Web API: accept identity provider tokens next to the API-user JWT (3/7)

src/Business/Grand.Business.Authentication/Services/ApiAuthenticationService.cs

@@ -58,6 +58,11 @@ public virtual async Task<Customer> GetAuthenticatedCustomer()
         if (!authenticateResult.Succeeded)
             return null;
 
+        //only a ticket of the Bearer scheme itself carries claims GrandNode signed with its SecretKey; a result the
+        //scheme forwarded (a provider token handed to the Oidc scheme) names its customer through the OIDC link
+        if (authenticateResult.Ticket?.AuthenticationScheme != JwtBearerDefaults.AuthenticationScheme)
+            return null;
+
         //prefer the stable customer id (unambiguous with per-store identity), fall back to e-mail for old tokens
         var customerIdClaim = authenticateResult.Principal.Claims.FirstOrDefault(claim => claim.Type == "CustomerId");
         if (customerIdClaim != null)

src/Business/Grand.Business.Authentication/Services/JwtBearerAuthenticationService.cs

@@ -2,6 +2,8 @@
 using Grand.Business.Core.Interfaces.Customers;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Business.Authentication.Services;
 
 public class JwtBearerAuthenticationService : IJwtBearerAuthenticationService

src/Business/Grand.Business.Authentication/Services/OidcCustomerResolver.cs

@@ -159,7 +159,7 @@ private async Task<OidcCustomerResult> Register(string sub, string email, string
             LastActivityDateUtc = DateTime.UtcNow
         });
 
-        //the provider verified the e-mail and access comes from permissions an admin grants, so the store's e-mail
+        //access comes from permissions an admin grants (and the provider's e-mail check is configurable), so the store's e-mail
         //validation / admin approval does not apply; the account gets the Registered group only
         await _customerManagerService.RegisterCustomer(new RegistrationRequest(customer, normalizedEmail,
             normalizedEmail, CommonHelper.GenerateRandomDigitCode(20), PasswordFormat.Hashed, storeId));

src/Business/Grand.Business.Authentication/Startup/StartupApplication.cs

@@ -6,6 +6,8 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Business.Authentication.Startup;
 
 public class StartupApplication : IStartupApplication

src/Business/Grand.Business.Core/Interfaces/Authentication/IJwtBearerAuthenticationService.cs

@@ -2,6 +2,7 @@
 
 namespace Grand.Business.Core.Interfaces.Authentication;
 
+[Obsolete("API users with a shared SecretKey are deprecated - configure OidcResourceServer and use access tokens of your identity provider")]
 public interface IJwtBearerAuthenticationService
 {
     /// <summary>

src/Business/Grand.Business.Core/Interfaces/Authentication/IOidcDisabledPathProvider.cs

@@ -0,0 +1,13 @@
+namespace Grand.Business.Core.Interfaces.Authentication;
+
+/// <summary>
+///     Lets a module that can be switched off withdraw the paths it serves from OIDC protection while it is off. A
+///     protected resource on, under or over one of these paths is left out of the registry: a token there is never
+///     validated by the Oidc scheme, mapped to a customer or used to pin the store, and the resource is not published.
+///     Read once, when the registry is built, so the switch must be a startup setting. Register the implementation
+///     as a singleton.
+/// </summary>
+public interface IOidcDisabledPathProvider
+{
+    IEnumerable<string> GetDisabledPaths();
+}

src/Business/Grand.Business.Core/Interfaces/Customers/IUserApiService.cs

@@ -3,6 +3,7 @@
 
 namespace Grand.Business.Core.Interfaces.Customers;
 
+[Obsolete("API users with a shared SecretKey are deprecated - configure OidcResourceServer and use access tokens of your identity provider")]
 public interface IUserApiService
 {
     /// <summary>

src/Business/Grand.Business.Customers/Services/UserApiService.cs

@@ -5,6 +5,8 @@
 using Grand.Infrastructure.Extensions;
 using Grand.Mediator;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Business.Customers.Services;
 
 public class UserApiService : IUserApiService

src/Business/Grand.Business.Customers/Startup/StartupApplication.cs

@@ -11,6 +11,8 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Business.Customers.Startup;
 
 public class StartupApplication : IStartupApplication

src/Core/Grand.Domain/Customers/UserApi.cs

@@ -1,5 +1,6 @@
 namespace Grand.Domain.Customers;
 
