DD.WellWorkover.Cloud/AsbCloudWebApi/Controllers/AuthController.cs

using AsbCloudApp.Data;
using AsbCloudApp.Data.User;
using AsbCloudApp.Repositories;
using AsbCloudApp.Services;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Swashbuckle.AspNetCore.Annotations;
using System.Threading;
using System.Threading.Tasks;

namespace AsbCloudWebApi.Controllers;

/// <summary>
/// Авторизация
/// </summary>
[Route("/auth")]
[ApiController]
public class AuthController : ControllerBase
{
    private readonly IAuthService authService;
    private readonly IUserRepository userRepository;

    public AuthController(IAuthService authService, IUserRepository userRepository)
    {
        this.authService = authService;
        this.userRepository = userRepository;
    }

    /// <summary>
    /// Аутентификация пользователя
    /// </summary>
    /// <param name="auth"></param>
    /// <param name="token">Токен отмены задачи</param>
    /// <response code="200">новый токен</response>
    /// <response code="400">логин и пароль не подходят</response>
    [AllowAnonymous]
    [HttpPost("login")]
    [SwaggerOperation(OperationId = "login")]
    [ProducesResponseType(typeof(UserTokenDto), (int)System.Net.HttpStatusCode.OK)]
    public async Task<IActionResult> LoginAsync([FromBody] AuthDto auth, CancellationToken token)
    {
        var userToken = await authService.LoginAsync(auth.Login, auth.Password, token);

        if (userToken is null)
            Forbid();

        return Ok(userToken);
    }

    /// <summary>
    /// Продление срока действия токена
    /// </summary>
    /// <returns code="200">новый токен</returns>
    [Authorize]
    [HttpGet("refresh")]
    [ProducesResponseType(typeof(UserTokenDto), (int)System.Net.HttpStatusCode.OK)]
    public async Task<IActionResult> RefreshAsync(CancellationToken token)
    {
        var userToken = await authService.RefreshAsync(User, token);

        if (userToken is null)
            Forbid();

        return Ok(userToken);
    }

    /// <summary>
    /// Отправить заявку на регистрацию. Заявка подтверждается администратором.
    /// </summary>
    /// <param name="user">Информация о новом пользователе</param>
    /// <returns code="200">Ок</returns>
    [HttpPost]
    [ProducesResponseType(typeof(ValidationProblemDetails), (int)System.Net.HttpStatusCode.BadRequest)]
    public IActionResult Register(UserRegistrationDto user)
    {
        authService.Register(user);
        return Ok();
    }

    /// <summary>
    /// Смена пароля пользователя. Доступна пользователю и администратору
    /// </summary>
    /// <returns code="200">Ок</returns>
    [Authorize]
    [HttpPut("{idUser}/ChangePassword")]
    [ProducesResponseType(typeof(ValidationProblemDetails), (int)System.Net.HttpStatusCode.BadRequest)]
    public IActionResult ChangePassword([FromRoute] int idUser, [FromBody] string newPassword)
    {
        var editorUserId = User.GetUserId();

        if (editorUserId is null)
            return Forbid();

        if (!((editorUserId == idUser) || userRepository.HasPermission((int)editorUserId, "Auth.edit")))
            return Forbid();

        authService.ChangePassword(idUser, newPassword);
        return Ok();
    }
}