949 lines
47 KiB
C#
949 lines
47 KiB
C#
using Marco.Pms.DataAccess.Data;
|
|
using Marco.Pms.Model.Authentication;
|
|
using Marco.Pms.Model.Dtos.Authentication;
|
|
using Marco.Pms.Model.Dtos.Util;
|
|
using Marco.Pms.Model.Employees;
|
|
using Marco.Pms.Model.Entitlements;
|
|
using Marco.Pms.Model.Utilities;
|
|
using Marco.Pms.Services.Service.ServiceInterfaces;
|
|
using MarcoBMS.Services.Helpers;
|
|
using MarcoBMS.Services.Service;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Identity;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using System.Net;
|
|
using System.Security.Claims;
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
|
|
namespace MarcoBMS.Services.Controllers
|
|
{
|
|
[ApiController]
|
|
[Route("api/[controller]")]
|
|
public class AuthController : ControllerBase
|
|
{
|
|
private readonly UserManager<ApplicationUser> _userManager;
|
|
private readonly UserHelper _userHelper;
|
|
private readonly ApplicationDbContext _context;
|
|
private readonly JwtSettings _jwtSettings;
|
|
private readonly RefreshTokenService _refreshTokenService;
|
|
private readonly IEmailSender _emailSender;
|
|
private readonly IConfiguration _configuration;
|
|
private readonly EmployeeHelper _employeeHelper;
|
|
private readonly ILoggingService _logger;
|
|
private readonly IFirebaseService _firebase;
|
|
//string tenentId = "1";
|
|
public AuthController(UserManager<ApplicationUser> userManager, ApplicationDbContext context, JwtSettings jwtSettings, RefreshTokenService refreshTokenService,
|
|
IEmailSender emailSender, IConfiguration configuration, EmployeeHelper employeeHelper, UserHelper userHelper, ILoggingService logger, IFirebaseService firebase)
|
|
{
|
|
_userManager = userManager;
|
|
_jwtSettings = jwtSettings;
|
|
_refreshTokenService = refreshTokenService;
|
|
_emailSender = emailSender;
|
|
_configuration = configuration;
|
|
_employeeHelper = employeeHelper;
|
|
_context = context;
|
|
_userHelper = userHelper;
|
|
_logger = logger;
|
|
_firebase = firebase;
|
|
}
|
|
|
|
[HttpPost("login")]
|
|
public async Task<IActionResult> Login([FromBody] LoginDto loginDto)
|
|
{
|
|
try
|
|
{
|
|
|
|
var user = await _context.ApplicationUsers
|
|
.FirstOrDefaultAsync(u => u.Email == loginDto.Username || u.PhoneNumber == loginDto.Username);
|
|
|
|
if (user == null)
|
|
{
|
|
_logger.LogWarning("Login failed: User not found for input {Username}", loginDto.Username ?? string.Empty);
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid username or password.", "Invalid username or password.", 401));
|
|
}
|
|
|
|
// Check if the user is active
|
|
if (!user.IsActive)
|
|
{
|
|
_logger.LogWarning("Login failed: Inactive user attempted login - UserId: {UserId}", user.Id);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("User is inactive", "User is inactive", 400));
|
|
}
|
|
|
|
// Ensure the user's email is confirmed
|
|
if (!user.EmailConfirmed)
|
|
{
|
|
_logger.LogWarning("Login failed: Email not confirmed for UserId: {UserId}", user.Id);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Email not verified", "Your email is not verified, please verify your email", 400));
|
|
}
|
|
|
|
// Validate the password
|
|
if (!await _userManager.CheckPasswordAsync(user, loginDto.Password ?? string.Empty))
|
|
{
|
|
_logger.LogWarning("Login failed: Incorrect password for UserId: {UserId}", user.Id);
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid username or password.", "Invalid username or password.", 401));
|
|
}
|
|
|
|
// Retrieve employee details
|
|
var emp = await _employeeHelper.GetEmployeeByApplicationUserID(user.Id);
|
|
if (emp == null)
|
|
{
|
|
_logger.LogWarning("Login failed: No employee record found for UserId: {UserId}", user.Id);
|
|
return NotFound(ApiResponse<object>.ErrorResponse("Employee record not found", "Employee not found", 404));
|
|
}
|
|
|
|
// Ensure UserName exists for JWT
|
|
if (string.IsNullOrWhiteSpace(user.UserName))
|
|
{
|
|
_logger.LogWarning("Login failed: Username not found for UserId: {UserId}", user.Id);
|
|
return NotFound(ApiResponse<object>.ErrorResponse("Username not found", "Username not found", 404));
|
|
}
|
|
|
|
// Generate tokens
|
|
var token = _refreshTokenService.GenerateJwtToken(user.UserName, emp.TenantId, _jwtSettings);
|
|
var refreshToken = await _refreshTokenService.CreateRefreshToken(user.Id, emp.TenantId.ToString(), _jwtSettings);
|
|
|
|
_logger.LogInfo("User login successful - UserId: {UserId}", user.Id);
|
|
return Ok(ApiResponse<object>.SuccessResponse(new
|
|
{
|
|
token,
|
|
refreshToken
|
|
}, "User logged in successfully.", 200));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "Unexpected error during login");
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("Unexpected error", ex.Message, 500));
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Handles mobile user login, validates credentials, sends a test push notification,
|
|
/// and generates JWT, Refresh, and MPIN tokens upon successful authentication.