+[Obsolete("API users with a shared SecretKey are deprecated - configure OidcResourceServer and use access tokens of your identity provider")]
 public class UserApi : BaseEntity
 {
     public string Email { get; set; }

src/Modules/Grand.Module.Api/Controllers/TokenController.cs

@@ -5,6 +5,8 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Module.Api.Controllers;
 
 [ApiController]

src/Modules/Grand.Module.Api/Filters/AuthorizeApiAdminAttribute.cs

@@ -2,6 +2,7 @@
 using Grand.Domain.Permissions;
 using Grand.Data;
 using Grand.Domain.Security;
+using Grand.Infrastructure.Configuration;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
@@ -31,7 +32,7 @@ public AuthorizeApiAdminAttribute(bool ignore = false) : base(typeof(AuthorizeAp
     ///     Represents a filter that confirms access to the admin panel
     /// </summary>
     private class AuthorizeApiAdminFilter(bool ignoreFilter, IPermissionService permissionService,
-        SecuritySettings securitySettings) : IAsyncAuthorizationFilter
+        SecuritySettings securitySettings, BackendAPIConfig backendApiConfig) : IAsyncAuthorizationFilter
     {
 
         #region Ctor
@@ -48,6 +49,14 @@ public async Task OnAuthorizationAsync(AuthorizationFilterContext filterContext)
         {
             ArgumentNullException.ThrowIfNull(filterContext);
 
+            //the kill switch also covers tokens forwarded to the OpenID Connect scheme, which skip the Bearer scheme's
+            //check; it applies to every action, including those that ignore the admin area checks below
+            if (!backendApiConfig.Enabled)
+            {
+                filterContext.Result = new ForbidResult(JwtBearerDefaults.AuthenticationScheme);
+                return;
+            }
+
             //check whether this filter has been overridden for the action
             var actionFilter = filterContext.ActionDescriptor.FilterDescriptors
                 .Where(f => f.Scope == FilterScope.Action)

src/Modules/Grand.Module.Api/Infrastructure/ApiAuthenticationRegistrar.cs

@@ -9,6 +9,8 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.IdentityModel.Tokens;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Module.Api.Infrastructure;
 
 public class ApiAuthenticationRegistrar : IAuthenticationBuilder

src/Modules/Grand.Module.Api/Infrastructure/ApiOidcDisabledPathProvider.cs

@@ -0,0 +1,15 @@
+using Grand.Business.Core.Interfaces.Authentication;
+using Grand.Infrastructure.Configuration;
+using Grand.Module.Api.Constants;
+
+namespace Grand.Module.Api.Infrastructure;
+
+/// <summary>
+///     While BackendAPI.Enabled is false the Web API's paths are withdrawn from OIDC protection, so an access token
+///     there is refused by the Bearer scheme before it is mapped to a customer or pins the store
+/// </summary>
+public class ApiOidcDisabledPathProvider(BackendAPIConfig config) : IOidcDisabledPathProvider
+{
+    public IEnumerable<string> GetDisabledPaths() =>
+        config.Enabled ? [] : ["/" + Configurations.RestRoutePrefix];
+}

src/Modules/Grand.Module.Api/Infrastructure/ApiSecurityStartup.cs

@@ -1,3 +1,4 @@
+using Grand.Business.Core.Interfaces.Authentication;
 using Grand.Infrastructure;
 using Grand.Infrastructure.Configuration;
 using Microsoft.AspNetCore.Builder;
@@ -65,6 +66,8 @@ private static bool IsStrong(string secret)
 
     public void ConfigureServices(IServiceCollection services, IConfiguration configuration)
     {
+        //a disabled Web API also refuses access tokens of the identity provider, before any customer is resolved
+        services.AddSingleton<IOidcDisabledPathProvider, ApiOidcDisabledPathProvider>();
     }
 
     public int Priority => 0;

src/Modules/Grand.Module.Api/Validators/Common/LoginValidator.cs

@@ -6,6 +6,8 @@
 using Grand.Infrastructure.Configuration;
 using Grand.Infrastructure.Validators;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Module.Api.Validators.Common;
 
 public class LoginValidator : BaseGrandValidator<LoginModel>

src/Modules/Grand.Module.Installer/Services/InstallationService.cs

@@ -39,6 +39,8 @@
 using Microsoft.Extensions.DependencyInjection;
 using System.Security.Cryptography;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Module.Installer.Services;
 
 public partial class InstallationService : IInstallationService

src/Modules/Grand.Module.Migration/Migrations/2.5/MigrationUpdateResourceString.cs

