mirror of
https://github.com/JogmansonReal/Radicade.git
synced 2026-10-25 15:09:26 -07:00
JogmansonReal
1117 lines
38 KiB
C#
1117 lines
38 KiB
C#
using Azure;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Identity;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using Microsoft.IdentityModel.Tokens;
|
|
using System.Collections.Generic;
|
|
using System.IdentityModel.Tokens.Jwt;
|
|
using System.Security.Claims;
|
|
using System.Text;
|
|
using System.Text.Json;
|
|
using RadicadeServer.DB;
|
|
using RadicadeServer.Extensions;
|
|
using RadicadeServer.RecNet.Accounts;
|
|
using RadicadeServer.RecNet.Accounts.Local;
|
|
using RadicadeServer.RecNet.Auth;
|
|
using RadicadeServer.RecNet.Auth.Cached;
|
|
using RadicadeServer.RecNet.Auth.Connection;
|
|
using RadicadeServer.RecNet.Enums.Players;
|
|
using RadicadeServer.RecNet.Moderation;
|
|
using RadicadeServer.RecNet.Progression;
|
|
using RadicadeServer.RecNet.Responses;
|
|
using RadicadeServer.Radicade.Mail;
|
|
using RadicadeServer.Radicade.Responses;
|
|
using RadicadeServer.Utils;
|
|
using static System.Runtime.InteropServices.JavaScript.JSType;
|
|
|
|
namespace RadicadeServer.Auth
|
|
{
|
|
[Route("auth")]
|
|
public class AuthAPI : Controller
|
|
{
|
|
|
|
public class WebLoginRequest
|
|
{
|
|
public string? Username { get; set; }
|
|
public string? Password { get; set; }
|
|
}
|
|
|
|
|
|
|
|
public const int MinPasswordLength = 6;
|
|
|
|
RecDBContext db;
|
|
PasswordHasher<PlayerData> hasher;
|
|
|
|
public AuthAPI(RecDBContext context) {
|
|
this.db = context;
|
|
this.hasher = new PasswordHasher<PlayerData>();
|
|
}
|
|
|
|
[HttpGet("account/me/haspassword"), Authorize]
|
|
public async Task<bool?> GetHasPassword()
|
|
{
|
|
var userId = User.GetUserId();
|
|
|
|
var user = await db.Players.FirstAsync(x => x.AccountId == userId);
|
|
|
|
return !string.IsNullOrEmpty(user.Hashword);
|
|
}
|
|
|
|
[HttpPost("account/me/changepassword"), Authorize]
|
|
public async Task<Success> ChangePassword([FromForm] string oldPassword, [FromForm] string newPassword)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(newPassword)) return new Success(false, "New password is required.", null);
|
|
if (newPassword.Length < MinPasswordLength) return new Success(false, $"Password must be at least {MinPasswordLength} characters.", null);
|
|
|
|
var userId = User.GetUserId();
|
|
|
|
var user = await db.Players.FirstOrDefaultAsync(x => x.AccountId == userId);
|
|
if (user == null) return new Success(false, "User does not exist.", "damn.");
|
|
|
|
|
|
|
|
if (!string.IsNullOrWhiteSpace(user.Hashword))
|
|
{
|
|
if (string.IsNullOrEmpty(oldPassword))
|
|
return new Success(false, "Current password is required.", null);
|
|
var check = hasher.VerifyHashedPassword(user, user.Hashword, oldPassword);
|
|
if (check != PasswordVerificationResult.Success && check != PasswordVerificationResult.SuccessRehashNeeded)
|
|
return new Success(false, "Current password is incorrect.", null);
|
|
}
|
|
|
|
user.Hashword = hasher.HashPassword(user, newPassword);
|
|
|
|
await db.SaveChangesAsync();
|
|
|
|
AuthSecurityMonitor.NoteCredentialChange(user.AccountId, "password changed");
|
|
return new Success(true, null, null);
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[HttpPost("account/recoverpassword")]
|
|
public async Task<Success> RecoverPassword()
|
|
{
|
|
|
|
var email = "";
|
|
if (Request.HasFormContentType)
