secure-core/SecureCore/Services/UserDataService.cs

using System;
using System.Collections.Generic;
using System.Data;
using System.Data.SqlClient;

namespace SecureCore.Services
{
    public static class UserDataService
    {
        public static int UserNameMaxLength { get; } = 64;
        public static int UserNameMinLength { get; } = 3;
        public static int EmailMaxLength { get; } = 512;

        public static (bool IsValid, string Message) IsUsernameValid(string userName)
        {
            if (string.IsNullOrEmpty(userName) || userName.Length < UserNameMinLength) return (false, $"Username is too short, the user name must be at least {UserNameMinLength} characters long.");
            if (userName.Length > UserNameMaxLength) return (false, $"Username too long, must not exceed {UserNameMaxLength} characters.");

            var invalidChars = new List<char>();

            foreach(var c in userName)
                if (char.IsPunctuation(c) || char.IsSymbol(c) || char.IsControl(c) || char.IsSeparator(c) || char.IsWhiteSpace(c)) invalidChars.Add(c);

            if (invalidChars.Count > 0) return (false, $"The character(s) '{string.Join(",", invalidChars)}' are not allowed in a user name.");

            return (true, string.Empty);
        }

        public static int RegisterNewUser(string userName, string email, string passwordHash, string saltHash, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress, string connectionString)
        {
            using var connection = new SqlConnection(connectionString);
            using var command = new SqlCommand("RegisterNewUser", connection) { CommandType = CommandType.StoredProcedure };

            command.Parameters.AddWithValue("UserName", userName);
            command.Parameters.AddWithValue("Email", email);
            command.Parameters.AddWithValue("Password", passwordHash);
            command.Parameters.AddWithValue("Salt", saltHash);
            command.Parameters.AddWithValue("SessionToken", sessionToken);
            command.Parameters.AddWithValue("ExpirationDate", expirationDate);
            command.Parameters.AddWithValue("UserAgent", userAgent);
            command.Parameters.AddWithValue("IpAddress", ipAddress);

            connection.Open();

            var result = command.ExecuteScalar();

            return Convert.ToInt32(result);
        }

        public static bool IsEmailInUse(string email, string connectionString)
        {
            using var connection = new SqlConnection(connectionString);
            using var command = new SqlCommand("SELECT dbo.EmailInUse(@Email) AS InUse", connection);

            command.Parameters.AddWithValue("Email", email);

            connection.Open();

            return Convert.ToBoolean(command.ExecuteScalar());
        }

        public static (bool IsValid, string Message) IsEmailValid(string email)
        {
            if (string.IsNullOrEmpty(email)) return (false, "The provided email is not in the correct format.");
            if (email.Length > EmailMaxLength) return (false, $"Email exceeds the maximum length of {EmailMaxLength} characters.");

            //Code taken from user "Cogwheel" on StackOverflow: https://stackoverflow.com/questions/1365407/c-sharp-code-to-validate-email-address
            try
            {
                var addr = new System.Net.Mail.MailAddress(email);

                if (addr.Address != email) return (false, $"The provided email is not in the correct format.");

                return (true, string.Empty);
            }
            catch
            {
                return (false, $"The provided email is not in the correct format.");
            }
        }
    }
}