From debb4ebc61ca077ec7a74cda34448cfb4fd92ac6 Mon Sep 17 00:00:00 2001
From: Garrritt McCune <glmccune@gmail.com>
Date: Fri, 15 Jan 2021 14:21:40 -0600
Subject: [PATCH] Added some minor tweaks, and set up the EmployeeController to
 be usable by a frontend to see how well all this works so far.

---
 .vs/SecureCore/v16/.suo                      | Bin 58880 -> 60416 bytes
 SecureCore/Authentication/SessionManager.cs  |  11 +++++++++++
 SecureCore/Controllers/AuthController.cs     |  13 ++++++-------
 SecureCore/Controllers/EmployeeController.cs |  16 ++++++++--------
 4 files changed, 25 insertions(+), 15 deletions(-)

diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo
index 4b7545f8f262ca298ae7f3979c4d77df3bdadb64..cd91533e35895f33c0f4bdfd7302ccb6928495f4 100644
GIT binary patch
delta 2058
zcmZoT!`yI#d4dfi|3+JWCPv1|7nv1!1xrqazP`q&&cMLX;5oU9$&W>rfq`MNe5B%J
z115H+9}JVfF*PyCvrevJuHp@1U|>+=X8;4q$&4(*_2LW+4F93vACv}Byijo^C@sOj
zz>vkjz>p2)>oPDf$b(E{U|<knU|>*XU|?WjU|^7g%7e@RIYfbhfkA|UfkBypfq|8Q
zfgy!~fx(S|fkB0VfkB3Wp`JmMfq{XWfq_92s!@x9fkB6XfkBLcfx(c0fuRU04l)pg
zjTjghj2Rdh%#g$_plmBB9S^1LptL;$1A_wt1A`+21A`L-1A_}x+?9cyfgz58fq`RU
zp!ehyPLW7Z5F{`#FeEZCFeEWBFeEcDFeoxGFr-0sXhZ2t1_p*a1_lN}1_p*41_p*)
z1_p)#1_p+F1_p*g1_lOU1_lO@S;Y(t3?&Q<3>gyx^(Qgqa0dAJ2Y{l>d2%V6|6~_t
zgUw&qG#CT*pvv_b7#R2%7#KjI&&I&O01ACesFh(13=H8=b)e7(1qKL%LLWrKFb@L*
zgTcf=@yRVL3IZ@eP-ueKlee%aC~`qfw1v_dP#P2sAVusT-8`&5jDnLRS*00;CI-q+
zp2C_lv4De@nUR5kg^_`Qm63tr-^9dnP8CK522~JeV`4VrB(WnblAzSrAE~qWix?vh
zD00gf!O4wb6W0+Y4p0&?1*w3h&&^*10+=~Kp$hUUEY)r<5%Fi*d{~Q>5o8xUF|&aZ
zQW@jqU%{S}otX_MmxKgxfRYL*+TmKigzzvfQe#>q!!$|7nUfLZ9~)!~OH_IoCoho@
znJgk<BLRvcP|$#K0Vsuo94`e@ogpzp0G3)nia>a>fTYZ19aavoZV$;Fi<FoaIWR5S
z$FxX;X^|Auq9CS4dN?gT!o+i)fq~%y0|Uc5kOeO4B^>V=7#Kc)I0w{aSV1=Yo0up+
zNu-1^aB`_gJ!8P+uOjt~ev?Z@yBC?UOp;NVtirPZBLo+J;bCO+2j{-YzqHS>aDohk
zhi;rdBPTckgMtngMr@z}NfDS_W#Gpmgrt1(7lQ^ym&v7u^^DG&zb0}sEiz$R<iaw^
z%7p_IjG!C}Gh%XyRRg2Q=C4-VjFaq~A+cfC!WgmnryV=vB%31~91IK$=168w@@3il
z!-j)#Q3cZ`4+qAG2nGfQP{IJE^1idr^^f}NF3POcb+WzIBYSSuhih9pb)D`V_CNpF
zVnW34|GG}X?;lCKaC57FYt(fTeP7$0vobotuS3_VCGcRux|3fmzkJmN<!pw@Gdwdu
zG2z8D`JR{EWV@_GJVs%`0U)bfor41=^JJS$%093tf@$)BY==ocWt+G8crh-D;g~#W
zf8ORiKOttuMUxu?m6<siL?#O;iEQ3I-IZxk7R#ixKE_Ft9aB;nlP4SA6`y=8MT}8n
za(~)%#=gmpDXxnOm?kTwDows~PJ}Uca^q#;$@|j7CNIcPU}TtlFvEUvLk8ob5~j(Q
zGG#W;nH$B(Q<R#VUz8eCoSMwYFgc;z4wUB^EQ}3IP0Y+qYWGeqtTtLy!Ni>+04Yh>
z7!FP@toEN=(4{xIBj0thNZGN;zQwtVYM3UM=gV@W<`(4SSEi;;o{?|5xo1HK<K(mR
z_fNi6c9DgR!R08DP97Acf}*Zajn4UbB}Mr;Ig|6-EG92#Qk-1UW(=ldw>wXcuIAyA
zW?*0dr7;(f)4=Z7tW!0G5$vFMbwQJb8>1&nH!k7=B|cE$ie&4%I{wMG7FtdAZ84ra
zp+#nq2h-#YZ4#3cS`;QvXi=JM-6}NsM4QFrfNE|rP+EkP6{-ge7#JAbK}Gd`sQUvZ
z>l7<ae%LKPxv$4*a#PPlUQmXGC|5dQF<GJa!Q_B#29pi81xz;BCbOu|VDkB%0RAqB
z3I<TA$jrbn`QbkK$pxuwllhdQHs9N)#K;kG9#kAMFibw!Y%%%3ZjH$w7D_BS!!qeo
z!{n8kB9o_FUbFbXQpU*+R~j}u)Hg6LK5&I`^MS?#jFS)CY*=)PX|ltuhRqEv4UCH}
zuual%m^^8R*JQ5S6_c6T?Is^`6q-Egw%+81^#>*!ovvfjV_1Bki*d5U9fwIh4wFCK
zHrTx3fdJFwhHVEXH#}~b{Nb#_qFXGJKkbp29I;1Zv%`)9jEf#IZQ9kqxVd3Z8q?$l
PN>Y>di)<D-_l6Mw86Uv_

