feat: add authentication with JWT

server/.editorconfig

@@ -396,7 +396,7 @@ dotnet_diagnostic.S3400.severity = silent
 dotnet_diagnostic.S1135.severity = suggestion
 
 # --- Naming convention rules for unit tests ---
-[**/*Tests.cs]
+[**/*Test.cs]
 dotnet_diagnostic.CA1707.severity = none
 
 # E.g. <Method>_Should<ExpectedBehavior>_When<Condition>

server/.env.example

@@ -2,3 +2,4 @@ UsosOAuth__ConsumerKey=your-usos-consumer-key
 UsosOAuth__ConsumerSecret=your-usos-consumer-secret
 UsosOAuth__HashingKey=your-64-bytes-length-hashing-key-for-user-usos-id
 ConnectionStrings__DefaultConnection=Host=localhost;Port=5433;Database=putwiki;Username=postgres;Password=password
+Jwt__SecretKey=your-32-bytes-length-secret-key-for-signing-jwt-tokens

server/Application/Interfaces/IUnitOfWork.cs → server/Application/Abstractions/IUnitOfWork.cs

@@ -1,7 +1,7 @@
 using System.Threading;
 using System.Threading.Tasks;
 
-namespace Application.Interfaces;
+namespace Application.Abstractions;
 
 public interface IUnitOfWork
 {

server/Application/Abstractions/IUserContext.cs

@@ -0,0 +1,9 @@
+using System;
+
+namespace Application.Abstractions;
+
+public interface IUserContext
+{
+    bool IsAuthenticated { get; }
+    Guid UserId { get; }
+}

server/Application/Auth/IUserSessionService.cs

@@ -0,0 +1,10 @@
+using System;
+using System.Threading.Tasks;
+
+namespace Application.Auth;
+
+public interface IUserSessionService
+{
+    JwtTokenPair CreateSession(Guid userId);
+    Task<JwtTokenPair?> RefreshSession(string rawRefreshTokenString);
+}

server/Application/Auth/JwtTokenPair.cs

@@ -0,0 +1,3 @@
+namespace Application.Auth;
+
+public record JwtTokenPair(string AccessToken, string RefreshToken);

server/Application/Extensions/ApplicationConfiguration.cs

@@ -1,5 +1,6 @@
-using Application.Features.AcademicTeachers.Queries;
+using Application.Features.AcademicTeachers.Queries;
 using Application.Features.Users.Commands.ProvisionUser;
+using Application.Features.Users.Commands.RefreshUserSession;
 using Application.Features.Users.Commands.UpdateNickname;
 using Application.Mappings;
 
@@ -17,6 +18,8 @@ public static IServiceCollection AddApplication(this IServiceCollection services
         });
 
         services.AddScoped<ProvisionUserCommandHandler>();
+        services.AddScoped<RefreshSessionCommandHandler>();
+
         services.AddScoped<GetAcademicTeacherQueryHandler>();
         services.AddScoped<UpdateNicknameCommandHandler>();
 

server/Application/Features/AcademicTeachers/Queries/AcademicTeacherDto.cs → server/Application/Features/AcademicTeachers/Queries/AcademicTeacherResponse.cs

@@ -1,6 +1,6 @@
 namespace Application.Features.AcademicTeachers.Queries;
 
-public record AcademicTeacherDto(
+public record AcademicTeacherResponse(
     string Id,
     string Slug,
     AcademicTeacherBaseInfoDto BaseInfo,

server/Application/Features/AcademicTeachers/Queries/GetAcademicTeacherQueryHandler.cs

@@ -9,7 +9,7 @@ namespace Application.Features.AcademicTeachers.Queries;
 
 public class GetAcademicTeacherQueryHandler(IAcademicTeacherQueryService queryService)
 {
-    public async Task<Result<AcademicTeacherDto>> ExecuteAsync(GetAcademicTeacherQuery query,
+    public async Task<Result<AcademicTeacherResponse>> ExecuteAsync(GetAcademicTeacherQuery query,
         CancellationToken ct = default)
     {
         var teacherDto = await queryService.GetAcademicTeacherByIdAsync(query.Id, ct);

server/Application/Features/AcademicTeachers/Queries/IAcademicTeacherQueryService.cs

