Merge pull request 'payments' (#91 ) from payments into master

Reviewed-on: #91
Adopted standard logout flow
2026-06-07 13:57:15 +02:00 · 2026-06-07 13:56:49 +02:00 · 2026-06-07 13:55:20 +02:00 · 2026-06-07 13:12:05 +02:00 · 2026-06-07 13:11:33 +02:00 · 2026-06-07 12:00:50 +02:00
9 changed files with 92 additions and 64 deletions
@@ -11,7 +11,7 @@
  <!-- Quartz Scheduler-->
  <ItemGroup>
    <PackageReference Include="Bogus" Version="35.6.5" />
-    <PackageReference Include="Meziantou.Analyzer" Version="3.0.98">
+    <PackageReference Include="Meziantou.Analyzer" Version="3.0.101">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
@@ -116,8 +116,8 @@

  <!-- Amazon S3 SDK -->
  <ItemGroup>
-    <PackageReference Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.4.3" />
-    <PackageReference Include="AWSSDK.S3" Version="4.0.24" />
+    <PackageReference Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.4.4" />
+    <PackageReference Include="AWSSDK.S3" Version="4.0.24.1" />
    <ProjectReference Include="..\LiteCharms.Features\LiteCharms.Features.csproj" />

    <!-- global Usings -->
@@ -32,7 +32,7 @@
  <!-- Quartz Scheduler-->
  <ItemGroup>
    <PackageReference Include="Humanizer" Version="3.0.10" />
-    <PackageReference Include="Meziantou.Analyzer" Version="3.0.98">
+    <PackageReference Include="Meziantou.Analyzer" Version="3.0.101">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
@@ -136,8 +136,8 @@

  <!-- Amazon S3 SDK -->
  <ItemGroup>
-    <PackageReference Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.4.3" />
-    <PackageReference Include="AWSSDK.S3" Version="4.0.24" />
+    <PackageReference Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.4.4" />
+    <PackageReference Include="AWSSDK.S3" Version="4.0.24.1" />
    <ProjectReference Include="..\LiteCharms.Features\LiteCharms.Features.csproj" />

    <!-- global Usings -->
@@ -136,8 +136,8 @@

  <!-- Amazon S3 SDK -->
  <ItemGroup>
-    <PackageReference Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.4.3" />
-    <PackageReference Include="AWSSDK.S3" Version="4.0.24" />
+    <PackageReference Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.4.4" />
+    <PackageReference Include="AWSSDK.S3" Version="4.0.24.1" />
    <ProjectReference Include="..\LiteCharms.Features\LiteCharms.Features.csproj" />

    <!-- global Usings -->
@@ -1,6 +1,6 @@
 ### Authentik Token Request (Service Account Explicit)
-POST {{authority}}
+POST {{authority}}/connect/token
 Content-Type: application/x-www-form-urlencoded
 Accept-Encoding: identity

-grant_type={{grantType}}&client_id={{clientId}}&username={{username}}&password={{password}}&scope={{scope}}
+grant_type={{grantType}}&client_id={{clientId}}&client_secret={{clientSecret}}&scope={{scope}}
@@ -0,0 +1,9 @@
+{
+  "uat": {
+    "authority": "https://sts.security.khongisa.co.za",
+    "grantType": "client_credentials",
+    "clientId": "midrandbooks-api-scaler-uat",
+    "clientSecret": "secret_0a8dc1f99061590a52b1272db3a1871d2761c79fbd058b2a968911029e4b208a",
+    "scope": "midrandbooks-api"
+  }
+}
@@ -1,18 +0,0 @@
-namespace LiteCharms.Features.Api.Configuration;
-
-public sealed class AuthentikSettings
-{
-    public string? Authority { get; set; }
-
-    public string? IntrospectionUrl { get; set; }
-
-    public string? ClientId { get; set; }
-
-    public string? ClientSecret { get; set; }
-
-    public string? RequiredClaimName { get; set; }
-
-    public string? RequiredClaimNameValue { get; set; }
-
-    public bool RequireHttpsMetadata { get; set; }
-}
@@ -0,0 +1,12 @@
+namespace LiteCharms.Features.Api.Configuration;
+
+public sealed class LiteCharmsSettings
+{
+    public string? Authority { get; set; }
+
+    public string? ClientId { get; set; }
+
+    public string? ClientSecret { get; set; }
+
+    public string? Audience { get; set; }
+}
@@ -1,6 +1,7 @@
 using LiteCharms.Features.Abstractions;
 using LiteCharms.Features.Api;
 using LiteCharms.Features.Api.Configuration;
+using Microsoft.AspNetCore.Authentication.JwtBearer;

 namespace LiteCharms.Features.Extensions;