|
|
/// </summary>
|
|
/// <param name="loginDto">Data Transfer Object containing the user's login credentials and device token.</param>
|
|
/// <returns>An IActionResult containing the authentication tokens or an error response.</returns>
|
|
|
|
[HttpPost("login-mobile")]
|
|
public async Task<IActionResult> LoginMobile([FromBody] LoginDto loginDto)
|
|
{
|
|
// Log the start of the login attempt for traceability.
|
|
_logger.LogInfo("Login attempt initiated for user: {Username}", loginDto.Username ?? "N/A");
|
|
|
|
try
|
|
{
|
|
// --- Input Validation ---
|
|
// Ensure that the request body and essential fields are not null or empty.
|
|
if (loginDto == null || string.IsNullOrWhiteSpace(loginDto.Username) || string.IsNullOrWhiteSpace(loginDto.Password))
|
|
{
|
|
_logger.LogWarning("Login failed due to missing username or password.");
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Username or password is missing.", "Invalid request", 400));
|
|
}
|
|
|
|
// --- User Retrieval ---
|
|
// Find the user in the database by their email or phone number.
|
|
_logger.LogInfo("Searching for user: {Username}", loginDto.Username);
|
|
var user = await _context.ApplicationUsers
|
|
.FirstOrDefaultAsync(u => u.Email == loginDto.Username || u.PhoneNumber == loginDto.Username);
|
|
|
|
// If no user is found, return an unauthorized response.
|
|
if (user == null || string.IsNullOrWhiteSpace(user.UserName))
|
|
{
|
|
_logger.LogWarning("Login failed: User not found for username {Username}", loginDto.Username);
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid username or password.", "Invalid username or password.", 401));
|
|
}
|
|
|
|
// --- User Status Checks ---
|
|
// Check if the user's account is marked as inactive.
|
|
if (!user.IsActive)
|
|
{
|
|
_logger.LogWarning("Login failed: User '{Username}' account is inactive.", user.UserName);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("User is inactive", "User is inactive", 400));
|
|
}
|
|
|
|
// Check if the user has confirmed their email address.
|
|
if (!user.EmailConfirmed)
|
|
{
|
|
_logger.LogWarning("Login failed: User '{Username}' email is not verified.", user.UserName);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Your email is not verified. Please verify your email.", "Email not verified", 400));
|
|
}
|
|
|
|
// --- Password Validation ---
|
|
// Use ASP.NET Identity's UserManager to securely check the password.
|
|
_logger.LogInfo("Validating password for user: {Username}", user.UserName);
|
|
var isPasswordValid = await _userManager.CheckPasswordAsync(user, loginDto.Password);
|
|
if (!isPasswordValid)
|
|
{
|
|
_logger.LogWarning("Login failed: Invalid password for user {Username}", user.UserName);
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid username or password.", "Invalid credentials", 401));
|
|
}
|
|
_logger.LogInfo("Password validation successful for user: {Username}", user.UserName);
|
|
|
|
// Check if the username property on the user object is populated.
|
|
if (string.IsNullOrWhiteSpace(user.UserName))
|
|
{
|
|
// This is an unlikely edge case, but good to handle.
|
|
_logger.LogWarning("Login failed: User object for ID {UserId} is missing a UserName.", user.Id);
|
|
return NotFound(ApiResponse<object>.ErrorResponse("UserName not found", "Username is missing", 404));
|
|
}
|
|
|
|
// --- Employee and Tenant Context Retrieval ---
|
|
// Fetch associated employee details to get tenant context for token generation.
|
|
_logger.LogInfo("Fetching employee details for user ID: {UserId}", user.Id);
|
|
var emp = await _employeeHelper.GetEmployeeByApplicationUserID(user.Id);
|
|
if (emp == null)
|
|
{
|
|
_logger.LogWarning("Login failed: Could not find associated employee record for user ID {UserId}", user.Id);
|
|
return NotFound(ApiResponse<object>.ErrorResponse("Employee not found", "Employee details missing", 404));
|
|
}
|
|
_logger.LogInfo("Successfully found employee details for tenant ID: {TenantId}", emp.TenantId);
|
|
|
|
// --- Token Generation ---
|
|
// Generate the primary JWT access token.
|
|
_logger.LogInfo("Generating JWT for user: {Username}", user.UserName);
|
|
var token = _refreshTokenService.GenerateJwtToken(user.UserName, emp.TenantId, _jwtSettings);
|
|
|
|
// Generate a new refresh token and store it in the database.
|
|
_logger.LogInfo("Generating and storing Refresh Token for user: {Username}", user.UserName);
|
|
var refreshToken = await _refreshTokenService.CreateRefreshToken(user.Id, emp.TenantId.ToString(), _jwtSettings);
|
|
|
|
// Fetch the user's MPIN token if it exists.
|
|
_logger.LogInfo("Fetching MPIN token for user: {Username}", user.UserName);
|
|
var mpinToken = await _context.MPINDetails.FirstOrDefaultAsync(p => p.UserId == Guid.Parse(user.Id) && p.TenantId == emp.TenantId);
|
|
|
|
// --- Response Assembly ---
|
|
// Combine all tokens into a single response object.
|
|
var responseData = new
|
|
{
|
|
token,
|
|
refreshToken,
|
|
mpinToken = mpinToken?.MPINToken // Safely access the MPIN token, will be null if not found.
|
|
};
|
|
|
|
// Return a successful response with the generated tokens.
