glm94/secure-core
1
0
Fork 0
Code Issues 9 Pull Requests Releases Wiki Activity

Cleaned up and refactored the code to make things much easier to understand.

Browse Source
This commit is contained in:
glm94
2021-01-13 11:24:19 -06:00
parent 4721a70ea7
commit e198838a32
6 changed files with 149 additions and 267 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SecureCore/Services/UserDataService.cs
+18 -181
View File
@@ -3,7 +3,6 @@ using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using System.Data;
using System.Transactions;
using System.Data.SqlClient;
namespace SecureCore.Services
@@ -13,202 +12,40 @@ namespace SecureCore.Services
//
public static int UserNameMaxLength { get; } = 64;
private static string ConnectionString = @"Server=DESKTOP-OEDDVKC\SQLEXPRESS;Database=main;Integrated Security=true;";
public static (bool IsValid, string Message) UserNameIsValid(string userName)
public static (bool IsValid, string Message) IsUsernameValid(string userName)
{
if (userName.Length > UserNameMaxLength) return (false, $"Username to long, must not exceed {UserNameMaxLength} characters.");
if (userName.Length > UserNameMaxLength) return (false, $"Username too long, must not exceed {UserNameMaxLength} characters.");
var invalidChars = new List<char>();
foreach(var c in userName)
{
if (char.IsPunctuation(c) || char.IsSymbol(c) || char.IsControl(c) || char.IsSeparator(c) || char.IsWhiteSpace(c)) invalidChars.Add(c);//return (false, $"The character '{c}' is not allowed.");
}
if (char.IsPunctuation(c) || char.IsSymbol(c) || char.IsControl(c) || char.IsSeparator(c) || char.IsWhiteSpace(c)) invalidChars.Add(c);
if (invalidChars.Count > 0) return (false, $"The characters '{string.Join(",", invalidChars)}' are not allowed in a user name.");
if (invalidChars.Count > 0) return (false, $"The character(s) '{string.Join(",", invalidChars)}' are not allowed in a user name.");
return (true, string.Empty);
}
public static (string PasswordHash, string SaltHash) GetUserPasswordHash(string userName)
public static int RegisterNewUser(string userName, string email, string passwordHash, string saltHash, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress, string connectionString)
{
var userId = GetUserId(userName);
using var connection = new SqlConnection(connectionString);
using(var connection = new SqlConnection(ConnectionString))
{
using(var command = new SqlCommand("SELECT [Password Hash], [Salt] FROM Login WHERE [User Key] = @UserId", connection))
{
command.Parameters.AddWithValue("UserId", userId);
using var command = new SqlCommand("RegisterNewUser", connection) { CommandType = CommandType.StoredProcedure };
connection.Open();
command.Parameters.AddWithValue("UserName", userName);
command.Parameters.AddWithValue("Email", email);
command.Parameters.AddWithValue("Password", passwordHash);
command.Parameters.AddWithValue("Salt", saltHash);
command.Parameters.AddWithValue("SessionToken", sessionToken);
command.Parameters.AddWithValue("ExpirationDate", expirationDate);
command.Parameters.AddWithValue("UserAgent", userAgent);
command.Parameters.AddWithValue("IpAddress", ipAddress);
var reader = command.ExecuteReader();
connection.Open();
reader.Read();
var result = command.ExecuteScalar();
return (reader["Password Hash"].ToString(), reader["Salt"].ToString());
}
}
return Convert.ToInt32(result);
}
public static bool UserHasLoginData(string userName)
{
var userId = GetUserId(userName);
using (var connection = new SqlConnection(ConnectionString))
{
using (var command = new SqlCommand("SELECT [Password Hash], [Salt Hash] FROM Login WHERE [User Key] = @UserId", connection))
{
command.Parameters.AddWithValue("UserId", userId);
connection.Open();
var reader = command.ExecuteReader();
return reader.HasRows;
}
}
}
public static int GetUserId(string userName)
{
using (var connection = new SqlConnection(ConnectionString))
{
