OIDC resource server: token to customer mapping (2/7)

src/Business/Grand.Business.Authentication/Services/ExternalAuthenticationService.cs

@@ -310,7 +310,7 @@ public virtual async Task<Customer> GetCustomer(ExternalAuthParam parameters)
         ArgumentNullException.ThrowIfNull(parameters);
 
         var associationRecord = (from q in _externalAuthenticationRecordRepository.Table
-            where q.ExternalIdentifier.ToLowerInvariant() == parameters.Identifier
+            where q.ExternalIdentifier == parameters.Identifier
                   && q.ProviderSystemName.ToLowerInvariant() == parameters.ProviderSystemName.ToLowerInvariant()
             select q).FirstOrDefault();
 

src/Business/Grand.Business.Authentication/Startup/StartupApplication.cs

@@ -18,6 +18,7 @@ public void ConfigureServices(IServiceCollection services, IConfiguration config
         services.AddScoped<IJwtBearerAuthenticationService, JwtBearerAuthenticationService>();
         services.AddScoped<ITwoFactorAuthenticationService, TwoFactorAuthenticationService>();
         services.AddScoped<IExternalAuthenticationService, ExternalAuthenticationService>();
+        services.AddScoped<IOidcCustomerResolver, OidcCustomerResolver>();
         services.AddScoped<IJwtBearerCustomerAuthenticationService, JwtBearerCustomerAuthenticationService>();
         services.AddScoped<IRefreshTokenService, RefreshTokenService>();
     }

src/Business/Grand.Business.Core/Interfaces/Authentication/IOidcCustomerResolver.cs

@@ -0,0 +1,15 @@
+using Grand.Business.Core.Utilities.Authentication;
+using System.Security.Claims;
+
+namespace Grand.Business.Core.Interfaces.Authentication;
+
+/// <summary>
+///     Maps a validated access token of the identity provider to a customer: by the stored link to the token
+///     subject, on first use by the verified e-mail address, otherwise by registering one
+/// </summary>
+public interface IOidcCustomerResolver
+{
+    /// <param name="principal">Principal of the validated access token</param>
+    /// <param name="storeId">Store resolved from the request host</param>
+    Task<OidcCustomerResult> Resolve(ClaimsPrincipal principal, string storeId);
+}

src/Business/Grand.Business.Core/Utilities/Authentication/OidcCustomerResult.cs

@@ -0,0 +1,28 @@
+using Grand.Domain.Customers;
+
+namespace Grand.Business.Core.Utilities.Authentication;
+
+/// <summary>
+///     Outcome of mapping a validated access token to a customer
+/// </summary>
+public class OidcCustomerResult
+{
+    private OidcCustomerResult(Customer customer, OidcFailureKind? failure, string description)
+    {
+        Customer = customer;
+        Failure = failure;
+        Description = description;
+    }
+
+    public Customer Customer { get; }
+    public OidcFailureKind? Failure { get; }
+
+    /// <summary>Fixed, token-independent text safe for error_description</summary>
+    public string Description { get; }
+
+    public bool Succeeded => Customer != null;
+
+    public static OidcCustomerResult Success(Customer customer) => new(customer, null, null);
+    public static OidcCustomerResult InvalidToken(string description) => new(null, OidcFailureKind.InvalidToken, description);
+    public static OidcCustomerResult Forbidden(string description) => new(null, OidcFailureKind.Forbidden, description);
+}

src/Core/Grand.Domain/Customers/ExternalAuthentication.cs

@@ -34,4 +34,9 @@ public class ExternalAuthentication : BaseEntity
     ///     Gets or sets the provider
     /// </summary>
     public string ProviderSystemName { get; set; }
+
+    /// <summary>
+    ///     Gets or sets the store of the linked customer when customers are registered per store; empty otherwise
+    /// </summary>
+    public string StoreId { get; set; }
 }

src/Core/Grand.Infrastructure/Configuration/OidcResourceServerConfig.cs

@@ -18,14 +18,17 @@ public class OidcResourceServerConfig
     public OidcClaimNames Claims { get; set; } = new();
 