|
|
email = Request.Form["email"].FirstOrDefault() ?? "";
|
|
if (string.IsNullOrWhiteSpace(email))
|
|
{
|
|
using var reader = new System.IO.StreamReader(Request.Body);
|
|
var raw = await reader.ReadToEndAsync();
|
|
if (!string.IsNullOrWhiteSpace(raw))
|
|
{
|
|
try
|
|
{
|
|
using var doc = System.Text.Json.JsonDocument.Parse(raw);
|
|
if (doc.RootElement.TryGetProperty("email", out var e) && e.ValueKind == System.Text.Json.JsonValueKind.String)
|
|
email = e.GetString() ?? "";
|
|
}
|
|
catch { }
|
|
}
|
|
}
|
|
email = email.Trim();
|
|
|
|
if (string.IsNullOrWhiteSpace(email) || !email.Contains('@'))
|
|
return new Success(false, "Enter a valid email address.", null);
|
|
|
|
|
|
|
|
var plrData = await db.Players.FirstOrDefaultAsync(x => x.Email.ToLower() == email.ToLower());
|
|
if (plrData != null)
|
|
{
|
|
plrData.PasswordResetToken = Guid.NewGuid().ToString("N");
|
|
plrData.PasswordResetExpires = DateTime.UtcNow.AddHours(1);
|
|
await db.SaveChangesAsync();
|
|
|
|
SendResetEmail(plrData);
|
|
AuthSecurityMonitor.NoteCredentialChange(plrData.AccountId, "password reset requested");
|
|
}
|
|
|
|
|
|
return new Success(true, null, null);
|
|
}
|
|
|
|
private void SendResetEmail(PlayerData plrData)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(plrData.PasswordResetToken)) return;
|
|
|
|
var link = $"https://radicade.app/reset?code={plrData.PasswordResetToken}";
|
|
var html =
|
|
"<div style=\"font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:24px;\">" +
|
|
"<img src=\"https://radicade.app/assests/RadicadeHorizontal.png\" alt=\"Radicade\" style=\"display:block;max-width:220px;height:auto;margin:0 auto 22px;\" />" +
|
|
"<h2 style=\"color:#1a1a2e;margin-top:0;\">Reset your Radicade password</h2>" +
|
|
"<p style=\"color:#444;font-size:15px;line-height:1.6;\">Hi there,</p>" +
|
|
"<p style=\"color:#444;font-size:15px;line-height:1.6;\">We received a request to reset the password on your Radicade account from the game. If that was you, click the button below to choose a new password:</p>" +
|
|
"<p style=\"text-align:center;margin:28px 0;\"><a href=\"" + link + "\" style=\"background:#00a0d0;color:#fff;text-decoration:none;padding:12px 28px;border-radius:6px;display:inline-block;\">Reset my password</a></p>" +
|
|
"<p style=\"color:#999;font-size:12px;margin-top:24px;\">This link expires in one hour. If you didn't request this, you can safely ignore this email.</p></div>";
|
|
|
|
_ = RadicadeMail.SendAsync(plrData.Email, "Reset your password - Radicade", html);
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[HttpPost("web/login")]
|
|
public async Task<IActionResult> WebLogin([FromBody] WebLoginRequest req)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(req?.Username)) return Ok(new { success = false, message = "No username was given." });
|
|
if (string.IsNullOrWhiteSpace(req?.Password)) return Ok(new { success = false, message = "No password was given." });
|
|
|
|
var loginName = req.Username.Trim().TrimStart('@');
|
|
var profile = await db.Profiles.FirstOrDefaultAsync(x => x.username == loginName || x.displayName == loginName);
|
|
if (profile == null)
|
|
return Ok(new { success = false, message = "Invalid username or password." });
|
|
|
|
var plrData = await db.Players.FirstOrDefaultAsync(x => x.AccountId == profile.accountId);
|
|
if (plrData == null)
|
|
