TokenFactory.cs

Go to the documentation of this file.

using System;
using System.Globalization;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Threading;
using System.Threading.Tasks;
 
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
 
using Tgstation.Server.Api.Models.Response;
using Tgstation.Server.Host.Configuration;
using Tgstation.Server.Host.System;
using Tgstation.Server.Host.Utils;
 
namespace Tgstation.Server.Host.Security
{
    sealed class TokenFactory : ITokenFactory
    {
        public TokenValidationParameters ValidationParameters { get; }
 
        readonly SecurityConfiguration securityConfiguration;
 
        readonly IAsyncDelayer asyncDelayer;
 
        public TokenFactory(
            IAsyncDelayer asyncDelayer,
            ICryptographySuite cryptographySuite,
            IAssemblyInformationProvider assemblyInformationProvider,
            IOptions<SecurityConfiguration> securityConfigurationOptions)
        {
            this.asyncDelayer = asyncDelayer ?? throw new ArgumentNullException(nameof(asyncDelayer));
 
            ArgumentNullException.ThrowIfNull(cryptographySuite);
            ArgumentNullException.ThrowIfNull(assemblyInformationProvider);
 
            securityConfiguration = securityConfigurationOptions?.Value ?? throw new ArgumentNullException(nameof(securityConfigurationOptions));
 
            var signingKeyBytes = String.IsNullOrWhiteSpace(securityConfiguration.CustomTokenSigningKeyBase64)
                ? cryptographySuite.GetSecureBytes(securityConfiguration.TokenSigningKeyByteCount)
                : Convert.FromBase64String(securityConfiguration.CustomTokenSigningKeyBase64);
 
            ValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(signingKeyBytes),
 
                ValidateIssuer = true,
                ValidIssuer = assemblyInformationProvider.AssemblyName.Name,
 
                ValidateLifetime = true,
                ValidateAudience = true,
                ValidAudience = typeof(TokenResponse).Assembly.GetName().Name,
 
                ClockSkew = TimeSpan.FromMinutes(securityConfiguration.TokenClockSkewMinutes),
 
                RequireSignedTokens = true,
 
                RequireExpirationTime = true,
            };
        }
 
        public async Task<TokenResponse> CreateToken(Models.User user, bool oAuth, CancellationToken cancellationToken)
        {
            ArgumentNullException.ThrowIfNull(user);
 
            var now = DateTimeOffset.UtcNow;
            var nowUnix = now.ToUnixTimeSeconds();
 
            // this prevents validation conflicts down the line
            // tldr we can (theoretically) send a token the same second we receive it
            // since unix time rounds down, it looks like it came from before the user changed their password
            // this happens occasionally in unit tests
            // just delay a second so we can force a round up
            var lpuUnix = user.LastPasswordUpdate?.ToUnixTimeSeconds();
            if (nowUnix == lpuUnix)
                await asyncDelayer.Delay(TimeSpan.FromSeconds(1), cancellationToken);
 
            var expiry = now.AddMinutes(oAuth
                ? securityConfiguration.OAuthTokenExpiryMinutes
                : securityConfiguration.TokenExpiryMinutes);
            var claims = new Claim[]
            {
                new Claim(JwtRegisteredClaimNames.Sub, user.Id.Value.ToString(CultureInfo.InvariantCulture)),
                new Claim(JwtRegisteredClaimNames.Exp, expiry.ToUnixTimeSeconds().ToString(CultureInfo.InvariantCulture)),
                new Claim(JwtRegisteredClaimNames.Nbf, nowUnix.ToString(CultureInfo.InvariantCulture)),
                new Claim(JwtRegisteredClaimNames.Iss, ValidationParameters.ValidIssuer),
                new Claim(JwtRegisteredClaimNames.Aud, ValidationParameters.ValidAudience),
            };
 
            var token = new JwtSecurityToken(new JwtHeader(new SigningCredentials(ValidationParameters.IssuerSigningKey, SecurityAlgorithms.HmacSha256)), new JwtPayload(claims));
            return new TokenResponse
            {
                Bearer = new JwtSecurityTokenHandler().WriteToken(token),
                ExpiresAt = expiry,
            };
        }
    }
}