niko
306 lines
17 KiB
C#
306 lines
17 KiB
C#
using Microsoft.AspNetCore.Mvc;
|
|
using Newtonsoft.Json;
|
|
using Campus_live_rewrite.api.dbs;
|
|
using Campus_live_rewrite.api.server;
|
|
using Campus_live_rewrite.api.server.Classes;
|
|
using Campus_live_rewrite.api.server.Classes.db_class;
|
|
using System.Net.Http.Headers;
|
|
using System.Text.Json;
|
|
|
|
namespace Campus_live_rewrite.Controllers
|
|
{
|
|
// Auth endpoints for the CampusPatch2025 Launcher.
|
|
//
|
|
// These live alongside the existing DiscordController (web-admin OAuth flow). The launcher
|
|
// uses a different callback strategy than the web admin: it spins up a short-lived HTTP
|
|
// listener on 127.0.0.1:<random port>, opens the browser at
|
|
// /api/auth/discord/login?state=launcher:<port>
|
|
// and expects the browser to be redirected to
|
|
// http://127.0.0.1:<port>/campus-auth?token=<jwt>
|
|
// after Discord OAuth completes. That JWT is the launcher's session credential; the launcher
|
|
// saves it locally and uses it as a Bearer for /api/auth/me + /api/auth/link/steam etc.
|
|
//
|
|
// Non-OAuth flows: launcher can also register with username+password (creates account with
|
|
// no Steam yet) or log in with existing credentials. Same JWT is returned in all three cases.
|
|
[ApiController]
|
|
[Route("api/auth")]
|
|
public class AuthLauncherController : ControllerBase
|
|
{
|
|
// Discord OAuth app is shared with DiscordController — same Client Id/Secret/Redirect. The
|
|
// callback discriminates admin-panel vs launcher by inspecting the `state` param format:
|
|
// "admin" => (default, existing) redirect to /admin/home/v4
|
|
// "launcher:<port>" => (new) redirect browser to http://127.0.0.1:<port>/campus-auth?token=<jwt>
|
|
private const string ClientId = "1537203658725265488";
|
|
private const string ClientSecret = "6JOoRs9-b-B8m8y5t9TnhURs6dOO-P-2";
|
|
private const string RedirectUri = "https://gameauth.ddns.net/api/auth/discord/login";
|
|
|
|
// ---- Discord OAuth — combined start + callback ------------------------------------------
|
|
// GET /api/auth/discord/login
|
|
// Discord's registered redirect URI is now this same endpoint (see RedirectUri
|
|
// constant above), so the browser makes TWO trips through here per login:
|
|
// 1) Initial hit from the launcher's "Log in with Discord" button. `code` is
|
|
// absent → we 302 the browser to Discord's OAuth authorize page.
|
|
// 2) Discord redirects the user back with ?code=<X>&state=<Y>. `code` is present
|
|
// → we exchange the code for an access token, fetch the Discord user, find or
|
|
// auto-create the linked Campus account, mint a JWT, and either:
|
|
// - state == "launcher:<port>" → redirect to http://127.0.0.1:<port>/campus-auth?token=<jwt>
|
|
// - state == "admin" (default) → set cookie + redirect to /admin/home/v4
|
|
// Doing both phases in one route matches whatever redirect URI is on the Discord
|
|
// dashboard without needing a separate /callback endpoint.
|
|
[HttpGet("discord/login")]
|
|
public async Task<IActionResult> DiscordLoginLauncher([FromQuery] string? code = null,
|
|
[FromQuery] string? state = null)
|
|
{
|
|
// Phase 1: no code yet → kick off OAuth by 302-ing to Discord.
|
|
if (string.IsNullOrEmpty(code))
|
|
{
|
|
string stateOut = string.IsNullOrEmpty(state) ? "admin" : state;
|
|
var url =
|
|
"https://discord.com/api/oauth2/authorize"
|
|
+ $"?client_id={ClientId}"
|
|
+ $"&redirect_uri={Uri.EscapeDataString(RedirectUri)}"
|
|
+ "&response_type=code"
|
|
+ "&scope=identify email"
|
|
+ $"&state={Uri.EscapeDataString(stateOut)}";
|
|
return Redirect(url);
|
|
}
|
|
|
|
// Phase 2: Discord redirected the user back here with a code. Exchange it.