return Ok(new { success = false, message = "Invalid username or password." });
|
|
|
|
|
|
|
|
|
|
|
|
if (string.IsNullOrWhiteSpace(plrData.Hashword))
|
|
return Ok(new { success = false, message = "Please make a password in-game!" });
|
|
|
|
var loginIp = Request.GetClientIp();
|
|
var result = hasher.VerifyHashedPassword(plrData, plrData.Hashword, req.Password ?? "");
|
|
if (result != PasswordVerificationResult.Success)
|
|
{
|
|
AuthSecurityMonitor.RecordFailedLogin(profile.accountId, loginIp);
|
|
return Ok(new { success = false, message = "Invalid username or password." });
|
|
}
|
|
|
|
if (await AccountLock.IsLockedAsync(db, profile.accountId))
|
|
{
|
|
var lockedUsername = await AccountLock.ResolveUsernameAsync(db, profile.accountId) ?? profile.username;
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Security] refused web sign-in for locked account {profile.accountId}");
|
|
return Ok(new { success = false, error = AccountLock.ErrorCode, message = AccountLock.LoginErrorMessage(lockedUsername) });
|
|
}
|
|
AuthSecurityMonitor.RecordSuccessfulLogin(profile.accountId, loginIp, false, false);
|
|
|
|
|
|
|
|
if (!await db.Presences.AnyAsync(x => x.playerId == profile.accountId))
|
|
{
|
|
db.Presences.Add(new RealPresence
|
|
{
|
|
playerId = profile.accountId,
|
|
deviceClass = DeviceClass.Screen,
|
|
statusVisibility = StatusVisibility.Public,
|
|
vRMovementMode = VRMovementModes.TELEPORT
|
|
});
|
|
await db.SaveChangesAsync();
|
|
}
|
|
|
|
var newToken = await GenerateToken(db, profile.accountId, "web", DeviceClass.Screen, Platforms.Steam, "web:" + profile.accountId);
|
|
if (!newToken.success || newToken.value == null)
|
|
return Ok(new { success = false, message = newToken.error ?? "Failed to sign in." });
|
|
|
|
return Ok(new
|
|
{
|
|
success = true,
|
|
token = (string)newToken.value,
|
|
username = profile.username,
|
|
displayName = profile.displayName,
|
|
email = plrData.Email,
|
|
emailVerified = plrData.EmailVerified
|
|
});
|
|
}
|
|
|
|
[HttpPost("connect/token")]
|
|
public async Task<ActionResult<AuthResponse?>> ConnectWithToken([FromForm] TokenConnectData data)
|
|
{
|
|
|
|
|
|
|
|
|
|
|
|
data.platform_id = data.platform_id?.Trim();
|
|
data.device_id = data.device_id?.Trim();
|
|
|
|
var platformAuth = data.platform_auth?.Trim() ?? string.Empty;
|
|
if (data.platform == Platforms.Standalone)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(data.device_id) ||
|
|
data.device_id.Length > 256 || data.client_id != "recroom")
|
|
return Unauthorized(new AuthResponse("Failed to sign in.", "Sign in with your Radicade username and password."));
|
|
data.platform_id = "radicade-quest:" + data.device_id;
|
|
if (data.grant_type == "password" && !string.IsNullOrWhiteSpace(data.username) &&
|
|
!string.IsNullOrWhiteSpace(data.password))
|
|
data.account_id = 0;
|
|
else if (data.grant_type is "cached_login" or "refresh_token")
|
|
{
|
|
var remembered = await QuestRememberedSession.ValidateAsync(db,
|
|
Request.Headers[QuestRememberedSession.Header].ToString(), data.device_id, data.account_id);
|
|
if (!remembered.HasValue)
|
|
return Unauthorized(new AuthResponse("invalid_grant", "Sign in with your Radicade username and password."));
|
|
data.account_id = remembered.Value;
|
|
data.grant_type = "refresh_token";
|
|
}
|
|
else return Unauthorized(new AuthResponse("invalid_grant", "Sign in with your Radicade username and password."));
|
|
}
|
|