@@ -6,5 +6,5 @@ namespace Application.Features.AcademicTeachers.Queries;
 
 public interface IAcademicTeacherQueryService
 {
-    Task<AcademicTeacherDto?> GetAcademicTeacherByIdAsync(Guid id, CancellationToken ct = default);
+    Task<AcademicTeacherResponse?> GetAcademicTeacherByIdAsync(Guid id, CancellationToken ct = default);
 }

server/Application/Features/Users/Commands/ProvisionUser/ProvisionUserCommandHandler.cs

@@ -2,11 +2,9 @@
 using System.Threading;
 using System.Threading.Tasks;
 
+using Application.Abstractions;
 using Application.Auth;
 using Application.Errors;
-using Application.Interfaces;
-
-using AutoMapper;
 
 using Domain.Users;
 
@@ -22,11 +20,11 @@ public partial class ProvisionUserCommandHandler(
     IUserRepository userRepository,
     IUnitOfWork unitOfWork,
     ILogger<ProvisionUserCommandHandler> logger,
-    IMapper mapper,
-    TimeProvider timeProvider)
+    TimeProvider timeProvider,
+    IUserSessionService userSessionService)
 {
 
-    public async Task<Result<UserDto>> ExecuteAsync(ProvisionUserCommand cmd,
+    public async Task<Result<JwtTokenPair>> ExecuteAsync(ProvisionUserCommand cmd,
         CancellationToken ct = default)
     {
         var usosResult = await usosOAuthService.HandleCallbackAndGetUserAsync(cmd.OauthToken, cmd.OauthVerifier, ct);
@@ -44,24 +42,31 @@ public async Task<Result<UserDto>> ExecuteAsync(ProvisionUserCommand cmd,
         var rawUsosId = usosResult.Value.Id;
         var hashedId = hasher.Hash(rawUsosId);
 
-        var existingUser = await userRepository.GetByHashedUsosIdAsync(hashedId, ct);
-        if (existingUser != null)
+        var user = await userRepository.GetByHashedUsosIdAsync(hashedId, ct);
+        if (user is null)
+        {
+            user = User.Create(hashedId, timeProvider.GetUtcNow());
+            userRepository.Add(user);
+            LogProvisionedNewUser(user.Id);
+        }
+        else
         {
-            return Result.Ok(mapper.Map<UserDto>(existingUser));
+            LogUserLoggedIn(user.Id);
         }
 
-        var newUser = User.Create(hashedId, timeProvider.GetUtcNow());
-        userRepository.Add(newUser);
-        await unitOfWork.SaveChangesAsync(ct);
+        var tokens = userSessionService.CreateSession(user.Id);
 
-        LogProvisionedNewAnonymousUserId(newUser.Id);
+        await unitOfWork.SaveChangesAsync(ct);
 
-        return Result.Ok(mapper.Map<UserDto>(newUser));
+        return Result.Ok(new JwtTokenPair(tokens.AccessToken, tokens.RefreshToken));
     }
 
     [LoggerMessage(LogLevel.Warning, "Provisioning aborted: USOS authentication failed. Error: {error}")]
     partial void LogProvisioningAbortedUsosAuthenticationFailed(string error);
 
-    [LoggerMessage(LogLevel.Information, "Provisioned new anonymous user {userId}")]
-    partial void LogProvisionedNewAnonymousUserId(Guid userId);
+    [LoggerMessage(LogLevel.Information, "Provisioned new user with id: {userId}")]
+    partial void LogProvisionedNewUser(Guid userId);
+
+    [LoggerMessage(LogLevel.Information, "User with id: {userId} has logged in")]
+    partial void LogUserLoggedIn(Guid userId);
 }

server/Application/Features/Users/Commands/RefreshUserSession/RefreshSessionCommand.cs

@@ -0,0 +1,3 @@
+namespace Application.Features.Users.Commands.RefreshUserSession;
+
+public record RefreshSessionCommand(string RefreshToken);

server/Application/Features/Users/Commands/RefreshUserSession/RefreshSessionCommandHandler.cs