|
|
_logger.LogInfo("User {Username} logged in successfully.", user.UserName);
|
|
|
|
var exsistingFCMMapping = await _context.FCMTokenMappings.FirstOrDefaultAsync(ft => ft.EmployeeId == emp.Id);
|
|
if (exsistingFCMMapping == null)
|
|
{
|
|
var fcmTokenMapping = new FCMTokenMapping
|
|
{
|
|
EmployeeId = emp.Id,
|
|
FcmToken = loginDto.FcmToken,
|
|
TenantId = emp.TenantId
|
|
};
|
|
_context.FCMTokenMappings.Add(fcmTokenMapping);
|
|
_logger.LogInfo("New FCM Token registering for employee {EmployeeId}", emp.Id);
|
|
}
|
|
else
|
|
{
|
|
exsistingFCMMapping.FcmToken = loginDto.FcmToken;
|
|
_logger.LogInfo("Updating FCM Token for employee {EmployeeId}", emp.Id);
|
|
}
|
|
try
|
|
{
|
|
await _context.SaveChangesAsync();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "Exception occured while saving FCM Token for employee {EmployeeId}", emp.Id);
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("Internal Error", ex.Message, 500));
|
|
}
|
|
|
|
_ = Task.Run(async () =>
|
|
{
|
|
// --- Push Notification Section ---
|
|
// This section attempts to send a test push notification to the user's device.
|
|
// It's designed to fail gracefully and handle invalid Firebase Cloud Messaging (FCM) tokens.
|
|
await _firebase.SendMessageToMultipleDevicesAsync();
|
|
|
|
});
|
|
return Ok(ApiResponse<object>.SuccessResponse(responseData, "User logged in successfully.", 200));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
// --- Global Exception Handling ---
|
|
// Catch any unexpected exceptions during the login process.
|
|
_logger.LogError(ex, "An unexpected error occurred during the LoginMobile process for user: {Username}", loginDto?.Username ?? "N/A");
|
|
|
|
// Return a generic 500 Internal Server Error to avoid leaking implementation details.
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("An internal server error occurred.", "Server Error", 500));
|
|
}
|
|
}
|
|
|
|
|
|
[HttpPost("login-mpin")]
|
|
public async Task<IActionResult> VerifyMPIN([FromBody] VerifyMPINDto verifyMPIN)
|
|
{
|
|
try
|
|
{
|
|
// Validate the MPIN token and extract claims
|
|
var claimsPrincipal = _refreshTokenService.ValidateToken(verifyMPIN.MPINToken, _jwtSettings);
|
|
if (claimsPrincipal?.Identity == null || !claimsPrincipal.Identity.IsAuthenticated)
|
|
{
|
|
_logger.LogWarning("Invalid or unauthenticated MPIN token");
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid MPIN token", "Unauthorized", 401));
|
|
}
|
|
|
|
string? tokenType = claimsPrincipal.FindFirst("token_type")?.Value;
|
|
string? tokenTenantId = claimsPrincipal.FindFirst("TenantId")?.Value;
|
|
string? tokenUserId = claimsPrincipal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
|
|
|
|
// Validate essential claims
|
|
if (string.IsNullOrWhiteSpace(tokenType) || string.IsNullOrWhiteSpace(tokenTenantId) || string.IsNullOrWhiteSpace(tokenUserId))
|
|
{
|
|
_logger.LogWarning("MPIN token claims are incomplete");
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid token claims", "MPIN token does not match your identity", 401));
|
|
}
|
|
|
|
Guid tenantId = Guid.Parse(tokenTenantId);
|
|
|
|
// Fetch employee by ID and tenant
|
|
var requestEmployee = await _context.Employees
|
|
.Include(e => e.ApplicationUser)
|
|
.FirstOrDefaultAsync(e => e.Id == verifyMPIN.EmployeeId && e.TenantId == tenantId && e.ApplicationUserId == tokenUserId && e.IsActive);
|
|
|
|
if (requestEmployee == null || string.IsNullOrWhiteSpace(requestEmployee.ApplicationUserId))
|
|
{
|
|
_logger.LogWarning("Employee not found or invalid for verification - EmployeeId: {EmployeeId}", verifyMPIN.EmployeeId);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Invalid request", "Provided invalid employee information", 400));
|
|
}
|
|
|
|
// Validate that the token belongs to the same employee making the request
|
|
if (requestEmployee.ApplicationUserId != tokenUserId || tokenType != "mpin")
|
|
{
|
|
_logger.LogWarning("Token identity does not match employee info - EmployeeId: {EmployeeId}", requestEmployee.Id);
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Unauthorized", "MPIN token does not match your identity", 401));
|
|
}
|
|
|
|
// Ensure MPIN input is valid
|
|
if (string.IsNullOrWhiteSpace(verifyMPIN.MPIN))
|
|
{
|
|
_logger.LogWarning("MPIN not provided for EmployeeId: {EmployeeId}", requestEmployee.Id);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Invalid request", "MPIN not provided", 400));
|
|
}
|
|
|
|
// Retrieve MPIN details
|
|
var mpinDetails = await _context.MPINDetails
|
|
.FirstOrDefaultAsync(p => p.UserId == Guid.Parse(requestEmployee.ApplicationUserId) && p.TenantId == tenantId);
|
|
|
|
if (mpinDetails == null)
|
|
{
|
|
_logger.LogWarning("MPIN not set for EmployeeId: {EmployeeId}", requestEmployee.Id);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("MPIN not set", "You have not set an MPIN", 400));
|
|
}
|
|
|
|