if (data.platform == Platforms.Steam && !string.IsNullOrEmpty(platformAuth) &&
|
|
!TryValidateSteamPlatformAuth(platformAuth, out var platformAuthReason))
|
|
{
|
|
return SteamIdentityRefusal("platform_auth shape", platformAuthReason, data);
|
|
}
|
|
|
|
if (data.platform == Platforms.Steam && (data.grant_type is "cached_login" or "create_account" or "password"))
|
|
{
|
|
if (string.IsNullOrWhiteSpace(platformAuth))
|
|
{
|
|
return SteamIdentityRefusal("platform_auth",
|
|
"platform_auth was absent or blank", data);
|
|
}
|
|
if (string.IsNullOrWhiteSpace(DBConfig.SteamApiKey))
|
|
{
|
|
if (!DBConfig.TrustUnverifiedSteamIdentity)
|
|
{
|
|
return SteamIdentityRefusal("steam api key",
|
|
"no SteamApiKey is configured and TrustUnverifiedSteamIdentity is off", data);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if (!TryReadSteamTicket(platformAuth, out var steamTicket))
|
|
{
|
|
return SteamIdentityRefusal("platform_auth.Ticket",
|
|
"platform_auth carried no readable string 'Ticket'", data);
|
|
}
|
|
|
|
string? verifiedSteamId;
|
|
try
|
|
{
|
|
using var timeout = CancellationTokenSource.CreateLinkedTokenSource(HttpContext.RequestAborted);
|
|
timeout.CancelAfter(TimeSpan.FromSeconds(10));
|
|
verifiedSteamId = await AuthenticateSteamTicketAsync(steamTicket, GetSteamAppId(platformAuth), timeout.Token);
|
|
}
|
|
catch (Exception ex) when (ex is HttpRequestException or TaskCanceledException or JsonException)
|
|
{
|
|
return SteamIdentityRefusal("steam ticket check",
|
|
$"Steam could not be reached ({ex.GetType().Name})", data);
|
|
}
|
|
|
|
if (string.IsNullOrWhiteSpace(verifiedSteamId))
|
|
{
|
|
return SteamIdentityRefusal("steam ticket check",
|
|
"Steam would not confirm the ticket (stale ticket, or one issued for an app it will not check)", data);
|
|
}
|
|
if (!string.Equals(verifiedSteamId, data.platform_id?.Trim(), StringComparison.Ordinal))
|
|
{
|
|
return SteamIdentityRefusal("identity match",
|
|
$"the ticket is for {verifiedSteamId}, not for the posted identity {data.platform_id?.Trim()}", data);
|
|
}
|
|
}
|
|
}
|
|
|
|
var isWhitelisted = await AuthShared.IsWhitelisted(data.platform_id ?? string.Empty);
|
|
if (!isWhitelisted)
|
|
{
|
|
return new AuthResponse("Error", "You are not whitelisted.");
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
AuthResponse response = new AuthResponse();
|
|
|
|
switch (data.grant_type)
|
|
{
|
|
default:
|
|
return Unauthorized();
|
|
|
|
case "cached_login":
|
|
{
|
|
if (data.account_id <= 0)
|
|
return StatusCode(400, new AuthResponse("invalid_request", "missing account_id"));
|
|
|
|
if (!await db.Players.AnyAsync(player => player.AccountId == data.account_id) ||
|
|
!await db.Profiles.AnyAsync(profile => profile.accountId == data.account_id) ||
|
|
!await db.Presences.AnyAsync(presence => presence.playerId == data.account_id))
|
|
return StatusCode(400, new AuthResponse("invalid_grant", "unknown or incomplete account_id"));
|
|
|
|
if (!await db.CachedLogins.AnyAsync(login => login.accountId == data.account_id &&
|
|
login.platform == data.platform && login.platformId == data.platform_id))
|
|
return StatusCode(400, new AuthResponse("invalid_grant", "no linked account for this platform identity"));
|
|
|
|
response = await TokenRefresh(data);
|
|
return Ok(response);
|
|
}
|
|
|
|
case "create_account":
|
|
{
|
|
var carriesSignUpPayload = HasSignUpPayload(data);
|
|
|
