Merge pull request 'Refactored authentication' (#71) from payments into master

Reviewed-on: #71

.gitignore

@@ -363,3 +363,4 @@ MigrationBackup/
 FodyWeavers.xsd
 /LiteCharms.Features.Tests/http/http-client.env.json
 /LiteCharms.Features.Tests/http/midrandshop-api/http-client.env.json
+/LiteCharms.Features.Tests/http/authentik/http-client.env.json

LiteCharms.Features.MidrandBooks.Seed/appsettings.json

@@ -1,6 +1,6 @@
 {
   "FeatureManagement": {
-    "CategorySeederService": true,
+    "CategorySeederService": false,
     "CustomerSeederService": false,
     "ProductsSeederService": false
   },

LiteCharms.Features.Tests/http/authentik/app.http

@@ -0,0 +1,6 @@
+### Authentik Token Request (Service Account Explicit)
+POST {{authority}}
+Content-Type: application/x-www-form-urlencoded
+Accept-Encoding: identity
+
+grant_type={{grantType}}&client_id={{clientId}}&username={{username}}&password={{password}}&scope={{scope}}

LiteCharms.Features/Api/Configuration/AuthentikSettings.cs

@@ -4,6 +4,8 @@ public sealed class AuthentikSettings
 {
     public string? Authority { get; set; }
 
+    public string? IntrospectionUrl { get; set; }
+
     public string? ApiResourceName { get; set; }
 
     public string? ApiResourceSecret { get; set; }
@@ -13,6 +15,4 @@ public sealed class AuthentikSettings
     public string? RequiredClaimNameValue { get; set; }
 
     public bool RequireHttpsMetadata { get; set; }
-
-    public bool BypassSslErrors { get; set; }
 }

LiteCharms.Features/Extensions/Api.cs

@@ -11,28 +11,28 @@ public static class Api
 
     public static IServiceCollection AddAuthentic(this IServiceCollection services, IConfiguration configuration)
     {
+        var configSection = configuration.GetSection(nameof(AuthentikSettings));
+
         var authOptions = new AuthentikSettings();
+        configSection.Bind(authOptions);
 
-        configuration.GetSection("Authentik").Bind(authOptions);
+        services.Configure<AuthentikSettings>(configSection);
-
-        services.Configure<AuthentikSettings>(configuration.GetSection(nameof(AuthentikSettings)));
 
         services.AddAuthentication(OAuth2IntrospectionDefaults.AuthenticationScheme)
-            .AddOAuth2Introspection(options =>
+            .AddOAuth2Introspection(OAuth2IntrospectionDefaults.AuthenticationScheme, options =>
             {
-                options.Authority = options.Authority;
+                options.Authority = authOptions.Authority;
-                options.ClientId = options.ClientId;
+                options.IntrospectionEndpoint = authOptions.IntrospectionUrl;
-                options.ClientSecret = options.ClientSecret;
+                options.ClientId = authOptions.ApiResourceName;
+                options.ClientSecret = authOptions.ApiResourceSecret;
+
+                options.NameClaimType = "sub";
                 options.DiscoveryPolicy.RequireHttps = authOptions.RequireHttpsMetadata;
-                options.EnableCaching = true;
+                options.DiscoveryPolicy.ValidateEndpoints = false;
-                options.CacheDuration = TimeSpan.FromMinutes(10);
+                options.EnableCaching = false;                
             });
 
-        if (!string.IsNullOrWhiteSpace(authOptions.RequiredClaimName) && !string.IsNullOrWhiteSpace(authOptions.RequiredClaimNameValue))
+        services.AddAuthorization();
-            services.AddAuthorizationBuilder().AddPolicy("ApiScope", policy =>
-                    policy.RequireClaim(authOptions.RequiredClaimName, authOptions.RequiredClaimNameValue));
-        else
-            services.AddAuthorization();
 
         return services;
     }

LiteCharms.Features/Hasher/HashService.cs

@@ -4,7 +4,7 @@ namespace LiteCharms.Features.Hasher;
 
 public sealed partial class HashService(IHashids hasher) : IService
 {
-    [GeneratedRegex(@"\A\b[0-9a-fA-F]+\b\Z")]
+    [GeneratedRegex(@"\A\b[0-9a-fA-F]+\b\Z", RegexOptions.None, matchTimeoutMilliseconds: 100)]
     private static partial Regex HexHashRegex { get; }
 
     [GeneratedRegex(@"\A[0-9a-fA-F]{32}\Z", RegexOptions.None, matchTimeoutMilliseconds: 100)]