// Compare hashed MPIN
|
|
var providedMPINHash = ComputeSha256Hash(verifyMPIN.MPIN);
|
|
if (providedMPINHash != mpinDetails.MPIN)
|
|
{
|
|
_logger.LogWarning("MPIN mismatch for EmployeeId: {EmployeeId}", requestEmployee.Id);
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("MPIN mismatch", "MPIN did not match", 401));
|
|
}
|
|
|
|
// Generate new tokens
|
|
var jwtToken = _refreshTokenService.GenerateJwtToken(requestEmployee.Email, tenantId, _jwtSettings);
|
|
var refreshToken = await _refreshTokenService.CreateRefreshToken(requestEmployee.ApplicationUserId, tenantId.ToString(), _jwtSettings);
|
|
|
|
_logger.LogInfo("MPIN verification successful - EmployeeId: {EmployeeId}", requestEmployee.Id);
|
|
|
|
return Ok(ApiResponse<object>.SuccessResponse(new
|
|
{
|
|
token = jwtToken,
|
|
refreshToken
|
|
}, "User logged in successfully.", 200));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "Unexpected error occurred while verifying MPIN");
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("Unexpected error", ex.Message, 500));
|
|
}
|
|
}
|
|
|
|
[HttpPost("logout")]
|
|
public async Task<IActionResult> Logout([FromBody] LogoutDto logoutDto)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(logoutDto.RefreshToken))
|
|
{
|
|
_logger.LogWarning("Logout failed: Refresh token is missing");
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Refresh token is required", "Refresh token is required", 400));
|
|
}
|
|
|
|
try
|
|
{
|
|
// Revoke the refresh token
|
|
bool isRevoked = await _refreshTokenService.RevokeRefreshTokenAsync(logoutDto.RefreshToken);
|
|
if (!isRevoked)
|
|
{
|
|
_logger.LogWarning("Logout failed: Invalid or expired refresh token");
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid or expired refresh token", "Invalid or expired refresh token", 401));
|
|
}
|
|
|
|
// Optional: Blacklist the JWT access token
|
|
string jwtToken = HttpContext.Request.Headers["Authorization"].ToString().Replace("Bearer ", "");
|
|
if (!string.IsNullOrWhiteSpace(jwtToken))
|
|
{
|
|
await _refreshTokenService.BlacklistJwtTokenAsync(jwtToken);
|
|
_logger.LogInfo("JWT access token blacklisted successfully");
|
|
}
|
|
|
|
_logger.LogInfo("User logged out successfully");
|
|
return Ok(ApiResponse<object>.SuccessResponse(new { }, "Logged out successfully", 200));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "Unexpected error during logout");
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("Unexpected error occurred", ex.Message, 500));
|
|
}
|
|
}
|
|
|
|
[HttpPost("refresh-token")]
|
|
public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenDto refreshTokenDto)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(refreshTokenDto.RefreshToken))
|
|
{
|
|
_logger.LogWarning("Refresh token is missing from the request body.");
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Refresh token is required.", "Missing refresh token.", 400));
|
|
}
|
|
|
|
try
|
|
{
|
|
// Step 1: Fetch and validate the refresh token
|
|
var refreshToken = await _refreshTokenService.GetRefreshToken(refreshTokenDto.RefreshToken);
|
|
if (refreshToken == null)
|
|
{
|
|
_logger.LogWarning("Refresh token not found in the database");
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid or expired refresh token.", "Token not found.", 401));
|
|
}
|
|
|
|
if (refreshToken.ExpiryDate < DateTime.UtcNow)
|
|
{
|
|
_logger.LogWarning("Refresh token expired");
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Refresh token expired.", "Token expired.", 401));
|
|
}
|
|
|
|
// Step 2: Mark the token as used
|
|
await _refreshTokenService.MarkRefreshTokenAsUsed(refreshToken);
|
|
_logger.LogInfo("Refresh token marked as used");
|
|
|
|
// Step 3: Validate and retrieve user
|
|
var user = await _userManager.FindByIdAsync(refreshToken.UserId ?? string.Empty);
|
|
if (user == null)
|
|
{
|
|
_logger.LogWarning("User not found for RefreshToken: {Token}", refreshTokenDto.RefreshToken);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Invalid request.", "User not found.", 400));
|
|
}
|
|
|
|
if (string.IsNullOrWhiteSpace(user.UserName))
|
|
{
|
|
_logger.LogWarning("Username missing for user ID: {UserId}", user.Id);
|
|
return NotFound(ApiResponse<object>.ErrorResponse("Username not found.", "Username not found.", 404));
|
|
}
|
|
|
|
// Step 4: Fetch employee and generate new tokens
|
|
var emp = await _employeeHelper.GetEmployeeByApplicationUserID(user.Id);
|
|
|
|
var newJwtToken = _refreshTokenService.GenerateJwtToken(user.UserName, emp.TenantId, _jwtSettings);
|
|
var newRefreshToken = await _refreshTokenService.CreateRefreshToken(user.Id, emp.TenantId.ToString(), _jwtSettings);
|
|
|
|
_logger.LogInfo("New access and refresh token issued for user: {UserId}", user.Id);
|
|
|
|
return Ok(ApiResponse<object>.SuccessResponse(
|
|
new { token = newJwtToken, refreshToken = newRefreshToken },
|
|
