| | | 1 | | using Elsa.Common; |
| | | 2 | | using Elsa.ExternalAuthentication.Contracts; |
| | | 3 | | using Elsa.ExternalAuthentication.Models; |
| | | 4 | | using Elsa.ExternalAuthentication.Services; |
| | | 5 | | |
| | | 6 | | namespace Elsa.ExternalAuthentication.Stores.InMemory; |
| | | 7 | | |
| | 37 | 8 | | public sealed class InMemoryExternalAuthenticationSessionStore(ISystemClock clock) : IExternalAuthenticationSessionStore |
| | | 9 | | { |
| | 37 | 10 | | private readonly object _syncRoot = new(); |
| | 37 | 11 | | private readonly Dictionary<string, ExternalAuthenticationSession> _sessions = new(StringComparer.Ordinal); |
| | | 12 | | |
| | | 13 | | public ValueTask<IReadOnlyCollection<ExternalAuthenticationSession>> FindAsync(ExternalAuthenticationSessionFilter f |
| | | 14 | | { |
| | 3 | 15 | | ArgumentNullException.ThrowIfNull(filter); |
| | 3 | 16 | | cancellationToken.ThrowIfCancellationRequested(); |
| | | 17 | | |
| | 3 | 18 | | lock (_syncRoot) |
| | | 19 | | { |
| | 3 | 20 | | var sessions = _sessions.Values |
| | 5 | 21 | | .Where(x => string.Equals(x.TenantId, filter.TenantId, StringComparison.Ordinal)) |
| | 3 | 22 | | .Where(x => filter.UserId is null || string.Equals(x.UserId, filter.UserId, StringComparison.Ordinal)) |
| | 3 | 23 | | .Where(x => filter.ConnectionKey is null || string.Equals(x.ConnectionKey, ConnectionRevisionCalculator. |
| | 3 | 24 | | .Where(x => filter.Status is null || |
| | 3 | 25 | | filter.Status.Equals("active", StringComparison.OrdinalIgnoreCase) && x.RevokedAt is null || |
| | 3 | 26 | | filter.Status.Equals("revoked", StringComparison.OrdinalIgnoreCase) && x.RevokedAt is not null) |
| | 3 | 27 | | .Select(Clone) |
| | 3 | 28 | | .ToArray(); |
| | 3 | 29 | | return ValueTask.FromResult<IReadOnlyCollection<ExternalAuthenticationSession>>(sessions); |
| | | 30 | | } |
| | 3 | 31 | | } |
| | | 32 | | |
| | | 33 | | public ValueTask<ExternalAuthenticationSession?> FindByIdAsync(string sessionId, CancellationToken cancellationToken |
| | | 34 | | { |
| | 8 | 35 | | cancellationToken.ThrowIfCancellationRequested(); |
| | | 36 | | |
| | 8 | 37 | | lock (_syncRoot) |
| | 8 | 38 | | return ValueTask.FromResult(_sessions.TryGetValue(sessionId, out var session) ? Clone(session) : null); |
| | 8 | 39 | | } |
| | | 40 | | |
| | | 41 | | public ValueTask<ExternalAuthenticationSession?> FindByRefreshTokenHashAsync(string refreshTokenHash, CancellationTo |
| | | 42 | | { |
| | 1 | 43 | | cancellationToken.ThrowIfCancellationRequested(); |
| | | 44 | | |
| | 1 | 45 | | if (string.IsNullOrWhiteSpace(refreshTokenHash)) |
| | 1 | 46 | | return ValueTask.FromResult<ExternalAuthenticationSession?>(null); |
| | | 47 | | |
| | 0 | 48 | | lock (_syncRoot) |
| | 0 | 49 | | return ValueTask.FromResult(_sessions.Values.FirstOrDefault(x => string.Equals(x.CurrentRefreshTokenHash, re |
| | 0 | 50 | | } |
| | | 51 | | |
| | | 52 | | public ValueTask SaveAsync(ExternalAuthenticationSession session, CancellationToken cancellationToken = default) |
| | | 53 | | { |
| | 15 | 54 | | cancellationToken.ThrowIfCancellationRequested(); |
| | | 55 | | |
| | 15 | 56 | | lock (_syncRoot) |
| | 15 | 57 | | _sessions[session.Id] = Clone(session); |
| | | 58 | | |
| | 15 | 59 | | return ValueTask.CompletedTask; |
| | | 60 | | } |
| | | 61 | | |
| | | 62 | | public ValueTask<ExternalAuthenticationSessionRotationResult> TryRotateRefreshTokenAsync(string sessionId, string re |
| | | 63 | | { |
| | 24 | 64 | | cancellationToken.ThrowIfCancellationRequested(); |
| | | 65 | | |
| | 24 | 66 | | lock (_syncRoot) |
| | | 67 | | { |
| | 24 | 68 | | if (!_sessions.TryGetValue(sessionId, out var session)) |
| | 0 | 69 | | return ValueTask.FromResult<ExternalAuthenticationSessionRotationResult>(new ExternalAuthenticationSessi |
| | | 70 | | |
| | 24 | 71 | | if (session.RevokedAt != null) |
| | 15 | 72 | | return ValueTask.FromResult<ExternalAuthenticationSessionRotationResult>(new ExternalAuthenticationSessi |
| | | 73 | | |
| | 9 | 74 | | if (session.ExpiresAt <= clock.UtcNow || session.RefreshExpiresAt <= clock.UtcNow) |
| | | 75 | | { |
| | 1 | 76 | | session.RevokedAt = clock.UtcNow; |