@@ -9,14 +10,14 @@ public static class Api
    public const string Books = nameof(Books);
    public const string Payments = nameof(Payments);

-    public static IServiceCollection AddAuthentikUiSecurity(this IServiceCollection services, IConfiguration configuration)
+    public static IServiceCollection AddLiteCharmsWebSecurity(this IServiceCollection services, IConfiguration configuration)
    {
-        var configSection = configuration.GetSection(nameof(AuthentikSettings));
+        var configSection = configuration.GetSection(nameof(LiteCharmsSettings));

-        var authOptions = new AuthentikSettings();
+        var authOptions = new LiteCharmsSettings();
        configSection.Bind(authOptions);

-        services.Configure<AuthentikSettings>(configSection);
+        services.Configure<LiteCharmsSettings>(configSection);

        services.AddAuthentication(options =>
        {
@@ -30,10 +31,8 @@ public static class Api

            options.ClientId = authOptions.ClientId;
            options.ClientSecret = authOptions.ClientSecret;
-            options.SignedOutCallbackPath = "/signout-callback-oidc";
-            options.SignedOutRedirectUri = "/";
-
            options.ResponseType = "code";
+
            options.SaveTokens = true;
            options.GetClaimsFromUserInfoEndpoint = true;

@@ -46,51 +45,76 @@ public static class Api
            {
                OnRedirectToIdentityProviderForSignOut = context =>
                {
-                    context.ProtocolMessage.PostLogoutRedirectUri = context.Properties.RedirectUri;
+                    var idToken = context.ProtocolMessage.IdTokenHint;
+
+                    if (string.IsNullOrEmpty(idToken))
+                    {
+                        var tokens = context.Properties.GetTokens();
+                        var idTokenItem = tokens.FirstOrDefault(t => string.Equals(t.Name, "id_token", StringComparison.Ordinal));
+
+                        if (idTokenItem != null) context.ProtocolMessage.IdTokenHint = idTokenItem.Value;
+                    }

                    return Task.CompletedTask;
                },
            };
        });

+        services.AddCascadingAuthenticationState();
+
        return services;
    }

-    public static IServiceCollection AddAuthentikApiSecurity(this IServiceCollection services, IConfiguration configuration)
+    public static IServiceCollection AddLiteCharmsApiSecurity(this IServiceCollection services, IConfiguration configuration)
    {
-        var configSection = configuration.GetSection(nameof(AuthentikSettings));
+        var configSection = configuration.GetSection(nameof(LiteCharmsSettings));

-        var authOptions = new AuthentikSettings();
+        var authOptions = new LiteCharmsSettings();
        configSection.Bind(authOptions);

-        services.Configure<AuthentikSettings>(configSection);
+        services.Configure<LiteCharmsSettings>(configSection);

-        services.AddAuthentication(OAuth2IntrospectionDefaults.AuthenticationScheme)
-            .AddOAuth2Introspection(OAuth2IntrospectionDefaults.AuthenticationScheme, options =>
+        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+            .AddJwtBearer(options =>
            {
                options.Authority = authOptions.Authority;
-                options.IntrospectionEndpoint = authOptions.IntrospectionUrl;
-                options.ClientId = authOptions.ClientId;
-                options.ClientSecret = authOptions.ClientSecret;
-
-                options.NameClaimType = "sub";
-                options.DiscoveryPolicy.RequireHttps = authOptions.RequireHttpsMetadata;
-                options.DiscoveryPolicy.ValidateEndpoints = false;
-                options.EnableCaching = false;
+                options.Audience = authOptions.Audience;
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidIssuer = authOptions.Authority,
+                    ValidateAudience = true,
+                    ValidateIssuer = true,
+                };
            });