delta 1202
zcmZp;!Q60$d4dh2)J9u=rpZ2R3VahbUA#W=)ip+E1_lNP-^o=>ek?2u3=EUyBNZnb
zFtKm`!p6hM$Um8pMVMEQfq~&a6#Sc*DD0yI70_p3U<iY<LGro`3=CROz5tX4iG#2X
z0|SErnpil<!Uhf%0bT|M21^D81~CQ(2Cyr(a40B>Kvmm9X$>f?38h&l28vJS;q+mY
zpB%|4%^JtR!0>NkqV(h`oH>)&ayS(>y|@PQpz`EWHh&Inn8^tLX)xA{g7p0V|6iPe
zfkBXgfkB9YfkA?SfdS+}1*kPn3=9mi3=9lx3=9k)4}v@+$-uw>@*ocb1A`0$0|OUS
zEl5s|fq{XKfq{XYfq}t=fq?<!Tn7dQ1~&!<1{DSd1``Gb1~mo-26YC8dIm$NMo<8N
zG=l;FL?=SUL2M8<Vqjn}W?*12V_;xVh00k#X)7pg1EuYtv^@g@gCYY1gChe21IYXG
zP;plV28MVB1_lm>i9ueIQ&>eN7O=P`FfcF(GcYiuFfcGALqjDEsv!$XgB$|F*$fN}
zISdR8xeN>p1xRv969erx@f~5}U}RumFa^aeJg^0L7~wJ?cO#OSKmhY(7ZZccB_jSz
ztc)P{PVSG?S^R~EkrR{v%0OmKUZ^0xS;S0$WwVOR9mYvIhdIHa4vHy+K{`B)lT1oB
zmx%N*E>dEeWZ*p6nb~l2iNO)3$rjQl7HKeT5<9^-`2?>H8^qknzpT%(fFc}Wgbfel
zB0Z)_b}o}$m<=YEBm_)8!fUYkOF{q>2PXpq14tiSafxFO(;_pLNggg791IK$pcH|S
zE9haI<a2}r6!qpv;V>zhW%Cao4#r6}hbJHQGTr>6hJ$gD3ezM%4;GZ*D)H-KT;#&C
zsDo+pfdHP(JQKdKFVbO}B;m};2+BsF0GeDP5x@b8aZv2TE&d|G!#GI}>T|gs#zhfK
zi=>zq#c(W|!L}%iWzjsQMFmWgA1?0M+_RvBaZw4=<ic)|$!DvMZN9Zgjd775(`3d*
zoy`}Tr!Y=Fu+(8u4b!4!T#GuG7Hwcz)Mqg1<+IJt)T9^}ZR42q^4Vk|4JiS+ouBlJ
zea|LWw~03~UrS##xn`Hf<fyyLCOhm=THJ7eX>r2=mdQz(B9r+v%r<*n*v7i(63gTS
hRj<htZU}6Sy0?sZvddm1&VkzpHXnH6z_{oM69Bm;oFf1L

diff --git a/SecureCore/Authentication/SessionManager.cs b/SecureCore/Authentication/SessionManager.cs
index 658b4d7..5495804 100644
--- a/SecureCore/Authentication/SessionManager.cs
+++ b/SecureCore/Authentication/SessionManager.cs
@@ -1,12 +1,14 @@
 using System;
 using System.Data;
 using System.Data.SqlClient;
+using Microsoft.AspNetCore.Http;
 
 namespace SecureCore.Authentication
 {
     public static class SessionManager
     {
         private static int SessionKeySize { get; } = 64; //n bytes
+        public static string SessionCookieName { get; } = "Session";
 
         public static string CreateSessionToken()
         {
@@ -32,6 +34,15 @@ namespace SecureCore.Authentication
             return Convert.ToBoolean(result);
         }
 
