @UserKey)", connection))
+                {
+                    command.Parameters.AddWithValue("SessionToken", sessionToken);
+                    command.Parameters.AddWithValue("ExpirationDate", expirationDate);
+                    command.Parameters.AddWithValue("UserKey", userId);
+
+                    connection.Open();
+
+                    command.ExecuteNonQuery();
+                }
+            }
+        }
+
+        public static int RegisterNewUser(string userName, string email, string passwordHash, string saltHash, string sessionToken, DateTime expirationDate)
+        {
+            using (var connection = new SqlConnection(ConnectionString))
+            {
+                using (var command = new SqlCommand("RegisterNewUser", connection) { CommandType = CommandType.StoredProcedure })
+                {
+                    command.Parameters.AddWithValue("UserName", userName);
+                    command.Parameters.AddWithValue("Email", email);
+                    command.Parameters.AddWithValue("Password", passwordHash);
+                    command.Parameters.AddWithValue("Salt", saltHash);
+                    command.Parameters.AddWithValue("SessionToken", sessionToken);
+                    command.Parameters.AddWithValue("ExpirationDate", expirationDate);
+
+                    connection.Open();
+
+                    var result = command.ExecuteScalar();
+
+                    return Convert.ToInt32(result);
+                }
+            }
+        }
+
+        public static bool IsSessionTokenValid(string sessionToken)//, string userName)
+        {
+            using (var connection = new SqlConnection(ConnectionString))
+            {
+                using (var command = new SqlCommand("SELECT 1 AS Valid WHERE EXISTS(SELECT 1 FROM Session WHERE [Session Token] = @SessionToken)", connection))// AND[User ID] = @UserId)", connection))
+                {
+                    command.Parameters.AddWithValue("SessionToken", sessionToken);
+                    //command.Parameters.AddWithValue("UserId", GetUserId(userName));
+
+                    connection.Open();
+
+                    var result = command.ExecuteScalar();
+
+                    return Convert.ToBoolean(result);
+                }
+            }
+        }
+    }
+}