secure-core/SecureCore/Services/UserDataService.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using System.Data;
using System.Transactions;
using System.Data.SqlClient;

namespace SecureCore.Services
{
    public static class UserDataService
    {
        private static string ConnectionString = @"Server=DESKTOP-OEDDVKC\SQLEXPRESS;Database=main;Integrated Security=true;";

        public static (string PasswordHash, string SaltHash) GetUserPasswordHash(string userName)
        {
            var userId = GetUserId(userName);

            using(var connection = new SqlConnection(ConnectionString))
            {
                using(var command = new SqlCommand("SELECT [Password Hash], [Salt Hash] FROM Login WHERE [User Key] = @UserId", connection))
                {
                    command.Parameters.AddWithValue("UserId", userId);

                    connection.Open();

                    var reader = command.ExecuteReader();

                    reader.Read();

                    return (reader["Password Hash"].ToString(), reader["Salt Hash"].ToString());
                }
            }
        }

        public static bool UserHasLoginData(string userName)
        {
            var userId = GetUserId(userName);

            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("SELECT [Password Hash], [Salt Hash] FROM Login WHERE [User Key] = @UserId", connection))
                {
                    command.Parameters.AddWithValue("UserId", userId);

                    connection.Open();

                    var reader = command.ExecuteReader();

                    return reader.HasRows;
                }
            }
        }

        public static int GetUserId(string userName)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("SELECT [User ID] FROM [User] WHERE Name = @UserName", connection))
                {
                    command.Parameters.AddWithValue("UserName", userName);

                    connection.Open();

                    return Convert.ToInt32(command.ExecuteScalar());
                }
            }
        }

        public static void WriteUserPasswordAndSalt(string password, string salt, int userId)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("INSERT INTO [Login]([Password Hash], [Salt Hash], [User Key]) VALUES (@PasswordHash, @SaltHash, @UserKey)", connection))
                {
                    command.Parameters.AddWithValue("PasswordHash", password);
                    command.Parameters.AddWithValue("SaltHash", salt);
                    command.Parameters.AddWithValue("UserKey", userId);

                    connection.Open();

                    command.ExecuteNonQuery();
                }
            }
        }

        public static void SetUserSessionToken(int userId, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("INSERT INTO [Session]([Session Token], [Expiration Date], [User ID], [User Agent], [IP Address]) VALUES (@SessionToken, @ExpirationDate, @UserKey, @UserAgent, @IpAddress)", connection))
                {
                    command.Parameters.AddWithValue("SessionToken", sessionToken);
                    command.Parameters.AddWithValue("ExpirationDate", expirationDate);
                    command.Parameters.AddWithValue("UserKey", userId);
                    command.Parameters.AddWithValue("UserAgent", userAgent);
                    command.Parameters.AddWithValue("IpAddress", ipAddress);

                    connection.Open();

                    command.ExecuteNonQuery();
                }
            }
        }

        public static int RegisterNewUser(string userName, string email, string passwordHash, string saltHash, string sessionToken, DateTime expirationDate, string userAgent, string ipAddress)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("RegisterNewUser", connection) { CommandType = CommandType.StoredProcedure })
                {
                    command.Parameters.AddWithValue("UserName", userName);
                    command.Parameters.AddWithValue("Email", email);
                    command.Parameters.AddWithValue("Password", passwordHash);
                    command.Parameters.AddWithValue("Salt", saltHash);
                    command.Parameters.AddWithValue("SessionToken", sessionToken);
                    command.Parameters.AddWithValue("ExpirationDate", expirationDate);
                    command.Parameters.AddWithValue("UserAgent", userAgent);
                    command.Parameters.AddWithValue("IpAddress", ipAddress);

                    connection.Open();

                    var result = command.ExecuteScalar();

                    return Convert.ToInt32(result);
                }
            }
        }

        public static bool IsSessionTokenValid(string sessionToken)//, string userName)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("SELECT 1 AS Valid WHERE EXISTS(SELECT 1 FROM Session WHERE [Session Token] = @SessionToken)", connection))// AND[User ID] = @UserId)", connection))
                {
                    command.Parameters.AddWithValue("SessionToken", sessionToken);
                    //command.Parameters.AddWithValue("UserId", GetUserId(userName));

                    connection.Open();

                    var result = command.ExecuteScalar();

                    return Convert.ToBoolean(result);
                }
            }
        }

        public static void DestorySession(string sessionToken)
        {
            using (var connection = new SqlConnection(ConnectionString))
            {
                using (var command = new SqlCommand("DELETE FROM [Session] WHERE [Session Token] = @SessionToken", connection))
                {
                    command.Parameters.AddWithValue("SessionToken", sessionToken);

                    connection.Open();

                    command.ExecuteNonQuery();
                }
            }
        }
    }
}