     /// <summary>
-    ///     An unverified e-mail address never links to an account and never registers one
+    ///     True: a token whose e-mail is not verified never links to an account and never registers one. False: the
+    ///     e-mail in the token is trusted as is, except that back-office accounts (admin panel access, vendor, store
+    ///     staff) are never linked by it
     /// </summary>
     public bool RequireEmailVerified { get; set; } = true;
 
     /// <summary>
-    ///     Register an unknown user (customer group Registered only)
+    ///     Register an unknown user on first use (customer group Registered only). Off by default: an account should exist,
+    ///     or be created through the store's registration, before a token can use it
     /// </summary>
-    public bool AutoRegister { get; set; } = true;
+    public bool AutoRegister { get; set; }
 
     public List<OidcProtectedResource> Resources { get; set; } = [];
 }

src/Modules/Grand.Module.Installer/Services/InstallationService.cs

@@ -908,6 +908,13 @@ await dbContext.CreateIndex(_permissionAction,
         //externalauth
         await dbContext.CreateIndex(_externalAuthenticationRepository,
             OrderBuilder<ExternalAuthentication>.Create().Ascending(x => x.CustomerId), CustomerId);
+        //unique: one customer per external identity and store (the store is set only when customers are registered
+        //per store) - makes linking an access token subject safe against concurrent requests (indexes are created
+        //for MongoDB only; LiteDB gets a non-unique one from the 2.5 migration)
+        await dbContext.CreateIndex(_externalAuthenticationRepository,
+            OrderBuilder<ExternalAuthentication>.Create().Ascending(x => x.ProviderSystemName)
+                .Ascending(x => x.ExternalIdentifier).Ascending(x => x.StoreId),
+            "ProviderSystemName_ExternalIdentifier_StoreId", true);
 
         //merchandise return
         await dbContext.CreateIndex(_merchandiseReturnRepository,

src/Modules/Grand.Module.Migration/Migrations/2.5/MigrationExternalAuthenticationIdentifierIndex.cs

@@ -0,0 +1,61 @@
+using Grand.Data;
+using Grand.Domain.Customers;
+using Grand.Infrastructure.Migrations;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+
+namespace Grand.Module.Migration.Migrations._2._5;
+
+public class MigrationExternalAuthenticationIdentifierIndex : IMigration
+{
+    private const string IndexName = "ProviderSystemName_ExternalIdentifier_StoreId";
+
+    //created by development builds of this migration, before identity links became per store
+    private const string PreviousIndexName = "ProviderSystemName_ExternalIdentifier";
+
+    public int Priority => 1;
+    public DbVersion Version => new(2, 5);
+    public Guid Identity => new("5d33a2b4-84d9-467b-8067-3b2fc2336225");
+    public string Name => "Unique index on ExternalAuthentication provider + external identifier + store";
+
+    public bool UpgradeProcess(IServiceProvider serviceProvider)
+    {
+        var repository = serviceProvider.GetRequiredService<IRepository<ExternalAuthentication>>();
+        var databaseContext = serviceProvider.GetRequiredService<IDatabaseContext>();
+        var logService = serviceProvider.GetRequiredService<ILogger<MigrationExternalAuthenticationIdentifierIndex>>();
+
+        try
+        {
+            var duplicates = repository.Table
+                .Select(x => new { x.ProviderSystemName, x.ExternalIdentifier, x.StoreId }).ToList()
+                //the same key as the index: a missing store and an empty one are different values
+                .GroupBy(x => (x.ProviderSystemName, x.ExternalIdentifier, x.StoreId))
+                .Where(x => x.Count() > 1)
+                .Select(x => $"{x.Key.ProviderSystemName}/{x.Key.ExternalIdentifier}/{x.Key.StoreId}")
+                .ToList();
+
+            //duplicates left by older external logins must not stop the upgrade - keep a non-unique index for the
+            //lookups and report them
+            //LiteDB indexes every field of a composite index on its own, so a unique flag would make each field unique
+            var isMongo = DataSettingsManager.Instance.LoadSettings().DbProvider == DbProvider.MongoDB;
+            var unique = duplicates.Count == 0 && isMongo;
+            if (duplicates.Count != 0)
+                logService.LogError(
+                    "The index {IndexName} was created as non-unique - these external identities are linked more than once: {Identities}. Remove the duplicates and recreate the index as unique",
+                    IndexName, string.Join(", ", duplicates));
+
+            //the two-field unique index would forbid a second link of the subject in another store
+            databaseContext.DeleteIndex(repository, PreviousIndexName).GetAwaiter().GetResult();
+            databaseContext.CreateIndex(repository,
+                OrderBuilder<ExternalAuthentication>.Create().Ascending(x => x.ProviderSystemName)
+                    .Ascending(x => x.ExternalIdentifier).Ascending(x => x.StoreId), IndexName, unique)
+                .GetAwaiter().GetResult();
+        }
+        catch (Exception ex)
+        {
+            logService.LogError(ex, "UpgradeProcess - ExternalAuthenticationIdentifierIndex (2.5)");
+        }
+
+        return true;
+    }
+}