"User refresh token generated successfully.",
|
|
200));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "An unexpected error occurred during token refresh.");
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("Unexpected error occurred.", ex.Message, 500));
|
|
}
|
|
}
|
|
|
|
[HttpPost("forgot-password")]
|
|
public async Task<IActionResult> ForgotPassword([FromBody] ForgotPasswordDto forgotPasswordDto)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(forgotPasswordDto.Email))
|
|
{
|
|
_logger.LogWarning("ForgotPassword request received without email.");
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Email is required.", "Email is required.", 400));
|
|
}
|
|
|
|
var user = await _userManager.FindByEmailAsync(forgotPasswordDto.Email);
|
|
if (user == null || user.Email == null)
|
|
{
|
|
_logger.LogWarning("ForgotPassword requested for non-existent or null-email user: {Email}", forgotPasswordDto.Email);
|
|
// Do not disclose whether the email exists (security best practice)
|
|
return Ok(ApiResponse<object>.SuccessResponse(true, "Password reset link sent if the account exists.", 200));
|
|
}
|
|
|
|
try
|
|
{
|
|
// Generate token and build reset link
|
|
var token = await _userManager.GeneratePasswordResetTokenAsync(user);
|
|
var resetLink = $"{_configuration["AppSettings:WebFrontendUrl"]}/reset-password?token={WebUtility.UrlEncode(token)}";
|
|
|
|
// Send reset email
|
|
await _emailSender.SendResetPasswordEmail(user.Email, user.UserName ?? "User", resetLink);
|
|
|
|
_logger.LogInfo("Password reset link sent to user: {Email}", user.Email);
|
|
return Ok(ApiResponse<object>.SuccessResponse(true, "Password reset link sent if the account exists.", 200));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "Error while sending password reset email to");
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("Error sending password reset email.", ex.Message, 500));
|
|
}
|
|
}
|
|
|
|
[HttpPost("reset-password")]
|
|
public async Task<IActionResult> ResetPassword([FromBody] ResetPasswordDto model)
|
|
{
|
|
_logger.LogInfo("Password reset request received for email: {Email}", model.Email ?? string.Empty);
|
|
|
|
if (string.IsNullOrWhiteSpace(model.Email) || string.IsNullOrWhiteSpace(model.Token) || string.IsNullOrWhiteSpace(model.NewPassword))
|
|
{
|
|
_logger.LogWarning("Reset password failed due to missing input fields for email: {Email}", model.Email ?? string.Empty);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("All fields are required.", "Invalid input.", 400));
|
|
}
|
|
|
|
var user = await _userManager.FindByEmailAsync(model.Email);
|
|
if (user == null)
|
|
{
|
|
_logger.LogWarning("Reset password failed - user not found for email: {Email}", model.Email);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Invalid request.", "Invalid user.", 400));
|
|
}
|
|
|
|
var isTokenValid = await _userManager.VerifyUserTokenAsync(
|
|
user,
|
|
TokenOptions.DefaultProvider, // This is the token provider
|
|
UserManager<ApplicationUser>.ResetPasswordTokenPurpose,
|
|
WebUtility.UrlDecode(model.Token)
|
|
);
|
|
string token = "";
|
|
|
|
if (!isTokenValid)
|
|
{
|
|
_logger.LogWarning("Decoded token failed, retrying with raw token for email: {Email}", model.Email);
|
|
|
|
var isDecodedTokenValid = await _userManager.VerifyUserTokenAsync(
|
|
user,
|
|
TokenOptions.DefaultProvider,
|
|
UserManager<ApplicationUser>.ResetPasswordTokenPurpose,
|
|
model.Token
|
|
);
|
|
|
|
if (!isDecodedTokenValid)
|
|
{
|
|
_logger.LogWarning("Both decoded and raw token failed for email: {Email}", model.Email);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Invalid request.", "Invalid or expired reset token.", 400));
|
|
}
|
|
|
|
token = model.Token;
|
|
}
|
|
else
|
|
{
|
|
token = WebUtility.UrlDecode(model.Token);
|
|
}
|
|
|
|
var result = await _userManager.ResetPasswordAsync(user, token, model.NewPassword);
|
|
if (!result.Succeeded)
|
|
{
|
|
var errors = result.Errors.Select(e => e.Description).ToList();
|
|
_logger.LogWarning("Reset password failed for user: {Email}. Errors: {Errors}", model.Email, string.Join(", ", errors));
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Failed to reset password.", errors, 400));
|
|
}
|
|
|
|
try
|
|
{
|
|
var emp = await _employeeHelper.GetEmployeeByApplicationUserID(user.Id);
|
|
string fullName = $"{emp.FirstName} {emp.LastName}".Trim();
|
|
|
|
await _emailSender.SendResetPasswordSuccessEmail(user.Email!, fullName);
|
|
|
|
_logger.LogInfo("Reset password success email sent to user: {Email}", model.Email);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "Error while sending reset password success email to user");
|
|
// Continue, do not fail because of email issue
|
|
}
|
|
|
|
_logger.LogInfo("Password reset successful for user: {Email}", model.Email);
|
|
return Ok(ApiResponse<object>.SuccessResponse(true, "Password reset successfully.", 200));