|
|
|
|
|
|
|
|
|
using var identity = await RegistrationGuard.LockIdentityAsync(
|
|
RegistrationGuard.IdentityKey(data.platform.ToString(), data.platform_id, data.device_id));
|
|
|
|
var existingLink = await db.CachedLogins
|
|
.AsNoTracking()
|
|
.Where(login => login.platform == data.platform && login.platformId == data.platform_id)
|
|
.Where(login => data.account_id <= 0 || login.accountId == data.account_id)
|
|
.OrderByDescending(login => login.lastLoginTime)
|
|
.FirstOrDefaultAsync();
|
|
|
|
if (data.account_id > 0 && existingLink == null)
|
|
return StatusCode(400, new AuthResponse("invalid_grant", "no linked account for this platform identity"));
|
|
if (existingLink != null && carriesSignUpPayload)
|
|
{
|
|
var linkedSettings = await db.PlayerSettings.AsNoTracking().FirstOrDefaultAsync(x => x.AccountId == existingLink.accountId);
|
|
bool finished = linkedSettings?.DeserializeSettings().Any(x =>
|
|
string.Equals(x.Key, "Recroom.AccountCreation.HasFinished", StringComparison.OrdinalIgnoreCase) &&
|
|
string.Equals(x.Value, "true", StringComparison.OrdinalIgnoreCase)) == true;
|
|
if (finished)
|
|
existingLink = null;
|
|
}
|
|
|
|
if (existingLink != null)
|
|
{
|
|
data.account_id = existingLink.accountId;
|
|
|
|
if (carriesSignUpPayload)
|
|
await ApplySignUpPayloadAsync(data, existingLink.accountId);
|
|
else if (!await PlayerUtils.HasFinishedAccountCreationAsync(db, existingLink.accountId))
|
|
{
|
|
|
|
|
|
|
|
|
|
|
|
await PlayerUtils.RefreshAccountCreationMarkersAsync(db, existingLink.accountId);
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Onboarding] account {existingLink.accountId} resumed " +
|
|
"before its creation flow finished; started marker restored so the client runs the flow");
|
|
}
|
|
}
|
|
else
|
|
{
|
|
var adoptable = await PlayerUtils.FindAdoptableAccountForDeviceAsync(db, data.device_id?.Trim());
|
|
if (adoptable != null)
|
|
{
|
|
data.account_id = adoptable.AccountId;
|
|
await PlayerUtils.AdoptDeviceAccountAsync(db, adoptable.AccountId, new AccountCreationData
|
|
{
|
|
platform = data.platform,
|
|
platformId = data.platform_id ?? string.Empty,
|
|
deviceId = data.device_id ?? string.Empty
|
|
}, markStarted: true);
|
|
if (carriesSignUpPayload)
|
|
await ApplySignUpPayloadAsync(data, adoptable.AccountId);
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Auth] create_account adopted this device's account " +
|
|
$"{adoptable.AccountId} for platform {data.platform} identity {data.platform_id}");
|
|
}
|
|
else
|
|
{
|
|
|
|
|
|
|
|
|
|
|
|
var refusal = await TryProvisionOnboardingAccountAsync(data);
|
|
if (refusal != null)
|
|
{
|
|
return TokenRefusal(refusal);
|
|
}
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Auth] create_account made account {data.account_id} " +
|
|
$"for platform {data.platform} identity {data.platform_id}");
|
|
}
|
|
}
|
|
|
|
response = await TokenRefresh(data);
|
|
return Ok(response);
|
|
}
|
|
|
|
case "refresh_token":
|
|
response = await TokenRefresh(data);
|
|
return Ok(response);
|
|
|
|
case "password":
|
|
if (data.username == null) return Ok(new AuthResponse { error = "Failed to sign in.", error_description = "No username was given." });
|
|
if (data.password == null) return Ok(new AuthResponse { error = "Failed to sign in.", error_description = "No password was given." });
|
|
|
|
var loginIp = Request.GetClientIp();
|
|