src/Tests/Grand.Business.Authentication.Tests/Services/ExternalAuthenticationServiceTests.cs

@@ -131,6 +131,51 @@ await _externalAuthenticationService.AssociateCustomer(expectedCustomer,
         Assert.AreEqual(customer.Username, expectedCustomer.Username);
     }
 
+    [TestMethod]
+    public async Task GetCustomer_IdentifierWithUpperCaseLetters_IsFound()
+    {
+        var expectedCustomer = new Customer { Username = "John", Active = true };
+        _customerServiceMock.Setup(c => c.GetCustomerById(It.IsAny<string>()))
+            .Returns(() => Task.FromResult(expectedCustomer));
+        await _externalAuthenticationService.AssociateCustomer(expectedCustomer,
+            new ExternalAuthParam { ProviderSystemName = "ExternalAuthenticationProviderTest", Identifier = "AbC-123" });
+
+        var customer = await _externalAuthenticationService.GetCustomer(new ExternalAuthParam
+            { ProviderSystemName = "ExternalAuthenticationProviderTest", Identifier = "AbC-123" });
+
+        Assert.IsNotNull(customer);
+    }
+
+    [TestMethod]
+    public async Task GetCustomer_IdentifierInDifferentCase_IsNotFound()
+    {
+        var expectedCustomer = new Customer { Username = "John", Active = true };
+        _customerServiceMock.Setup(c => c.GetCustomerById(It.IsAny<string>()))
+            .Returns(() => Task.FromResult(expectedCustomer));
+        await _externalAuthenticationService.AssociateCustomer(expectedCustomer,
+            new ExternalAuthParam { ProviderSystemName = "ExternalAuthenticationProviderTest", Identifier = "AbC-123" });
+
+        var customer = await _externalAuthenticationService.GetCustomer(new ExternalAuthParam
+            { ProviderSystemName = "ExternalAuthenticationProviderTest", Identifier = "abc-123" });
+
+        Assert.IsNull(customer);
+    }
+
+    [TestMethod]
+    public async Task GetCustomer_ProviderSystemNameInDifferentCase_IsFound()
+    {
+        var expectedCustomer = new Customer { Username = "John", Active = true };
+        _customerServiceMock.Setup(c => c.GetCustomerById(It.IsAny<string>()))
+            .Returns(() => Task.FromResult(expectedCustomer));
+        await _externalAuthenticationService.AssociateCustomer(expectedCustomer,
+            new ExternalAuthParam { ProviderSystemName = "ExternalAuthenticationProviderTest", Identifier = "AbC-123" });
+
+        var customer = await _externalAuthenticationService.GetCustomer(new ExternalAuthParam
+            { ProviderSystemName = "externalauthenticationprovidertest", Identifier = "AbC-123" });
+
+        Assert.IsNotNull(customer);
+    }
+
     [TestMethod]
     public async Task GetExternalIdentifiersTest()
     {