-        if (!string.IsNullOrWhiteSpace(authOptions.RequiredClaimName) && !string.IsNullOrWhiteSpace(authOptions.RequiredClaimNameValue))
-        {
-            services.AddAuthorizationBuilder()
-                .AddPolicy("RequiredScope", policy =>
-                    policy.RequireClaim(authOptions.RequiredClaimName, authOptions.RequiredClaimNameValue));
-        }
-        else
-            services.AddAuthorization();
+        services.AddAuthorization();

        return services;
    }

+    public static WebApplication AddSecurityEndpoints(this WebApplication app)
+    {
+        app.MapGet("/login", async (HttpContext context, string redirectUri = "/") =>
+        {
+            await context.ChallengeAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
+            {
+                RedirectUri = redirectUri,
+            });
+        });
+
+        app.MapGet("/logout", async (HttpContext context) =>
+        {
+            await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+
+            await context.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
+            {
+                RedirectUri = "/",
+            });
+        });
+
+        return app;
+    }
+
    public static IServiceCollection AddApiServices(this IServiceCollection services, IConfiguration configuration)
    {
        services.AddHttpClient();
@@ -38,9 +38,10 @@
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.8" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />

-    <Using Include="Microsoft.AspNetCore.Authentication.OpenIdConnect"/>
-    <Using Include="Microsoft.AspNetCore.Authentication.Cookies"/>
-    <Using Include="IdentityModel.AspNetCore.OAuth2Introspection"/>
+    <Using Include="Microsoft.AspNetCore.Authentication" />
+    <Using Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" />
+    <Using Include="Microsoft.AspNetCore.Authentication.Cookies" />
+    <Using Include="IdentityModel.AspNetCore.OAuth2Introspection" />
  </ItemGroup>

  <!-- API Versioning -->
@@ -66,7 +67,7 @@
  <!-- Quartz Scheduler-->
  <ItemGroup>    
    <PackageReference Include="Hashids.net" Version="1.7.0" />    
-    <PackageReference Include="Meziantou.Analyzer" Version="3.0.98">
+    <PackageReference Include="Meziantou.Analyzer" Version="3.0.101">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>    
@@ -170,8 +171,8 @@
  
  <!-- Amazon S3 SDK -->
  <ItemGroup>
-    <PackageReference Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.4.3" />
-    <PackageReference Include="AWSSDK.S3" Version="4.0.24" />
+    <PackageReference Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.4.4" />
+    <PackageReference Include="AWSSDK.S3" Version="4.0.24.1" />
    