@@ -0,0 +1,28 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+using Application.Abstractions;
+using Application.Auth;
+using Application.Errors;
+
+using FluentResults;
+
+namespace Application.Features.Users.Commands.RefreshUserSession;
+
+public class RefreshSessionCommandHandler(
+    IUserSessionService userSessionService,
+    IUnitOfWork unitOfWork)
+{
+    public async Task<Result<JwtTokenPair>> ExecuteAsync(RefreshSessionCommand cmd, CancellationToken ct)
+    {
+        var newPair = await userSessionService.RefreshSession(cmd.RefreshToken);
+        if (newPair is null)
+        {
+            return Result.Fail(new UnauthorizedError("Cannot refresh user's session"));
+        }
+
+        await unitOfWork.SaveChangesAsync(ct);
+
+        return Result.Ok(newPair);
+    }
+}

server/Application/Features/Users/Commands/UpdateNickname/UpdateNicknameCommandHandler.cs

@@ -2,8 +2,8 @@
 using System.Threading;
 using System.Threading.Tasks;
 
+using Application.Abstractions;
 using Application.Errors;
-using Application.Interfaces;
 
 using Domain.Users;
 

server/Application/Mappings/MappingsProfile.cs

@@ -8,8 +8,5 @@ namespace Application.Mappings;
 
 public class MappingsProfile : Profile
 {
-    public MappingsProfile()
-    {
-        CreateMap<User, UserDto>();
-    }
+    public MappingsProfile() { }
 }

server/Application/packages.lock.json

@@ -24,11 +24,11 @@
       },
       "FluentValidation.DependencyInjectionExtensions": {
         "type": "Direct",
-        "requested": "[12.1.1, )",
-        "resolved": "12.1.1",
-        "contentHash": "D0VXh4dtjjX2aQizuaa0g6R8X3U1JaVqJPfGCvLwZX9t/O2h7tkpbitbadQMfwcgSPdDbI2vDxuwRMv/Uf9dHA==",
+        "requested": "[12.2.0, )",
+        "resolved": "12.2.0",
+        "contentHash": "QpKXgiO9E6wXCh19X2Musn8MZM0xt7KQt/QrD6GDBn3MCUfy8a+rkhCzrYJNCfoxTsTRQ7bpKP8T3geTnJNNeQ==",
         "dependencies": {
-          "FluentValidation": "12.1.1",
+          "FluentValidation": "12.2.0",
           "Microsoft.Extensions.DependencyInjection.Abstractions": "2.1.0"
         }
       },
@@ -57,8 +57,8 @@
       },
       "FluentValidation": {
         "type": "Transitive",
-        "resolved": "12.1.1",
-        "contentHash": "EPpkIe1yh1a0OXyC100oOA8WMbZvqUu5plwhvYcb7oSELfyUZzfxV48BLhvs3kKo4NwG7MGLNgy1RJiYtT8Dpw=="
+        "resolved": "12.2.0",
+        "contentHash": "DR3lFbdnKucaaj1/8zMNOACMz/64igzox1yVZSFVsLxYB5mxAB+wFP1WZ8fjwrZnbU1KA1DoMzHKYKxUfuZ4wQ=="
       },
       "Microsoft.Extensions.DependencyInjection.Abstractions": {
         "type": "Transitive",

server/Directory.Packages.props

@@ -10,15 +10,18 @@
     <PackageVersion Include="FluentAssertions" Version="8.11.0" />
     <PackageVersion Include="FluentResults" Version="4.0.0" />
     <PackageVersion Include="FluentResults.Extensions.FluentAssertions" Version="2.2.1" />
-    <PackageVersion Include="FluentValidation.DependencyInjectionExtensions" Version="12.1.1" />
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.14" />
+    <PackageVersion Include="FluentValidation.DependencyInjectionExtensions" Version="12.2.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.13" />
+
     <!-- NOTE: pins ef core to the same version in entire solution -->
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12">
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.13" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.13" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.13">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageVersion>
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.13" />
     <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.11.0" />
     <PackageVersion Include="Moq" Version="4.21.0" />
     <PackageVersion Include="Npgsql" Version="10.0.3" />

server/Infrastructure/AppDbContext.cs

@@ -1,26 +1,25 @@
-using Application.Interfaces;
+using Application.Abstractions;
 
 using Domain.AcademicTeachers;
 using Domain.Users;
 