@@ -0,0 +1,16 @@
+using Grand.Infrastructure.Migrations;
+
+namespace Grand.Module.Migration.Migrations._2._5;
+
+public class MigrationUpdateResourceString : IMigration
+{
+    public int Priority => 0;
+    public DbVersion Version => new(2, 5);
+    public Guid Identity => new("15EDC88E-A865-4BA2-9E43-FB97839F1B92");
+    public string Name => "Update resource string for english language 2.5";
+
+    public bool UpgradeProcess(IServiceProvider serviceProvider)
+    {
+        return serviceProvider.ImportLanguageResourcesFromXml("App_Data/Resources/Upgrade/en_250.xml");
+    }
+}

src/Tests/Grand.Business.Authentication.Tests/Services/ApiAuthenticationServiceTests.cs

@@ -14,6 +14,8 @@
 using Moq;
 using System.Security.Claims;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Business.Authentication.Tests.Services;
 
 [TestClass]
@@ -235,6 +237,25 @@ public async Task GetAuthenticatedCustomer_JwtSchemeRegisteredAndSucceeds_Return
         Assert.AreSame(customer, result);
     }
 
+    [TestMethod]
+    public async Task GetAuthenticatedCustomer_BearerForwardedToOidc_ReturnsNull()
+    {
+        //a provider token the Bearer scheme forwards to the Oidc scheme: its CustomerId claim was not issued by GrandNode
+        var customer = new Customer { Id = "c1", Active = true };
+        _customerService.Setup(c => c.GetCustomerById("c1")).ReturnsAsync(customer);
+        _groupService.Setup(g => g.IsRegistered(customer)).ReturnsAsync(true);
+        var context = CreateHttpContext(b => b
+            .AddScheme<AuthenticationSchemeOptions, OkHandler>(JwtBearerDefaults.AuthenticationScheme,
+                o => o.ForwardDefault = "Oidc")
+            .AddScheme<AuthenticationSchemeOptions, OkHandler>("Oidc", null));
+
+        var result = await CreateService(context).GetAuthenticatedCustomer();
+
+        Assert.IsNull(result);
+        _customerService.Verify(c => c.GetCustomerById(It.IsAny<string>()), Times.Never);
+        _customerService.Verify(c => c.GetCustomerByEmail(It.IsAny<string>()), Times.Never);
+    }
+
     private class OkHandler : AuthenticationHandler<AuthenticationSchemeOptions>
     {
         public OkHandler(Microsoft.Extensions.Options.IOptionsMonitor<AuthenticationSchemeOptions> options,

src/Tests/Grand.Business.Customers.Tests/Services/UserApiServiceTests.cs

@@ -6,6 +6,8 @@
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 using Moq;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Business.Customers.Tests.Services;
 
 [TestClass]

src/Tests/Grand.Mapping.Tests/AdminShared/CustomerMappingTests.cs

@@ -8,6 +8,8 @@
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 using VerifyMSTest;
 
+#pragma warning disable CS0618 //API users stay supported until removed
+
 namespace Grand.Mapping.Tests.AdminShared;
 