    <!-- global Usings -->
    <Using Include="Amazon.S3" />
Author	SHA1	Message	Date
khwezi	0ad410c64e	Merge pull request 'payments' (#91 ) from payments into master Reviewed-on: #91	2026-06-07 13:57:15 +02:00
Khwezi Mngoma	e193aa7c1c	Adopted standard logout flow continuous-integration/drone/pr Build is running Details	2026-06-07 13:56:49 +02:00
Khwezi Mngoma	840d4568e2	Refactored logout process	2026-06-07 13:55:20 +02:00
khwezi	6e580ecdf6	Merge pull request 'Added token hint to logout event' (#90 ) from payments into master Reviewed-on: #90	2026-06-07 13:12:05 +02:00
Khwezi Mngoma	60095057b7	Added token hint to logout event continuous-integration/drone/pr Build is passing Details	2026-06-07 13:11:33 +02:00
khwezi	4c194c1141	Merge pull request 'Added AddSecurityEndpoints login endpoint' (#89 ) from payments into master Reviewed-on: #89	2026-06-07 12:00:50 +02:00
Khwezi Mngoma	b41136e2c7	Added AddSecurityEndpoints login endpoint continuous-integration/drone/pr Build is passing Details	2026-06-07 12:00:07 +02:00
khwezi	41eb4daeb4	Merge pull request 'Refactored AddSecurityEndpoints' (#88 ) from payments into master Reviewed-on: #88	2026-06-07 11:09:02 +02:00
Khwezi Mngoma	c423f04b42	Refactored AddSecurityEndpoints continuous-integration/drone/pr Build is passing Details	2026-06-07 11:08:05 +02:00
khwezi	7fe5f7aef3	Merge pull request 'Refactored client auth method' (#87 ) from payments into master Reviewed-on: #87	2026-06-07 10:33:33 +02:00
Khwezi Mngoma	a567fc7cd7	Refactored client auth method continuous-integration/drone/pr Build is passing Details	2026-06-07 10:30:56 +02:00
khwezi	31254932ae	Merge pull request 'Enabled api audience verification' (#86 ) from payments into master Reviewed-on: #86	2026-06-06 23:54:13 +02:00
Khwezi Mngoma	c53434a578	Enabled api audience verification continuous-integration/drone/pr Build is passing Details	2026-06-06 23:53:19 +02:00
khwezi	5a0aae8182	Merge pull request 'Disabled audience verification on jwt tokens' (#85 ) from payments into master Reviewed-on: #85	2026-06-06 21:50:48 +02:00
Khwezi Mngoma	3f3e0dbe88	Disabled audience verification on jwt tokens continuous-integration/drone/pr Build is passing Details	2026-06-06 21:49:32 +02:00
khwezi	8d8ebffabf	Merge pull request 'Removed required scope policy, no longer needed, audience covers the intent' (#84 ) from payments into master Reviewed-on: #84	2026-06-06 16:44:52 +02:00
Khwezi Mngoma	dc4addb43a	Removed required scope policy, no longer needed, audience covers the intent continuous-integration/drone/pr Build is passing Details	2026-06-06 16:44:22 +02:00
khwezi	e2d29261da	Merge pull request 'Updated API to use LiteCharms Security' (#83 ) from payments into master Reviewed-on: #83	2026-06-06 16:27:16 +02:00
Khwezi Mngoma	5d5b59d610	Updated API to use LiteCharms Security continuous-integration/drone/pr Build is passing Details	2026-06-06 16:26:27 +02:00
khwezi	f001b02633	Merge pull request 'Refactored to deal with cookie hell' (#82 ) from payments into master Reviewed-on: #82	2026-06-05 09:20:17 +02:00
Khwezi Mngoma	90a11dc65e	Refactored to deal with cookie hell continuous-integration/drone/pr Build is passing Details	2026-06-05 09:19:32 +02:00
khwezi	de955a96a8	Merge pull request 'Removed login proto handling' (#81 ) from payments into master Reviewed-on: #81	2026-06-05 08:56:17 +02:00
Khwezi Mngoma	cdf5cfb5cd	Removed login proto handling continuous-integration/drone/pr Build is passing Details	2026-06-05 08:55:31 +02:00
khwezi	c4d3bb4cdf	Merge pull request 'Simplified login process' (#80 ) from payments into master Reviewed-on: #80	2026-06-05 08:18:12 +02:00
Khwezi Mngoma	65f102f18a	Simplified login process continuous-integration/drone/pr Build is passing Details	2026-06-05 08:17:32 +02:00
khwezi	cdc80db214	Merge pull request 'Refactored logout endpoint' (#79 ) from payments into master Reviewed-on: #79	2026-06-05 08:15:50 +02:00
Khwezi Mngoma	4576b5aa2b	Refactored logout endpoint continuous-integration/drone/pr Build is passing Details	2026-06-05 08:15:13 +02:00
khwezi	3847927ace	Merge pull request 'Added port stripping' (#78 ) from payments into master Reviewed-on: #78	2026-06-05 07:37:16 +02:00
Khwezi Mngoma	d38d1dd059	Added port stripping continuous-integration/drone/pr Build is passing Details	2026-06-05 07:36:41 +02:00
khwezi	c27aba1954	Merge pull request 'Forcing login https proto on redirect' (#77 ) from payments into master Reviewed-on: #77	2026-06-05 06:40:33 +02:00
Khwezi Mngoma	e646d16053	Forcing login https proto on redirect continuous-integration/drone/pr Build is passing Details	2026-06-05 06:39:47 +02:00
khwezi	1c946dab26	Merge pull request 'Refactored security components' (#76 ) from payments into master Reviewed-on: #76	2026-06-05 05:44:47 +02:00
Khwezi Mngoma	20c3ad9569	Refactored security components continuous-integration/drone/pr Build is passing Details	2026-06-05 05:43:56 +02:00