-using Infrastructure.EntitiesConfiguration;
+using Infrastructure.Auth;
 
 using Microsoft.EntityFrameworkCore;
 
 namespace Infrastructure;
 
 public class AppDbContext(DbContextOptions<AppDbContext> options) : DbContext(options), IUnitOfWork
 {
-    public required DbSet<User> Users { get; set; }
-    public required DbSet<AcademicTeacher> AcademicTeachers { get; set; }
+    public DbSet<User> Users => Set<User>();
+    public DbSet<AcademicTeacher> AcademicTeachers => Set<AcademicTeacher>();
+    public virtual DbSet<RefreshToken> RefreshTokens => Set<RefreshToken>();
 
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {
         base.OnModelCreating(modelBuilder);
-
         modelBuilder.HasPostgresExtension("citext");
 
-        new UserEntityTypeConfiguration().Configure(modelBuilder.Entity<User>());
-        new AcademicTeacherEntityTypeConfiguration().Configure(modelBuilder.Entity<AcademicTeacher>());
+        modelBuilder.ApplyConfigurationsFromAssembly(typeof(AppDbContext).Assembly);
     }
 }

server/Infrastructure/Auth/Configuration/JwtSettings.cs

@@ -0,0 +1,14 @@
+using System;
+
+namespace Infrastructure.Auth.Configuration;
+
+public class JwtSettings
+{
+    public const string SectionName = "Jwt";
+
+    public string Issuer { get; set; } = string.Empty;
+    public string Audience { get; set; } = string.Empty;
+    public string SecretKey { get; set; } = string.Empty;
+    public TimeSpan AccessTokenLifetime { get; set; } = TimeSpan.FromMinutes(30);
+    public TimeSpan RefreshTokenLifetime { get; set; } = TimeSpan.FromDays(7);
+}

server/Infrastructure/Auth/Configuration/JwtTokensSettingsValidator.cs

@@ -0,0 +1,26 @@
+using FluentValidation;
+
+namespace Infrastructure.Auth.Configuration;
+
+public class JwtTokensSettingsValidator : AbstractValidator<JwtSettings>
+{
+    public JwtTokensSettingsValidator()
+    {
+        RuleFor(x => x.Issuer)
+            .NotEmpty()
+            .WithMessage("Missing issuer name.");
+
+        RuleFor(x => x.Audience)
+            .NotEmpty()
+            .WithMessage("Missing audience name.");
+
+        RuleFor(x => x.SecretKey)
+            .NotEmpty()
+            .WithMessage("Missing jwt signing key.");
+
+        RuleFor(x => x.SecretKey)
+            .MinimumLength(32)
+            .Matches("[a-zA-Z0-9]")
+            .WithMessage("Jwt signing key should be at least 32 ASCII characters (bytes) long.");
+    }
+}

server/Infrastructure/Auth/Configuration/UsosOAuthSettings.cs

@@ -2,6 +2,8 @@ namespace Infrastructure.Auth.Configuration;
 
 public class UsosOAuthSettings
 {
+    public const string SectionName = "UsosOAuth";
+
     public string ConsumerKey { get; set; } = string.Empty;
     public string ConsumerSecret { get; set; } = string.Empty;
     public string BaseUrl { get; set; } = string.Empty;

server/Infrastructure/Auth/Configuration/UsosOAuthSettingsValidator.cs

@@ -34,5 +34,10 @@ public UsosOAuthSettingsValidator()
         RuleFor(x => x.HashingKey)
             .NotEmpty()
             .WithMessage("Missing user's usos id hashing key.");
+
+        RuleFor(x => x.HashingKey)
+            .Length(64)
+            .Matches("[a-zA-Z0-9]")
+            .WithMessage("Hashing key should be exactly 64 ASCII characters (bytes) long.");
     }
 }