|
|
}
|
|
|
|
[HttpPost("send-otp")]
|
|
public async Task<IActionResult> SendOtpEmail([FromBody] GenerateOTPDto generateOTP)
|
|
{
|
|
try
|
|
{
|
|
// Validate input email
|
|
if (string.IsNullOrWhiteSpace(generateOTP.Email))
|
|
{
|
|
_logger.LogWarning("Send OTP failed - Email is missing");
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Email is required", "Invalid email", 400));
|
|
}
|
|
|
|
// Fetch user by email
|
|
var requestedUser = await _userManager.FindByEmailAsync(generateOTP.Email);
|
|
string title = "Send OTP";
|
|
|
|
if (requestedUser != null && requestedUser.IsActive)
|
|
{
|
|
// Fetch employee details
|
|
var requestedEmployee = await _context.Employees
|
|
.FirstOrDefaultAsync(e => e.ApplicationUserId == requestedUser.Id);
|
|
|
|
// Generate a random 4-digit OTP
|
|
string otp = new Random().Next(1000, 9999).ToString();
|
|
|
|
// Store OTP in database
|
|
var otpDetails = new OTPDetails
|
|
{
|
|
UserId = Guid.Parse(requestedUser.Id),
|
|
OTP = otp,
|
|
ExpriesInSec = 600, // 10 minutes
|
|
TimeStamp = DateTime.UtcNow,
|
|
TenantId = requestedUser.TenantId
|
|
};
|
|
|
|
_context.OTPDetails.Add(otpDetails);
|
|
await _context.SaveChangesAsync();
|
|
|
|
// Prepare email
|
|
List<string> toEmails = [generateOTP.Email];
|
|
string name = $"{requestedEmployee?.FirstName} {requestedEmployee?.LastName}".Trim();
|
|
var mailTemplate = await _context.MailingList
|
|
.FirstOrDefaultAsync(t => t.Title.ToLower() == title.ToLower());
|
|
|
|
string subject = mailTemplate?.Subject ?? string.Empty;
|
|
string emailBody = mailTemplate?.Body ?? string.Empty;
|
|
|
|
// Send OTP via email
|
|
await _emailSender.SendOTP(toEmails, emailBody, name, otp, subject);
|
|
|
|
_logger.LogInfo("OTP sent successfully to {Email}", generateOTP.Email);
|
|
return Ok(ApiResponse<object>.SuccessResponse("Success", "OTP generated successfully", 200));
|
|
}
|
|
|
|
_logger.LogWarning("Send OTP failed - Invalid or inactive user: {Email}", generateOTP.Email);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Provided invalid information", "User not found or inactive", 400));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "An unexpected error occurred while sending OTP to {Email}", generateOTP.Email ?? "");
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("An unexpected error occurred.", ex.Message, 500));
|
|
}
|
|
}
|
|
|
|
[HttpPost("login-otp")]
|
|
public async Task<IActionResult> LoginWithOTP([FromBody] VerifyOTPDto verifyOTP)
|
|
{
|
|
try
|
|
{
|
|
// Validate input
|
|
if (string.IsNullOrWhiteSpace(verifyOTP.Email) ||
|
|
string.IsNullOrWhiteSpace(verifyOTP.OTP) ||
|
|
verifyOTP.OTP.Length != 4 ||
|
|
!verifyOTP.OTP.All(char.IsDigit))
|
|
{
|
|
_logger.LogWarning("OTP login failed - invalid input provided");
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Invalid input", "Please provide a valid 4-digit OTP and Email", 400));
|
|
}
|
|
|
|
// Fetch employee by email
|
|
var requestEmployee = await _context.Employees
|
|
.Include(e => e.ApplicationUser)
|
|
.FirstOrDefaultAsync(e => e.Email == verifyOTP.Email && e.IsActive);
|
|
|
|
if (requestEmployee == null || string.IsNullOrWhiteSpace(requestEmployee.ApplicationUserId))
|
|
{
|
|
_logger.LogWarning("OTP login failed - user not found for email {Email}", verifyOTP.Email);
|
|
return NotFound(ApiResponse<object>.ErrorResponse("User not found", "User not found", 404));
|
|
}
|
|
|
|
Guid userId = Guid.Parse(requestEmployee.ApplicationUserId);
|
|
|
|
// Fetch most recent OTP
|
|
var otpDetails = await _context.OTPDetails
|
|
.Where(o => o.UserId == userId && o.TenantId == requestEmployee.TenantId)
|
|
.OrderByDescending(o => o.TimeStamp)
|
|
.FirstOrDefaultAsync();
|
|
|
|
if (otpDetails == null)
|
|
{
|
|
_logger.LogWarning("OTP login failed - no OTP found for user {UserId}", userId);
|
|
return NotFound(ApiResponse<object>.ErrorResponse("OTP not found", "No OTP was generated for this user", 404));
|
|
}
|
|
|
|
// Validate OTP expiration
|
|
var validUntil = otpDetails.TimeStamp.AddSeconds(otpDetails.ExpriesInSec);
|
|
if (DateTime.UtcNow > validUntil || otpDetails.IsUsed)
|
|
{
|
|
_logger.LogWarning("OTP login failed - OTP expired for user {UserId}", userId);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("OTP expired", "The OTP has expired, please request a new one", 400));
|
|
}
|
|
|
|
// Match OTP
|
|
if (otpDetails.OTP != verifyOTP.OTP)
|
|
{
|
|
_logger.LogWarning("OTP login failed - incorrect OTP entered for user {UserId}", userId);
|
|
return Unauthorized(ApiResponse<object>.ErrorResponse("Invalid OTP", "OTP did not match", 401));
|
|
}
|
|
|
|
// Generate access and refresh tokens
|
|
var accessToken = _refreshTokenService.GenerateJwtToken(
|
|
requestEmployee.ApplicationUser?.UserName,
|
|
requestEmployee.TenantId,
|
|
_jwtSettings
|
|
);
|
|
|
|
var refreshToken = await _refreshTokenService.CreateRefreshToken(
|
|