|
|
using var http = new HttpClient();
|
|
var tokenResponse = await http.PostAsync(
|
|
"https://discord.com/api/oauth2/token",
|
|
new FormUrlEncodedContent(new Dictionary<string, string>
|
|
{
|
|
["client_id"] = ClientId,
|
|
["client_secret"] = ClientSecret,
|
|
["grant_type"] = "authorization_code",
|
|
["code"] = code,
|
|
["redirect_uri"] = RedirectUri
|
|
})
|
|
);
|
|
if (!tokenResponse.IsSuccessStatusCode)
|
|
return Unauthorized("OAuth token exchange failed.");
|
|
|
|
var tokenBody = await tokenResponse.Content.ReadAsStringAsync();
|
|
var accessTok = System.Text.Json.JsonDocument.Parse(tokenBody)
|
|
.RootElement.GetProperty("access_token").GetString();
|
|
http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessTok);
|
|
|
|
var userBody = await http.GetStringAsync("https://discord.com/api/users/@me");
|
|
var user = System.Text.Json.JsonDocument.Parse(userBody).RootElement;
|
|
string discordIdStr = user.GetProperty("id").GetString();
|
|
string discordName = user.GetProperty("username").GetString();
|
|
ulong discordId = ulong.Parse(discordIdStr);
|
|
|
|
// Find existing Campus account for this Discord id, or auto-create one.
|
|
var accountIds = PlayerDB.GetAccountIdsByDiscordId(discordId);
|
|
ulong accId;
|
|
if (accountIds == null || !accountIds.Any())
|
|
{
|
|
if (!PlayerDB.CreateAccount(Platforms.RecNet, 0UL, "", discordId, out var newAcc))
|
|
return StatusCode(500, "Failed to create Discord-linked account.");
|
|
accId = newAcc.accountId;
|
|
Console.WriteLine($"[DiscordAuth/launcher] Auto-created account_id={accId} for discord_id={discordId} ({discordName})");
|
|
}
|
|
else
|
|
{
|
|
accId = accountIds.First();
|
|
Console.WriteLine($"[DiscordAuth/launcher] Existing account_id={accId} for discord_id={discordId} ({discordName})");
|
|
}
|
|
|
|
string jwt = ClientSecurity.RefreshToken_Web(accId);
|
|
|
|
// Launcher flow: bounce to the launcher's local http listener with the JWT.
|
|
if (!string.IsNullOrEmpty(state) && state.StartsWith("launcher:", StringComparison.Ordinal))
|
|
{
|
|
string portStr = state.Substring("launcher:".Length);
|
|
if (int.TryParse(portStr, out int port) && port >= 1024 && port <= 65535)
|
|
{
|
|
string dest = $"http://127.0.0.1:{port}/campus-auth?token={Uri.EscapeDataString(jwt)}&account_id={accId}";
|
|
Console.WriteLine($"[DiscordAuth/launcher] redirecting to {dest}");
|
|
return Redirect(dest);
|
|
}
|
|
}
|
|
|
|
// Admin panel flow (default): cookie + redirect to dashboard.
|
|
Response.Cookies.Append("Authorization", jwt, new Microsoft.AspNetCore.Http.CookieOptions
|
|
{
|
|
Expires = DateTime.Now.AddHours(24),
|
|
HttpOnly = true,
|
|
Secure = true,
|
|
SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Lax,
|
|
Path = "/"
|
|
});
|
|
return Redirect("/admin/home/v4");
|
|
}
|
|
|
|
// ---- Register: username + password ------------------------------------------------------
|
|
// POST /api/auth/register {username, password}
|
|
// Creates a PlayerDB account with no Steam / Discord link yet. Both are added later:
|
|
// Steam via /api/auth/link/steam when the launcher extracts the local Steam ID, Discord
|
|
// via /api/auth/link/discord if the user then chooses to Discord-link. Returns a JWT.
|
|
[HttpPost("register")]
|
|
public IActionResult Register([FromBody] AuthCreds body)
|
|
{
|
|
if (body == null || string.IsNullOrWhiteSpace(body.username) || string.IsNullOrWhiteSpace(body.password))
|
|
return BadRequest(new { success = false, error = "username and password required" });
|
|
|
|
// Reject if username already taken. The DB reserves username via PlayerDB.SetPlayerUsername
|
|
// but there's no atomic create-with-username helper, so we check-then-create with a note
|
|
// that racing two identical registers is possible (rare; second one gets rejected on next
|
|
// rename check).
