using System.Net;

using System.Text.Json.Nodes;

using Microsoft.AspNetCore.Http.HttpResults;

using Microsoft.Extensions.Options;

namespace NpgsqlRestClient;

public class BearerTokenConfig

{

public string? Scheme { get; set; }

public string? RefreshPath { get; set; }

}

public class TokenRefreshAuth

{

public TokenRefreshAuth(BearerTokenConfig? bearerTokenConfig, WebApplication app, ILogger? logger)

{

var tokenConfig = bearerTokenConfig;

if (bearerTokenConfig is null ||

string.IsNullOrEmpty(bearerTokenConfig.RefreshPath) is true ||

string.IsNullOrEmpty(bearerTokenConfig.Scheme) is true)

{

return;

}

// Use local variables from parameters - no instance references captured

var refreshPath = bearerTokenConfig.RefreshPath;

var scheme = bearerTokenConfig.Scheme;

app.Use(async (context, next) =>

{

if (context.Request.Path.Equals(refreshPath, StringComparison.OrdinalIgnoreCase) is false)

{

await next(context);

return;

}

if (string.Equals(context.Request.Method, "POST", StringComparison.OrdinalIgnoreCase) is false)

{

await next(context);

return;

}

var bearerTokenOptions = app.Services.GetRequiredService<IOptionsMonitor<Microsoft.AspNetCore.Authentication.BearerToken.BearerTokenOptions>>();

var refreshTokenProtector = bearerTokenOptions.Get(scheme).RefreshTokenProtector;

var timeProvider = app.Services.GetRequiredService<TimeProvider>();

string refreshToken;

IResult result;

try

{

using var reader = new StreamReader(context.Request.Body);

var body = await reader.ReadToEndAsync();

var node = JsonNode.Parse(string.IsNullOrWhiteSpace(body) ? "{}" : body);

refreshToken = node!["refresh"]?.ToString() ?? throw new ArgumentException("refresh token is null");

}

catch (Exception ex)

{

logger?.LogError(ex, "Failed to read refresh token from request body.");

result = Results.BadRequest(context.Response);

await result.ExecuteAsync(context);

return;

}

var refreshTicket = refreshTokenProtector.Unprotect(refreshToken);

if (

(refreshTicket?.Properties?.ExpiresUtc is not { } expiresUtc || timeProvider.GetUtcNow() >= expiresUtc) ||

context.User.Identity?.IsAuthenticated is false)

{

result = Results.Challenge();

await result.ExecuteAsync(context);

return;

}

if (Results.SignIn(principal: context.User, authenticationScheme: scheme) is not SignInHttpResult signInResult)

{

logger?.LogError("Failed in constructing user identity for authentication.");

context.Response.StatusCode = (int)HttpStatusCode.InternalServerError;

return;

}

await signInResult.ExecuteAsync(context);

});

}

}