secure-core/SecureCore/Services/UserDataService.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using System.Data;
using System.Transactions;
using System.Data.SqlClient;

namespace SecureCore.Services
{
    public static class UserDataService
    {
        //
        public static int UserNameMaxLength { get; } = 64;

        private static string ConnectionString = @"Server=DESKTOP-OEDDVKC\SQLEXPRESS;Database=main;Integrated Security=true;";

        public static (bool IsValid, string Message) UserNameIsValid(string userName)
        {
            if (userName.Length > UserNameMaxLength) return (false, $"Username to long, must not exceed {UserNameMaxLength} characters.");

            var invalidChars = new List<char>();

            foreach(var c in userName)
            {
                if (char.IsPunctuation(c) || char.IsSymbol(c) || char.IsControl(c) || char.IsSeparator(c) || char.IsWhiteSpace(c)) invalidChars.Add(c);//return (false, $"The character '{c}' is not allowed.");
            }

            if (invalidChars.Count > 0) return (false, $"The characters '{string.Join(",", invalidChars)}' are not allowed in a user name.");

            return (true, string.Empty);
        }

        public static (string PasswordHash, string SaltHash) GetUserPasswordHash(string userName)
        {
            var userId = GetUserId(userName);

            using(var connection = new SqlConnection(ConnectionString))
            {
                using(var command = new SqlCommand("SELECT [Password Hash], [Salt] FROM Login WHERE [User Key] = @UserId", connection))
                {
                    command.Parameters.AddWithValue("UserId", userId);

                    connection.Open();

                    var reader = command.ExecuteReader();

                    reader.Read();

                    return (reader["Password Hash"].ToString(), reader["Salt"].ToString());
                }
            }
        }

        public static bool UserHasLoginData(string userName)
        {
            var userId = GetUserId(userName);

            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("SELECT [Password Hash], [Salt Hash] FROM Login WHERE [User Key] = @UserId", connection))
                {
                    command.Parameters.AddWithValue("UserId", userId);

                    connection.Open();

                    var reader = command.ExecuteReader();

                    return reader.HasRows;
                }
            }
        }

        public static int GetUserId(string userName)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("SELECT [User ID] FROM [User] WHERE Name = @UserName", connection))
                {
                    command.Parameters.AddWithValue("UserName", userName);

                    connection.Open();

                    return Convert.ToInt32(command.ExecuteScalar());
                }
            }
        }

        public static void WriteUserPasswordAndSalt(string password, string salt, int userId)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("INSERT INTO [Login]([Password Hash], [Salt Hash], [User Key]) VALUES (@PasswordHash, @SaltHash, @UserKey)", connection))
                {
                    command.Parameters.AddWithValue("PasswordHash", password);
                    command.Parameters.AddWithValue("SaltHash", salt);
                    command.Parameters.AddWithValue("UserKey", userId);

                    connection.Open();

                    command.ExecuteNonQuery();
                }
            }
        }

        public static void SetUserSessionToken(string userName, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress, bool isResetToken = false)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("InsertSessionToken", connection) { CommandType = CommandType.StoredProcedure })
                {
                    command.Parameters.AddWithValue("SessionToken", sessionToken);
                    command.Parameters.AddWithValue("ExpirationDate", expirationDate);
                    command.Parameters.AddWithValue("UserName", userName);
                    command.Parameters.AddWithValue("UserAgent", userAgent);
                    command.Parameters.AddWithValue("IpAddress", ipAddress);
                    command.Parameters.AddWithValue("PendingReset", isResetToken);

                    connection.Open();

                    command.ExecuteNonQuery();
                }
            }
        }

        public static int RegisterNewUser(string userName, string email, string passwordHash, string saltHash, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("RegisterNewUser", connection) { CommandType = CommandType.StoredProcedure })
                {
                    command.Parameters.AddWithValue("UserName", userName);
                    command.Parameters.AddWithValue("Email", email);
                    command.Parameters.AddWithValue("Password", passwordHash);
                    command.Parameters.AddWithValue("Salt", saltHash);
                    command.Parameters.AddWithValue("SessionToken", sessionToken);
                    command.Parameters.AddWithValue("ExpirationDate", expirationDate);
                    command.Parameters.AddWithValue("UserAgent", userAgent);
                    command.Parameters.AddWithValue("IpAddress", ipAddress);

                    connection.Open();

                    var result = command.ExecuteScalar();

                    return Convert.ToInt32(result);
                }
            }
        }

        public static bool IsSessionTokenValid(string sessionToken)//, string userName)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("ValidateSessionToken", connection) { CommandType = CommandType.StoredProcedure })
                {
                    command.Parameters.AddWithValue("SessionToken", sessionToken);

                    connection.Open();

                    var result = command.ExecuteScalar();

                    return Convert.ToBoolean(result);
                }
            }
        }

        public static void DestroySession(string sessionToken)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("DestroySession", connection) { CommandType = CommandType.StoredProcedure })
                {
                    command.Parameters.AddWithValue("SessionToken", sessionToken);

                    connection.Open();

                    command.ExecuteNonQuery();
                }
            }
        }

        public static bool IsResetTokenValid(string token)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("ValidateResetToken", connection) { CommandType = CommandType.StoredProcedure })
                {
                    command.Parameters.AddWithValue("SessionToken", token);

                    connection.Open();

                    var reader = command.ExecuteScalar();

                    return Convert.ToBoolean(reader);
                }
            }
        }

        //public static void ResetPassword(string email)
        //{
        //    using (var connection = new SqlConnection(ConnectionString))
        //    {
        //        using (var command = new SqlCommand("DestroySession", connection) { CommandType = CommandType.StoredProcedure })
        //        {
        //            command.Parameters.AddWithValue("SessionToken", sessionToken);

        //            connection.Open();

        //            command.ExecuteNonQuery();
        //        }
        //    }
        //}
    }
}