BusinessMgr-2019/SaBusinessMgrCoreWebControl/Control/Controllers/Security/SecurityController.cs

using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using NPOI.SS.Formula.Functions;
using Sarand.BusinessMgr.Net.Core.Web.App;
using Sarand.BusinessMgr.Web.Control.Models;
using Sarand.BusinessMgr.Net.Standard.Base.Bus.Control;
using Sarand.Net.Standard.Base.App;
using Sarand.Net.Standard.Base.Utils;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Text.RegularExpressions;
using System.Threading.Tasks;

namespace Sarand.BusinessMgr.Web.Control.Controllers
{
	//======================================================================
	public partial class SecurityController : SbmController_Control
	{
		//-------------------------------------------------------------------
		// Data members.

		//-------------------------------------------------------------------
		// Construction.
		public SecurityController(SbmLocaliser localiser, ILogger<HomeController> logger) :
			base(localiser, logger)
		{
		}

		//-------------------------------------------------------------------
		public IActionResult Index()
		{
			return RedirectToAction("Signin", "Security");
		}

		//-------------------------------------------------------------------
		public IActionResult Signin()
		{
			// Redirect home if signed-in.
			if (ValidUserSession)
				return RedirectToAction("", "");

			Model_Security model = new Model_Security(Localiser);
			return View(model);
		}

		//-------------------------------------------------------------------
		// Security - Change password
		/// <summary>
		/// Security - Change Password action.
		/// <para>- GET from request password email link.</para>
		/// <para>- POST with user signed-in. Browser cache prohibited.</para>
		/// </summary>
		[HttpGet, HttpPost]
		public IActionResult ChangePassword(Model_Security model)
		{
			bool validSessionRequired = true;

			if (Request.Method.EqualsCI(HttpMethods.Get))
			{
				// Check for encrypted parameters from 'Request Password' email link.
				// NB Only allowed as a 'GET' request.
				String encryptedParams = Request.Query[ParamName_RequestPasswordEncrypted];
				RequestPasswordParams requestPasswordParams = ExtractRequestPasswordLinkParams(encryptedParams);
				if (requestPasswordParams.IsValid())
				{
					String logSuffix = requestPasswordParams.GetValidParams().Concat("", " ", ".");
					using (SbmcUserAccount userAccount = ControlAccountMgr.GetUserAccountById(requestPasswordParams.UserAccountId))
					{
						if (userAccount != null)
						{
							if (userAccount.IsStatusActive)
							{
								if (requestPasswordParams.IsValid(userAccount))
								{
									model.rpe = encryptedParams;
									validSessionRequired = false;
								}
								else SaLogger.Warn($"{SysUtil.Fn} 'Request Password' parameters supplied but invalid. {logSuffix}");
							}
							else SaLogger.Warn($"{SysUtil.Fn} 'Request Password' parameters supplied but account is not active. {logSuffix}");
						}
						else
						{
							// User Account not found - redirect to Portal application.
							String redirectParamName = ParamName_RequestPasswordEncrypted + "2";
							SaLogger.Warn($"{SysUtil.Fn} 'Request Password' parameters supplied but account is not 'Admin'. {logSuffix}");
							if (!Request.Query.Keys.Contains(redirectParamName) && !StringUtil.IsEmpty(AppConfig.URL.Portal.Root))
							{
								UriBuilder uri = new UriBuilder(Regex.Replace(AppConfig.URL.Portal.Root, "/$", "") + "/Security/ChangePassword");
								uri.Query = $"{ParamName_RequestPasswordEncrypted}={Uri.EscapeDataString(encryptedParams)}&{redirectParamName}";
								return Redirect(uri.Uri.OriginalString);
							}
						}
					}
				}
			}

			// Must have a valid session to change password unless linked from Request Password above.
			if (validSessionRequired && !ValidUserSession)
				return RedirectToAction("", "");

			// Configure page.

			return View(model);
		}

		//-------------------------------------------------------------------
		// Security - Request Password
		//-------------------------------------------------------------------
		/// <summary>
		/// Sign-in Request Password action.
		/// <para>- User not signed-in.</para>
		/// <para>- GET only with browser cache allowed.</para>
		/// </summary>
		[HttpGet]
		public IActionResult RequestPassword()
		{
			Model_Security model = new Model_Security(Localiser);

			// Configure page.
			model.ProhibitCache = false;

			return View(model);
		}

		//-------------------------------------------------------------------
	}
	//======================================================================
}