requestEmployee.ApplicationUserId,
|
|
requestEmployee.TenantId.ToString(),
|
|
_jwtSettings
|
|
);
|
|
|
|
// Fetch MPIN token if exists
|
|
var mpinDetails = await _context.MPINDetails
|
|
.FirstOrDefaultAsync(p => p.UserId == userId && p.TenantId == requestEmployee.TenantId);
|
|
|
|
// Build and return response
|
|
var response = new
|
|
{
|
|
token = accessToken,
|
|
refreshToken,
|
|
mpinToken = mpinDetails?.MPINToken
|
|
};
|
|
otpDetails.IsUsed = true;
|
|
await _context.SaveChangesAsync();
|
|
_logger.LogInfo("OTP login successful for employee {EmployeeId}", requestEmployee.Id);
|
|
return Ok(ApiResponse<object>.SuccessResponse(response, "User logged in successfully.", 200));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "An unexpected error occurred during OTP login for email {Email}", verifyOTP.Email ?? string.Empty);
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("Unexpected error", ex.Message, 500));
|
|
}
|
|
}
|
|
|
|
[HttpPost("sendmail")]
|
|
public async Task<IActionResult> SendEmail([FromBody] EmailDot emailDot)
|
|
{
|
|
|
|
|
|
|
|
var user = await _userManager.FindByEmailAsync(emailDot.ToEmail ?? string.Empty);
|
|
if (user == null)
|
|
{
|
|
return NotFound(ApiResponse<object>.ErrorResponse("User not found.", "User not found.", 404));
|
|
}
|
|
|
|
/* New User*/
|
|
//var token = await _userManager.GeneratePasswordResetTokenAsync(user);
|
|
//var resetLink = $"{_configuration["AppSettings:WebFrontendUrl"]}/reset-password?token={WebUtility.UrlEncode(token)}";
|
|
|
|
//await _emailSender.SendResetPasswordEmailOnRegister(emailDot.ToEmail, "Vikas", resetLink);
|
|
|
|
|
|
/* Forget password*/
|
|
// var token = await _userManager.GeneratePasswordResetTokenAsync(user);
|
|
|
|
var token = await _userManager.GenerateUserTokenAsync(user, TokenOptions.DefaultProvider, "ResetPassword");
|
|
|
|
var isTokenValid = await _userManager.VerifyUserTokenAsync(user, TokenOptions.DefaultProvider, "ResetPassword", token);
|
|
|
|
var resetLink = $"{_configuration["AppSettings:WebFrontendUrl"]}/reset-password?token={WebUtility.UrlEncode(token)}";
|
|
|
|
if (user.Email == null) return NotFound(ApiResponse<object>.ErrorResponse("Email Not found", "Email Not found", 404));
|
|
|
|
await _emailSender.SendResetPasswordEmail(user.Email, "", resetLink);
|
|
|
|
return Ok(ApiResponse<object>.SuccessResponse(new { }, "Password reset link sent.", 200));
|
|
}
|
|
|
|
[Authorize]
|
|
[HttpPost("change-password")]
|
|
public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordDto changePassword)
|
|
{
|
|
try
|
|
{
|
|
// Get the currently logged-in user
|
|
var loggedUser = await _userHelper.GetCurrentUserAsync();
|
|
|
|
// Validate email
|
|
if (string.IsNullOrWhiteSpace(changePassword.Email))
|
|
{
|
|
_logger.LogWarning("Change password attempt failed - Email is missing");
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Email is missing", "Email is missing", 400));
|
|
}
|
|
|
|
// Find the user by email
|
|
var requestedUser = await _userManager.FindByEmailAsync(changePassword.Email);
|
|
if (requestedUser == null)
|
|
{
|
|
_logger.LogWarning("Change password attempt failed - Email not found: {Email}", changePassword.Email);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Invalid email", "User not found.", 400));
|
|
}
|
|
|
|
// Validate the old password
|
|
bool isOldPasswordCorrect = await _userManager.CheckPasswordAsync(requestedUser, changePassword.OldPassword ?? string.Empty);
|
|
|
|
// Ensure user identity and old password match
|
|
if (loggedUser?.Email != requestedUser.Email || !isOldPasswordCorrect)
|
|
{
|
|
_logger.LogWarning("Change password denied - User {Email} provided incorrect credentials", changePassword.Email);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Incorrect credentials", "Invalid request.", 400));
|
|
}
|
|
|
|
// Generate reset token and change password
|
|
var resetToken = await _userManager.GeneratePasswordResetTokenAsync(requestedUser);
|
|
var result = await _userManager.ResetPasswordAsync(requestedUser, resetToken, changePassword.NewPassword ?? string.Empty);
|
|
|
|
if (!result.Succeeded)
|
|
{
|
|
var errors = result.Errors.Select(e => e.Description).ToList();
|
|
_logger.LogWarning("Password reset failed for user {Email}. Errors: {Errors}", changePassword.Email, string.Join("; ", errors));
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Failed to change password", errors, 400));
|
|
}
|
|
|
|
// Send confirmation email
|
|
var emp = await _employeeHelper.GetEmployeeByApplicationUserID(requestedUser.Id);
|
|
await _emailSender.SendResetPasswordSuccessEmail(requestedUser.Email ?? string.Empty, $"{emp.FirstName} {emp.LastName}");
|
|
|
|
_logger.LogInfo("Password changed successfully for user {Email}", requestedUser.Email ?? string.Empty);
|
|
return Ok(ApiResponse<object>.SuccessResponse(true, "Password changed successfully.", 200));
|
|