| | 1 | 77 | | session.RevocationReason = "expired"; |
| | 1 | 78 | | session.ProtectedUpstreamLogoutHint = null; |
| | 1 | 79 | | return ValueTask.FromResult<ExternalAuthenticationSessionRotationResult>(new ExternalAuthenticationSessi |
| | | 80 | | } |
| | | 81 | | |
| | 8 | 82 | | if (session.CurrentRefreshTokenHash is null || !string.Equals(session.CurrentRefreshTokenHash, refreshTokenH |
| | | 83 | | { |
| | 3 | 84 | | session.RevokedAt = clock.UtcNow; |
| | 3 | 85 | | session.RevocationReason = "refresh_token_reuse"; |
| | 3 | 86 | | session.ProtectedUpstreamLogoutHint = null; |
| | 3 | 87 | | return ValueTask.FromResult<ExternalAuthenticationSessionRotationResult>(new ExternalAuthenticationSessi |
| | | 88 | | } |
| | | 89 | | |
| | 5 | 90 | | session.CurrentRefreshTokenHash = nextRefreshTokenHash; |
| | 5 | 91 | | session.RefreshGeneration++; |
| | 5 | 92 | | session.LastRefreshedAt = refreshedAt; |
| | 5 | 93 | | return ValueTask.FromResult<ExternalAuthenticationSessionRotationResult>(new ExternalAuthenticationSessionRo |
| | | 94 | | } |
| | 24 | 95 | | } |
| | | 96 | | |
| | | 97 | | public ValueTask<bool> RevokeAsync(string sessionId, string reason, DateTimeOffset revokedAt, CancellationToken canc |
| | | 98 | | { |
| | 4 | 99 | | cancellationToken.ThrowIfCancellationRequested(); |
| | | 100 | | |
| | 4 | 101 | | lock (_syncRoot) |
| | | 102 | | { |
| | 4 | 103 | | if (!_sessions.TryGetValue(sessionId, out var session) || session.RevokedAt != null) |
| | 1 | 104 | | return ValueTask.FromResult(false); |
| | | 105 | | |
| | 3 | 106 | | session.RevokedAt = revokedAt; |
| | 3 | 107 | | session.RevocationReason = reason; |
| | 3 | 108 | | session.ProtectedUpstreamLogoutHint = null; |
| | 3 | 109 | | return ValueTask.FromResult(true); |
| | | 110 | | } |
| | 4 | 111 | | } |
| | | 112 | | |
| | | 113 | | public ValueTask<int> RevokeActiveForConnectionAsync(string connectionKey, string reason, DateTimeOffset revokedAt, |
| | | 114 | | { |
| | 0 | 115 | | ArgumentException.ThrowIfNullOrWhiteSpace(connectionKey); |
| | 0 | 116 | | cancellationToken.ThrowIfCancellationRequested(); |
| | 0 | 117 | | var normalizedConnectionKey = ConnectionRevisionCalculator.NormalizeKey(connectionKey); |
| | | 118 | | |
| | 0 | 119 | | lock (_syncRoot) |
| | | 120 | | { |
| | 0 | 121 | | var count = 0; |
| | 0 | 122 | | foreach (var session in _sessions.Values.Where(x => x.RevokedAt is null && string.Equals(x.ConnectionKey, no |
| | | 123 | | { |
| | 0 | 124 | | session.RevokedAt = revokedAt; |
| | 0 | 125 | | session.RevocationReason = reason; |
| | 0 | 126 | | session.ProtectedUpstreamLogoutHint = null; |
| | 0 | 127 | | count++; |
| | | 128 | | } |
| | | 129 | | |
| | 0 | 130 | | return ValueTask.FromResult(count); |
| | | 131 | | } |
| | 0 | 132 | | } |
| | | 133 | | |
| | 30 | 134 | | private static ExternalAuthenticationSession Clone(ExternalAuthenticationSession session) => new() |
| | 30 | 135 | | { |
| | 30 | 136 | | Id = session.Id, |
| | 30 | 137 | | AuthenticationClientId = session.AuthenticationClientId, |
| | 30 | 138 | | TenantId = session.TenantId, |
| | 30 | 139 | | UserId = session.UserId, |
| | 30 | 140 | | ConnectionKey = session.ConnectionKey, |
| | 30 | 141 | | ConnectionMaterialRevision = session.ConnectionMaterialRevision, |
| | 30 | 142 | | SecretGenerationFingerprint = session.SecretGenerationFingerprint, |
| | 30 | 143 | | Issuer = session.Issuer, |
| | 30 | 144 | | SubjectHash = session.SubjectHash, |
| | 30 | 145 | | ExternalGrants = session.ExternalGrants.ToArray(), |
| | 30 | 146 | | StartedAt = session.StartedAt, |
| | 30 | 147 | | LastRefreshedAt = session.LastRefreshedAt, |
| | 30 | 148 | | ExpiresAt = session.ExpiresAt, |
| | 30 | 149 | | RefreshExpiresAt = session.RefreshExpiresAt, |
| | 30 | 150 | | CurrentRefreshTokenHash = session.CurrentRefreshTokenHash, |
| | 30 | 151 | | RefreshGeneration = session.RefreshGeneration, |
| | 30 | 152 | | RevokedAt = session.RevokedAt, |
| | 30 | 153 | | RevocationReason = session.RevocationReason |
| | 30 | 154 | | ,ProtectedUpstreamLogoutHint = session.ProtectedUpstreamLogoutHint?.ToArray() |
| | 30 | 155 | | }; |
| | | 156 | | } |