 [TestClass]

src/Tests/Grand.Module.Api.Tests/Filters/AuthorizeApiAdminAttributeTests.cs

@@ -0,0 +1,88 @@
+using Grand.Business.Core.Interfaces.Common.Security;
+using Grand.Data;
+using Grand.Domain.Permissions;
+using Grand.Domain.Security;
+using Grand.Infrastructure.Configuration;
+using Grand.Module.Api.Filters;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Abstractions;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace Grand.Module.Api.Tests.Filters;
+
+[TestClass]
+public class AuthorizeApiAdminAttributeTests
+{
+    private Mock<IPermissionService> _permissionService;
+
+    [TestInitialize]
+    public void Init()
+    {
+        DataSettingsManager.Initialize(Path.Join(Path.GetTempPath(), "grand-api-tests-settings.json"));
+        DataSettingsManager.Instance.LoadDataSettings(new DataSettings { ConnectionString = "mongodb://localhost" });
+        _permissionService = new Mock<IPermissionService>();
+    }
+
+    private async Task<AuthorizationFilterContext> Run(bool apiEnabled, bool ignore, bool permitted)
+    {
+        _permissionService.Setup(x => x.Authorize(It.IsAny<Permission>())).ReturnsAsync(permitted);
+        var attribute = new AuthorizeApiAdminAttribute(ignore);
+        var filter = (IAsyncAuthorizationFilter)ActivatorUtilities.CreateInstance(
+            new ServiceCollection()
+                .AddSingleton(_permissionService.Object)
+                .AddSingleton(new SecuritySettings())
+                .AddSingleton(new BackendAPIConfig { Enabled = apiEnabled })
+                .BuildServiceProvider(),
+            attribute.ImplementationType, ignore);
+        var context = new AuthorizationFilterContext(
+            new ActionContext(new DefaultHttpContext(), new RouteData(), new ActionDescriptor()),
+            [new FilterDescriptor(attribute, FilterScope.Controller).Filter]);
+        context.Filters.Add((IFilterMetadata)filter);
+        await filter.OnAuthorizationAsync(context);
+        return context;
+    }
+
+    [TestMethod]
+    public async Task ApiDisabled_Forbid()
+    {
+        var context = await Run(apiEnabled: false, ignore: false, permitted: true);
+        Assert.IsInstanceOfType<ForbidResult>(context.Result);
+        _permissionService.Verify(x => x.Authorize(It.IsAny<Permission>()), Times.Never);
+    }
+
+    [TestMethod]
+    public async Task ApiDisabled_IgnoredAction_Forbid()
+    {
+        //ignore skips the admin panel checks, not the kill switch
+        var context = await Run(apiEnabled: false, ignore: true, permitted: true);
+        Assert.IsInstanceOfType<ForbidResult>(context.Result);
+    }
+
+    [TestMethod]
+    public async Task ApiEnabled_IgnoredAction_NoPermissionCheck()
+    {
+        var context = await Run(apiEnabled: true, ignore: true, permitted: false);
+        Assert.IsNull(context.Result);
+        _permissionService.Verify(x => x.Authorize(It.IsAny<Permission>()), Times.Never);
+    }
+
+    [TestMethod]
+    public async Task ApiEnabled_PermissionDenied_Forbid()
+    {
+        var context = await Run(apiEnabled: true, ignore: false, permitted: false);
+        Assert.IsInstanceOfType<ForbidResult>(context.Result);
+        _permissionService.Verify(x => x.Authorize(It.IsAny<Permission>()), Times.Once);
+    }
+
+    [TestMethod]
+    public async Task ApiEnabled_PermissionGranted_Allowed()
+    {
+        var context = await Run(apiEnabled: true, ignore: false, permitted: true);
+        Assert.IsNull(context.Result);
+    }
+}

src/Tests/Grand.Module.Api.Tests/Infrastructure/ApiOidcDisabledPathProviderTests.cs

@@ -0,0 +1,19 @@
+using Grand.Infrastructure.Configuration;
+using Grand.Module.Api.Infrastructure;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Grand.Module.Api.Tests.Infrastructure;
+
+[TestClass]
+public class ApiOidcDisabledPathProviderTests
+{
+    [TestMethod]
+    public void ApiDisabled_ApiPathWithdrawn() =>
+        CollectionAssert.AreEqual(new[] { "/api" },
+            new ApiOidcDisabledPathProvider(new BackendAPIConfig { Enabled = false }).GetDisabledPaths().ToList());
+
+    [TestMethod]
+    public void ApiEnabled_NothingWithdrawn() =>
+        Assert.AreEqual(0,
+            new ApiOidcDisabledPathProvider(new BackendAPIConfig { Enabled = true }).GetDisabledPaths().Count());
+}