}
|
|
catch (Exception exp)
|
|
{
|
|
_logger.LogError(exp, "An unexpected error occurred while changing password");
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("An unexpected error occurred.", exp.Message, 500));
|
|
}
|
|
}
|
|
|
|
[Authorize]
|
|
[HttpPost("generate-mpin")]
|
|
public async Task<IActionResult> GenerateMPIN([FromBody] GenerateMPINDto generateMPINDto)
|
|
{
|
|
Guid tenantId = _userHelper.GetTenantId();
|
|
Employee loggedInEmployee = await _userHelper.GetCurrentEmployeeAsync();
|
|
|
|
// Get the employee for whom MPIN is being generated
|
|
var requestEmployee = await _context.Employees
|
|
.Include(e => e.ApplicationUser)
|
|
.FirstOrDefaultAsync(e => e.Id == generateMPINDto.EmployeeId && e.TenantId == tenantId);
|
|
|
|
// Validate employee and MPIN input
|
|
if (requestEmployee == null || string.IsNullOrWhiteSpace(generateMPINDto.MPIN) || generateMPINDto.MPIN.Length != 4 || !generateMPINDto.MPIN.All(char.IsDigit))
|
|
{
|
|
_logger.LogWarning("Employee {EmployeeId} provided invalid information to generate MPIN", loggedInEmployee.Id);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("Provided invalid information", "Provided invalid information", 400));
|
|
}
|
|
|
|
// Ensure the logged-in user is only generating their own MPIN
|
|
if (requestEmployee.Id != loggedInEmployee.Id)
|
|
{
|
|
_logger.LogWarning("Employee {EmployeeId} tried to set MPIN for a different employee", loggedInEmployee.Id);
|
|
return BadRequest(ApiResponse<object>.ErrorResponse("You can't create MPIN for another employee", "Unauthorized MPIN creation", 400));
|
|
}
|
|
|
|
// Generate hash and token
|
|
string mpinHash = ComputeSha256Hash(generateMPINDto.MPIN);
|
|
string mpinToken = _refreshTokenService.CreateMPINToken(
|
|
requestEmployee.ApplicationUserId,
|
|
requestEmployee.TenantId.ToString(),
|
|
_jwtSettings
|
|
);
|
|
|
|
// Prepare MPIN entity
|
|
Guid userId = Guid.Parse(requestEmployee.ApplicationUserId ?? string.Empty);
|
|
var existingMPIN = await _context.MPINDetails.FirstOrDefaultAsync(p => p.UserId == userId && p.TenantId == tenantId);
|
|
|
|
if (existingMPIN == null)
|
|
{
|
|
// Add new MPIN record
|
|
var mPINDetails = new MPINDetails
|
|
{
|
|
UserId = userId,
|
|
MPIN = mpinHash,
|
|
MPINToken = mpinToken,
|
|
TimeStamp = DateTime.UtcNow,
|
|
TenantId = tenantId
|
|
};
|
|
|
|
_context.MPINDetails.Add(mPINDetails);
|
|
await _context.SaveChangesAsync();
|
|
|
|
_logger.LogInfo("MPIN generated successfully for employee {EmployeeId}", requestEmployee.Id);
|
|
return Ok(ApiResponse<object>.SuccessResponse(mpinToken, "MPIN generated successfully", 200));
|
|
}
|
|
else
|
|
{
|
|
// Update existing MPIN record
|
|
existingMPIN.MPIN = mpinHash;
|
|
existingMPIN.MPINToken = mpinToken;
|
|
existingMPIN.TimeStamp = DateTime.UtcNow;
|
|
|
|
await _context.SaveChangesAsync();
|
|
|
|
_logger.LogInfo("MPIN updated successfully for employee {EmployeeId}", requestEmployee.Id);
|
|
return Ok(ApiResponse<object>.SuccessResponse(mpinToken, "MPIN updated successfully", 200));
|
|
}
|
|
}
|
|
|
|
[Authorize]
|
|
[HttpPost("set/device-token")]
|
|
public async Task<IActionResult> StoreDeviceToken([FromBody] FCMTokenDto model)
|
|
{
|
|
var loggedInEmployee = await _userHelper.GetCurrentEmployeeAsync();
|
|
var tenantId = _userHelper.GetTenantId();
|
|
|
|
var exsistingFCMMapping = await _context.FCMTokenMappings.FirstOrDefaultAsync(ft => ft.EmployeeId == loggedInEmployee.Id);
|
|
if (exsistingFCMMapping == null)
|
|
{
|
|
var fcmTokenMapping = new FCMTokenMapping
|
|
{
|
|
EmployeeId = loggedInEmployee.Id,
|
|
FcmToken = model.FcmToken,
|
|
TenantId = tenantId
|
|
};
|
|
_context.FCMTokenMappings.Add(fcmTokenMapping);
|
|
_logger.LogInfo("New FCM Token registering for employee {EmployeeId}", loggedInEmployee.Id);
|
|
}
|
|
else
|
|
{
|
|
exsistingFCMMapping.FcmToken = model.FcmToken;
|
|
_logger.LogInfo("Updating FCM Token for employee {EmployeeId}", loggedInEmployee.Id);
|
|
}
|
|
try
|
|
{
|
|
await _context.SaveChangesAsync();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.LogError(ex, "Exception occured while saving FCM Token for employee {EmployeeId}", loggedInEmployee.Id);
|
|
return StatusCode(500, ApiResponse<object>.ErrorResponse("Internal Error", ex.Message, 500));
|
|
}
|
|
return Ok(ApiResponse<object>.SuccessResponse(new { }, "FCM Token registered Successfuly", 200));
|
|
}
|
|
private static string ComputeSha256Hash(string rawData)
|
|
{
|
|
using (SHA256 sha256 = SHA256.Create())
|
|
{
|
|
// Convert the input string to bytes and compute the hash
|
|
byte[] bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(rawData));
|
|
|
|
// Convert byte array to a readable hex string
|
|
StringBuilder builder = new StringBuilder();
|
|
foreach (var b in bytes)
|
|
builder.Append(b.ToString("x2"));
|
|
|
|
return builder.ToString();
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|