+        public static bool IsSessionTokenValid(HttpContext context)
+        {
+            AppSettingsManager.TryGetConnectionStringByName("MainDataConnectionString", out string connectionString);
+
+            if (!context.Request.Cookies.ContainsKey(SessionCookieName)) return false;
+
+            return IsSessionTokenValid(context.Request.Cookies[SessionCookieName], connectionString);
+        }
+
         public static void Logout(string sessionToken, string connectionString)
         {
             using var connection = new SqlConnection(connectionString);
diff --git a/SecureCore/Controllers/AuthController.cs b/SecureCore/Controllers/AuthController.cs
index 13b4dcc..3b65183 100644
--- a/SecureCore/Controllers/AuthController.cs
+++ b/SecureCore/Controllers/AuthController.cs
@@ -20,9 +20,8 @@ namespace SecureCore.Controllers
             
             try
             {
-                if (HttpContext.Request.Cookies.ContainsKey("Session"))
-                    if (SessionManager.IsSessionTokenValid(HttpContext.Request.Cookies["Session"], connectionString))
-                        return Ok("Logged in\n");
+                if (SessionManager.IsSessionTokenValid(HttpContext))
+                    return Ok("Logged in\n");
 
                 //Verify that the username provided is valid, i.e. no whitespace, special characters, etc.
                 var result = UserDataService.IsUsernameValid(info.Username);
@@ -47,7 +46,7 @@ namespace SecureCore.Controllers
 
                 SessionManager.Login(info.Username, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString);
 
-                HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions);
+                HttpContext.Response.Cookies.Append(SessionManager.SessionCookieName, sessionToken, cookieOptions);
 
                 return Ok($"Logged in success{Environment.NewLine}");
             }
@@ -89,7 +88,7 @@ namespace SecureCore.Controllers
 
                 var i = UserDataService.RegisterNewUser(info.Username, info.Email, hash, salt, sessionToken, cookieOptions.Expires.Value.UtcDateTime, agent, ip, connectionString);
 
-                HttpContext.Response.Cookies.Append("Session", sessionToken, cookieOptions);
+                HttpContext.Response.Cookies.Append(SessionManager.SessionCookieName, sessionToken, cookieOptions);
 
                 return Ok($"New User ID: {i}");
             }
@@ -109,14 +108,14 @@ namespace SecureCore.Controllers
 
             try
             {
-                SessionManager.Logout(HttpContext.Request.Cookies["Session"], connectionString);
+                SessionManager.Logout(HttpContext.Request.Cookies[SessionManager.SessionCookieName], connectionString);
             }
             catch(Exception e)
             {
                 //TODO: decide what to do here. If the SQL fails to clear the token from the database, do we want to clear the token cookie?
             }
 
-            HttpContext.Response.Cookies.Delete("Session");
+            HttpContext.Response.Cookies.Delete(SessionManager.SessionCookieName);
 
             return Ok();
         }
diff --git a/SecureCore/Controllers/EmployeeController.cs b/SecureCore/Controllers/EmployeeController.cs
index 8759034..8ecec09 100644
--- a/SecureCore/Controllers/EmployeeController.cs
+++ b/SecureCore/Controllers/EmployeeController.cs
@@ -24,19 +24,19 @@ namespace SecureCore.Controllers
         [HttpGet]
         public IActionResult Get()
         {
-            //if (Authentication.IsAllowed(HttpContext))
-            return Ok(DataService.Get());
-            //else
-            //    return Unauthorized();
+            if(SessionManager.IsSessionTokenValid(HttpContext))
+                return Ok(DataService.Get());
+            else
+               return Unauthorized();
         }
 
         [HttpGet("{id}", Name = "Get")]
         public IActionResult Get(int id)
         {
-            //if (Authentication.IsAllowed(HttpContext))
-            return Ok(DataService.GetById(id));
-            //else
-            //    return Unauthorized();
+            if (SessionManager.IsSessionTokenValid(HttpContext))
+                return Ok(DataService.GetById(id));
+            else
+                return Unauthorized();
         }
     }