|
|
var existing = PlayerDB.GetFullAccountByName(body.username);
|
|
if (existing != null)
|
|
return Conflict(new { success = false, error = "username already taken" });
|
|
|
|
// Create account with Platforms.RecNet (no Steam yet) and blank device id. Discord id 0
|
|
// means "not Discord-linked". Link steps happen separately.
|
|
if (!PlayerDB.CreateAccount(Platforms.RecNet, 0UL, "", 0UL, out var newAcc))
|
|
return StatusCode(500, new { success = false, error = "account creation failed" });
|
|
|
|
PlayerDB.SetPlayerUsername(body.username, newAcc.accountId);
|
|
PlayerDB.SetPlayerPassword(body.password, newAcc.accountId, log: true);
|
|
|
|
string jwt = ClientSecurity.RefreshToken_Web(newAcc.accountId);
|
|
return Ok(new { success = true, token = jwt, account_id = newAcc.accountId });
|
|
}
|
|
|
|
// ---- Login: username + password ---------------------------------------------------------
|
|
// POST /api/auth/login {username, password}
|
|
// Delegates to PlayerDB.GetAccountPassword (same helper the web admin login uses).
|
|
// Returns a JWT and a minimal account snapshot. Launcher usually calls /api/auth/me
|
|
// right after for the fuller view including ban state, dev/mod flags, pfp, etc.
|
|
[HttpPost("login")]
|
|
public IActionResult Login([FromBody] AuthCreds body)
|
|
{
|
|
if (body == null || string.IsNullOrWhiteSpace(body.username) || string.IsNullOrWhiteSpace(body.password))
|
|
return BadRequest(new { success = false, error = "username and password required" });
|
|
|
|
var result = PlayerDB.GetAccountPassword(body.username, body.password, isAdminPanel: false);
|
|
if (!result.success)
|
|
return Unauthorized(new { success = false, error = result.error });
|
|
|
|
string jwt = ClientSecurity.RefreshToken_Web(result.accid);
|
|
return Ok(new { success = true, token = jwt, account_id = result.accid });
|
|
}
|
|
|
|
// ---- Logout -----------------------------------------------------------------------------
|
|
// POST /api/auth/logout
|
|
// JWTs are stateless (HMACSHA256, no server-side session store), so logout is a no-op
|
|
// server-side today. The launcher wipes its local JWT on 401 anyway. This endpoint just
|
|
// returns 200 so the launcher has a well-known URL to POST to for symmetry.
|
|
[HttpPost("logout")]
|
|
public IActionResult Logout() => Ok(new { success = true });
|
|
|
|
// ---- Me ---------------------------------------------------------------------------------
|
|
// GET /api/auth/me
|
|
// Returns the full account snapshot the launcher UI needs: display name, pfp, discord +
|
|
// steam ids, ban status + expiry, dev/mod flags. Launcher polls this at startup and on
|
|
// every panel refresh. 401 tells the launcher to wipe its local JWT and show
|
|
// "Login time expired, please log back in".
|
|
[HttpGet("me")]
|
|
public IActionResult Me()
|
|
{
|
|
var (account, error) = AuthHelper.ValidateToken(HttpContext);
|
|
if (error != null) return Unauthorized(new { success = false, error = "invalid or expired token" });
|
|
|
|
var full = PlayerDB.GetFullAccount(account.Id);
|
|
if (full == null) return NotFound(new { success = false, error = "account not found" });
|
|
|
|
// Ban info: HasActiveModerationBlock is the source of truth. Get_moderation_block
|
|
// returns a JSON string of the current block; we parse it lightly to extract end time
|
|
// + reason. If no active ban, everything stays null.
|
|
bool banned = PlayerDB.HasActiveModerationBlock(account.Id);
|
|
long? banEndsAt = null;
|
|
string? banReason = null;
|
|
if (banned)
|
|
{
|
|
try
|
|
{
|
|
var blockJson = PlayerDB.Get_moderation_block(account.Id);
|
|
if (!string.IsNullOrEmpty(blockJson) && blockJson != "null")
|
|
{
|
|
var doc = System.Text.Json.JsonDocument.Parse(blockJson);
|
|
var root = doc.RootElement;
|
|
if (root.TryGetProperty("EndTime", out var e) && e.TryGetInt64(out var eSec)) banEndsAt = eSec;
|
|
else if (root.TryGetProperty("ends_at", out var e2) && e2.TryGetInt64(out var e2Sec)) banEndsAt = e2Sec;
|
|
if (root.TryGetProperty("Reason", out var r) && r.ValueKind == System.Text.Json.JsonValueKind.String) banReason = r.GetString();
|
|
else if (root.TryGetProperty("reason", out var r2) && r2.ValueKind == System.Text.Json.JsonValueKind.String) banReason = r2.GetString();
|
|
}
|
|
}
|
|
catch { /* leave ban fields null on parse error */ }
|
|
}
|
|
|
|
// Platform ids: pull first Steam / Oculus ids off PlatformIds list.
