v0.6 prerelease commit with some minor fixes

Signed-off-by: Dmitri Shimanski <yawaflua@perseverance.yawaflua.tech>

backend/SpMega.Backend/Services/TokenService.cs

@@ -1,3 +1,4 @@
+using System.Globalization;
 using System.IdentityModel.Tokens.Jwt;
 using System.Security.Claims;
 using System.Text;
@@ -5,36 +6,120 @@ using Microsoft.IdentityModel.Tokens;
 
 namespace SpMega.Backend.Services;
 
+public sealed record ValidatedAccessToken(
+    Guid UserId,
+    string UserName,
+    DateTimeOffset AuthenticatedAt,
+    DateTimeOffset ExpiresAt);
+
 public class TokenService(IConfiguration conf)
 {
-    private const int AccessTokenExpirationMinutes = 24;
+    public const string HttpContextItemKey = "ValidatedAccessToken";
+    public static readonly TimeSpan AccessTokenLifetime = TimeSpan.FromHours(24);
+    public static readonly TimeSpan MaximumAuthenticationAge = TimeSpan.FromDays(2);
+    public static readonly TimeSpan RefreshThreshold = TimeSpan.FromHours(1);
+
+    private static readonly TimeSpan ClockSkew = TimeSpan.FromMinutes(1);
     private readonly string _issuer = conf["JWT:Issuer"] ?? conf["JWT__Issuer"] ?? "spmega.il.yawaflua.tech";
     private readonly string _secret = conf["JWT:Secret"] ?? conf["JWT__Secret"] ?? throw new InvalidOperationException("JWT__Secret is not configured.");
 
     public string GenerateAccessToken(string userName, Guid uuid)
     {
+        return GenerateAccessToken(userName, uuid, DateTimeOffset.UtcNow);
+    }
+
+    public string GenerateAccessToken(string userName, Guid uuid, DateTimeOffset authenticatedAt)
+    {
+        var now = DateTimeOffset.UtcNow;
+        var maximumExpiration = authenticatedAt.Add(MaximumAuthenticationAge);
+        var expiration = now.Add(AccessTokenLifetime);
+        if (expiration > maximumExpiration)
+        {
+            expiration = maximumExpiration;
+        }
+
+        if (expiration <= now)
+        {
+            throw new SecurityTokenExpiredException("The original authentication is older than two days.");
+        }
+
         var claims = new List<Claim>
         {
             new(JwtRegisteredClaimNames.Name, userName),
-            new (JwtRegisteredClaimNames.UniqueName, uuid.ToString()),
-            new(JwtRegisteredClaimNames.AuthTime, DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString()),
+            new(JwtRegisteredClaimNames.UniqueName, uuid.ToString()),
+            new(JwtRegisteredClaimNames.AuthTime, authenticatedAt.ToUnixTimeSeconds().ToString(CultureInfo.InvariantCulture)),
             new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
         };
 
-        var tokenHandler = new JwtSecurityTokenHandler();
-        var key = Encoding.ASCII.GetBytes(_secret);
-
+        var tokenHandler = new JwtSecurityTokenHandler { MapInboundClaims = false };
         var tokenDescriptor = new SecurityTokenDescriptor
         {
             Subject = new ClaimsIdentity(claims),
-            Expires = DateTime.UtcNow.AddHours(AccessTokenExpirationMinutes),
+            Expires = expiration.UtcDateTime,
             Issuer = _issuer,
-            SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature),
-            IssuedAt = DateTime.UtcNow
+            SigningCredentials = new SigningCredentials(
+                new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_secret)),
+                SecurityAlgorithms.HmacSha256),
+            IssuedAt = now.UtcDateTime
         };
 
-        var token = tokenHandler.CreateToken(tokenDescriptor);
-
-        return tokenHandler.WriteToken(token);
+        return tokenHandler.WriteToken(tokenHandler.CreateToken(tokenDescriptor));
     }
-}
+
+    public ValidatedAccessToken ValidateAccessToken(string token)
+    {
+        var tokenHandler = new JwtSecurityTokenHandler { MapInboundClaims = false };
+        var principal = tokenHandler.ValidateToken(token, new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = _issuer,
+            ValidateAudience = false,
+            ValidateIssuerSigningKey = true,
+            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_secret)),
+            ValidateLifetime = true,
+            RequireExpirationTime = true,
+            RequireSignedTokens = true,
+            ClockSkew = ClockSkew,
+            ValidAlgorithms = [SecurityAlgorithms.HmacSha256]
+        }, out var validatedToken);
+
+        if (validatedToken is not JwtSecurityToken jwtToken ||
+            !string.Equals(jwtToken.Header.Alg, SecurityAlgorithms.HmacSha256, StringComparison.Ordinal))
+        {
+            throw new SecurityTokenValidationException("Unsupported JWT signing algorithm.");
+        }
+
+        var userName = principal.FindFirst(JwtRegisteredClaimNames.Name)?.Value;
+        var uniqueName = principal.FindFirst(JwtRegisteredClaimNames.UniqueName)?.Value;
+        var authTimeValue = principal.FindFirst(JwtRegisteredClaimNames.AuthTime)?.Value;
+        var expirationValue = principal.FindFirst(JwtRegisteredClaimNames.Exp)?.Value;
+
+        if (string.IsNullOrWhiteSpace(userName) ||
+            !Guid.TryParse(uniqueName, out var userId) ||
+            !long.TryParse(authTimeValue, NumberStyles.None, CultureInfo.InvariantCulture, out var authTimeSeconds) ||
+            !long.TryParse(expirationValue, NumberStyles.None, CultureInfo.InvariantCulture, out var expirationSeconds))
+        {
+            throw new SecurityTokenValidationException("Required JWT claims are missing or invalid.");
+        }
+
+        DateTimeOffset authenticatedAt;
+        DateTimeOffset expiresAt;
+        try
+        {
+            authenticatedAt = DateTimeOffset.FromUnixTimeSeconds(authTimeSeconds);
+            expiresAt = DateTimeOffset.FromUnixTimeSeconds(expirationSeconds);
+        }
+        catch (ArgumentOutOfRangeException exception)
+        {
+            throw new SecurityTokenValidationException("JWT timestamps are invalid.", exception);
+        }
+
+        var now = DateTimeOffset.UtcNow;
+        if (authenticatedAt > now.Add(ClockSkew) || now - authenticatedAt > MaximumAuthenticationAge)
+        {
+            throw new SecurityTokenExpiredException("Reauthentication is required.");
+        }
+
+        return new ValidatedAccessToken(userId, userName, authenticatedAt, expiresAt);
+    }
+}