using (var command = new SqlCommand("SELECT [User ID] FROM [User] WHERE Name = @UserName", connection))
{
command.Parameters.AddWithValue("UserName", userName);
connection.Open();
return Convert.ToInt32(command.ExecuteScalar());
}
}
}
public static void WriteUserPasswordAndSalt(string password, string salt, int userId)
{
using (var connection = new SqlConnection(ConnectionString))
{
using (var command = new SqlCommand("INSERT INTO [Login]([Password Hash], [Salt Hash], [User Key]) VALUES (@PasswordHash, @SaltHash, @UserKey)", connection))
{
command.Parameters.AddWithValue("PasswordHash", password);
command.Parameters.AddWithValue("SaltHash", salt);
command.Parameters.AddWithValue("UserKey", userId);
connection.Open();
command.ExecuteNonQuery();
}
}
}
public static void SetUserSessionToken(string userName, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress, bool isResetToken = false)
{
using (var connection = new SqlConnection(ConnectionString))
{
using (var command = new SqlCommand("InsertSessionToken", connection) { CommandType = CommandType.StoredProcedure })
{
command.Parameters.AddWithValue("SessionToken", sessionToken);
command.Parameters.AddWithValue("ExpirationDate", expirationDate);
command.Parameters.AddWithValue("UserName", userName);
command.Parameters.AddWithValue("UserAgent", userAgent);
command.Parameters.AddWithValue("IpAddress", ipAddress);
command.Parameters.AddWithValue("PendingReset", isResetToken);
connection.Open();
command.ExecuteNonQuery();
}
}
}
public static int RegisterNewUser(string userName, string email, string passwordHash, string saltHash, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress)
{
using (var connection = new SqlConnection(ConnectionString))
{
using (var command = new SqlCommand("RegisterNewUser", connection) { CommandType = CommandType.StoredProcedure })
{
command.Parameters.AddWithValue("UserName", userName);
command.Parameters.AddWithValue("Email", email);
command.Parameters.AddWithValue("Password", passwordHash);
command.Parameters.AddWithValue("Salt", saltHash);
command.Parameters.AddWithValue("SessionToken", sessionToken);
command.Parameters.AddWithValue("ExpirationDate", expirationDate);
command.Parameters.AddWithValue("UserAgent", userAgent);
command.Parameters.AddWithValue("IpAddress", ipAddress);
connection.Open();
var result = command.ExecuteScalar();
return Convert.ToInt32(result);
}
}
}
public static bool IsSessionTokenValid(string sessionToken)//, string userName)
{
using (var connection = new SqlConnection(ConnectionString))
{
using (var command = new SqlCommand("ValidateSessionToken", connection) { CommandType = CommandType.StoredProcedure })
{
command.Parameters.AddWithValue("SessionToken", sessionToken);
connection.Open();
var result = command.ExecuteScalar();
return Convert.ToBoolean(result);
}
}
}
public static void DestroySession(string sessionToken)
{
using (var connection = new SqlConnection(ConnectionString))
{
using (var command = new SqlCommand("DestroySession", connection) { CommandType = CommandType.StoredProcedure })
{
command.Parameters.AddWithValue("SessionToken", sessionToken);
connection.Open();
command.ExecuteNonQuery();
}
}
}
public static bool IsResetTokenValid(string token)
{
using (var connection = new SqlConnection(ConnectionString))
{
using (var command = new SqlCommand("ValidateResetToken", connection) { CommandType = CommandType.StoredProcedure })
{
command.Parameters.AddWithValue("SessionToken", token);
connection.Open();
var reader = command.ExecuteScalar();
return Convert.ToBoolean(reader);
}
}
}
//public static void ResetPassword(string email)
//{
// using (var connection = new SqlConnection(ConnectionString))
// {
// using (var command = new SqlCommand("DestroySession", connection) { CommandType = CommandType.StoredProcedure })
// {
// command.Parameters.AddWithValue("SessionToken", sessionToken);
// connection.Open();
// command.ExecuteNonQuery();
// }
// }
//}
}
}