feat: use authentication and authorization

CarlosPavajeau · Jun 9, 2021 · aee7ec3 · aee7ec3
1 parent 4607f59
commit aee7ec3
Show file tree

Hide file tree

Showing 4 changed files with 61 additions and 9 deletions.
diff --git a/src/Armory.Api/Controllers/ArmoryUsers/ArmoryUsersController.cs b/src/Armory.Api/Controllers/ArmoryUsers/ArmoryUsersController.cs
@@ -11,12 +11,14 @@
 using Armory.Users.Application.GeneratePasswordResetToken;
 using Armory.Users.Application.ResetPassword;
 using Armory.Users.Domain;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Armory.Api.Controllers.ArmoryUsers
 {
     [ApiController]
+    [Authorize]
     [Route("[controller]")]
     public class ArmoryUsersController : ControllerBase
     {
@@ -40,6 +42,7 @@ private IActionResult IdentityErrors(IEnumerable<IdentityError> errors)
         }
 
         [HttpPost]
+        [AllowAnonymous]
         public async Task<IActionResult> RegisterUser([FromBody] CreateArmoryUserRequest request)
         {
             try
@@ -63,6 +66,7 @@ private IActionResult ArmoryUserNotFound(string usernameOrEmail)
         }
 
         [HttpPost("[action]/{userNameOrEmail}")]
+        [AllowAnonymous]
         public async Task<IActionResult> ForgottenPassword(string userNameOrEmail)
         {
             var response = await _queryBus.Ask<PasswordResetTokenResponse>(
@@ -73,6 +77,7 @@ public async Task<IActionResult> ForgottenPassword(string userNameOrEmail)
         }
 
         [HttpPost("[action]/{usernameOrEmail}")]
+        [AllowAnonymous]
         public async Task<IActionResult> ResetPassword(string usernameOrEmail, [FromBody] ResetPasswordRequest request)
         {
             try

diff --git a/src/Armory.Api/Controllers/ArmoryUsers/Authentication/AuthenticationController.cs b/src/Armory.Api/Controllers/ArmoryUsers/Authentication/AuthenticationController.cs
@@ -5,11 +5,13 @@
 using Armory.Users.Application.GenerateJwt;
 using Armory.Users.Application.Logout;
 using Armory.Users.Domain;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Armory.Api.Controllers.ArmoryUsers.Authentication
 {
     [ApiController]
+    [Authorize]
     [Route("[controller]")]
     public class AuthenticationController : ControllerBase
     {
@@ -23,6 +25,7 @@ public AuthenticationController(ICommandBus commandBus, IQueryBus queryBus)
         }
 
         [HttpPost]
+        [AllowAnonymous]
         public async Task<ActionResult<string>> Authenticate([FromBody] AuthenticationRequest request)
         {
             try

diff --git a/src/Armory.Api/Extensions/Infrastructure.cs b/src/Armory.Api/Extensions/Infrastructure.cs
@@ -1,3 +1,4 @@
+using System;
 using Armory.Shared.Domain.Bus.Command;
 using Armory.Shared.Domain.Bus.Event;
 using Armory.Shared.Domain.Bus.Query;
@@ -8,10 +9,12 @@
 using Armory.Users.Infrastructure.Identity;
 using Armory.Users.Infrastructure.Persistence;
 using Armory.Users.Infrastructure.Persistence.EntityFramework;
+using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.OpenApi.Models;
 
 namespace Armory.Api.Extensions
 {
@@ -41,5 +44,50 @@ public static IServiceCollection AddInfrastructure(this IServiceCollection servi
 
             return services;
         }
+
+        public static IServiceCollection AddSwagger(this IServiceCollection services)
+        {
+            services.AddSwaggerGen(c =>
+            {
+                c.SwaggerDoc("v1", new OpenApiInfo {Title = "Armory.Api", Version = "v1"});
+
+                c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
+                {
+                    Description =
+                        "JWT Authorization header using the Bearer scheme. Example 'Authorization: Bearer {token}'",
+                    Name = "Authorization",
+                    In = ParameterLocation.Header,
+                    Type = SecuritySchemeType.ApiKey
+                });
+
+                c.AddSecurityRequirement(new OpenApiSecurityRequirement
+                {
+                    {
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = "Bearer"
+                            },
+                            Scheme = "oauth2",
+                            Name = "Bearer",
+                            In = ParameterLocation.Header
+                        },
+                        ArraySegment<string>.Empty
+                    }
+                });
+            });
+
+            return services;
+        }
+
+        public static IApplicationBuilder UseSwaggerDocumentation(this IApplicationBuilder app)
+        {
+            app.UseSwagger();
+            app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "Armory.Api v1"));
+
+            return app;
+        }
     }
 }
diff --git a/src/Armory.Api/Startup.cs b/src/Armory.Api/Startup.cs
@@ -4,7 +4,6 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
-using Microsoft.OpenApi.Models;
 
 namespace Armory.Api
 {
@@ -21,12 +20,9 @@ public Startup(IConfiguration configuration)
         public void ConfigureServices(IServiceCollection services)
         {
             services.AddControllers();
-            services.AddApplication();
-            services.AddInfrastructure(Configuration);
-            services.AddSwaggerGen(c =>
-            {
-                c.SwaggerDoc("v1", new OpenApiInfo {Title = "Armory.Api", Version = "v1"});
-            });
+            services.AddApplication()
+                .AddInfrastructure(Configuration)
+                .AddSwagger();
         }
 
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
@@ -35,14 +31,14 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
             if (env.IsDevelopment())
             {
                 app.UseDeveloperExceptionPage();
-                app.UseSwagger();
-                app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "Armory.Api v1"));
+                app.UseSwaggerDocumentation();
             }
 
             app.UseHttpsRedirection();
 
             app.UseRouting();
 
+            app.UseAuthentication();
             app.UseAuthorization();
 
             app.UseEndpoints(endpoints => { endpoints.MapControllers(); });