|
|
string? steamId = null, metaId = null;
|
|
if (full.player?.PlatformIds != null)
|
|
{
|
|
foreach (var p in full.player.PlatformIds)
|
|
{
|
|
if (p == null) continue;
|
|
if (p.Platform == Platforms.Steam && steamId == null) steamId = p.PlatformId.ToString();
|
|
if (p.Platform == Platforms.Oculus && metaId == null) metaId = p.PlatformId.ToString();
|
|
}
|
|
}
|
|
|
|
return Ok(new
|
|
{
|
|
success = true,
|
|
id = full.playerid,
|
|
username = full.player?.Username,
|
|
display_name = full.player?.DisplayName,
|
|
profile_image = full.player?.profileImage,
|
|
bio = full.player_Extra?.Bio,
|
|
discord_id = full.player_Extra?.DiscordId == 0 ? (ulong?)null : full.player_Extra?.DiscordId,
|
|
// Discord username isn't stored today. If it were captured during Discord OAuth
|
|
// callback (and persisted onto player_Extra), it would surface here. For now null.
|
|
discord_username = (string?)null,
|
|
steam_id = steamId,
|
|
meta_id = metaId,
|
|
banned = banned,
|
|
ban_ends_at = banEndsAt,
|
|
ban_reason = banReason,
|
|
is_dev = (full.dev_Flag & DevFlag.dev) == DevFlag.dev,
|
|
is_mod = (full.dev_Flag & DevFlag.mod) == DevFlag.mod,
|
|
});
|
|
}
|
|
|
|
// ---- Link Steam --------------------------------------------------------------------------
|
|
// POST /api/auth/link/steam {steam_id}
|
|
// Called by the launcher after Discord/register login once it extracts the local Steam
|
|
// ID (via steam_api). Behaviour matrix:
|
|
// - account has NO Steam yet AND no other account owns this steam_id → add it, 200 ok
|
|
// - account has THIS steam_id already → 200 no-op
|
|
// - account has a DIFFERENT steam_id (user changed Steam accounts) → swap to new one
|
|
// - a DIFFERENT account owns this steam_id → 409 conflict, caller decides (probably
|
|
// "This Steam account is linked to a different Campus account, log in there instead")
|
|
[HttpPost("link/steam")]
|
|
public IActionResult LinkSteam([FromBody] SteamLinkBody body)
|
|
{
|
|
var (account, error) = AuthHelper.ValidateToken(HttpContext);
|
|
if (error != null) return Unauthorized(new { success = false, error = "invalid or expired token" });
|
|
if (body == null || body.steam_id == 0) return BadRequest(new { success = false, error = "steam_id required" });
|
|
|
|
// Check if the steam_id is already claimed by another account.
|
|
PlayerDB.GetLogins(Platforms.Steam, body.steam_id, out var owners);
|
|
if (owners != null)
|
|
{
|
|
foreach (var o in owners)
|
|
{
|
|
if (o.accountId != account.Id)
|
|
return Conflict(new { success = false, error = "steam_id already linked to a different Campus account", other_account_id = o.accountId });
|
|
}
|
|
}
|
|
|
|
// Safe to add or swap. SetPlayerSteamId replaces the account's Steam entry (or adds if
|
|
// missing) — see PlayerDB.SetPlayerSteamId.
|
|
bool ok = PlayerDB.SetPlayerSteamId(body.steam_id, account.Id);
|
|
return Ok(new { success = ok, steam_id = body.steam_id });
|
|
}
|
|
|
|
// Body shapes.
|
|
public class AuthCreds { public string? username { get; set; } public string? password { get; set; } }
|
|
public class SteamLinkBody { public ulong steam_id { get; set; } }
|
|
}
|
|
}
|