if (AuthSecurityMonitor.IsSourceThrottled(loginIp))
|
|
{
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Security] throttled sign-in source {loginIp} (suspected spraying)");
|
|
return StatusCode(429, new AuthResponse("too_many_requests", "Too many sign-in attempts from this connection. Please try again later."));
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
var loginName = data.username.Trim().TrimStart('@');
|
|
var existingProfile = await db.Profiles.FirstOrDefaultAsync(x => x.username == loginName || x.displayName == loginName);
|
|
if (existingProfile != null)
|
|
{
|
|
data.account_id = existingProfile.accountId;
|
|
}
|
|
|
|
var playerData = await db.Players.FirstOrDefaultAsync(x => x.AccountId == data.account_id);
|
|
if (playerData != null)
|
|
{
|
|
var result = hasher.VerifyHashedPassword(playerData, playerData.Hashword, data.password);
|
|
if (result == PasswordVerificationResult.Success)
|
|
{
|
|
var alreadyCached = await db.CachedLogins.FirstOrDefaultAsync(x => x.accountId == data.account_id && x.platform == data.platform && x.platformId == data.platform_id);
|
|
if (await AccountLock.IsLockedAsync(db, data.account_id) && alreadyCached == null)
|
|
{
|
|
var lockedUsername = await AccountLock.ResolveUsernameAsync(db, data.account_id);
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Security] refused password sign-in for locked account {data.account_id}");
|
|
return Ok(new AuthResponse(AccountLock.ErrorCode, AccountLock.LoginErrorMessage(lockedUsername)));
|
|
}
|
|
if (alreadyCached == null)
|
|
{
|
|
await db.AddAsync(new CachedLogin { lastLoginTime = DateTime.UtcNow, accountId = data.account_id, platform = data.platform, platformId = data.platform_id! });
|
|
await db.SaveChangesAsync();
|
|
}
|
|
|
|
var newDevice = !string.IsNullOrWhiteSpace(playerData.DeviceId)
|
|
&& !string.Equals(playerData.DeviceId, data.device_id, StringComparison.Ordinal);
|
|
var newIp = !string.IsNullOrWhiteSpace(playerData.LastIpAddress)
|
|
&& !string.Equals(playerData.LastIpAddress, loginIp, StringComparison.Ordinal);
|
|
AuthSecurityMonitor.RecordSuccessfulLogin(data.account_id, loginIp, newDevice, newIp);
|
|
|
|
response = await TokenRefresh(data, verifiedByPassword: true);
|
|
return Ok(response);
|
|
}
|
|
}
|
|
|
|
var failures = AuthSecurityMonitor.RecordFailedLogin(data.account_id, loginIp);
|
|
var failureDelay = AuthSecurityMonitor.ProgressiveDelayMs(failures);
|
|
if (failureDelay > 0) await Task.Delay(failureDelay);
|
|
return Ok(new AuthResponse { error = "Failed to sign in.", error_description = "Unknown error." });
|
|
}
|
|
|
|
}
|
|
|
|
[NonAction]
|
|
private async Task ApplySignUpPayloadAsync(TokenConnectData data, long accountId)
|
|
{
|
|
var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == accountId);
|
|
var plrData = await db.Players.FirstOrDefaultAsync(x => x.AccountId == accountId);
|
|
if (profile == null || plrData == null)
|
|
{
|
|
return;
|
|
}
|
|
|
|
var applied = new List<string>();
|
|
var ignored = new List<string>();
|
|
bool isOnboarding = await PlayerUtils.IsChoosingTheirAccountNameAsync(db, accountId) || PlayerUtils.IsNewPlayer(plrData);
|
|
|
|
|
|
|
|
|
|
|
|
bool nameApplied = false;
|
|
bool nameChosen = false;
|
|
var chosen = UsernameRules.Parse(data.username, out var nameRejection);
|
|
if (nameRejection != null)
|
|
{
|
|
|
|
|
|
|
|
ignored.Add($"name=refused({nameRejection})");
|
|
}
|
|
else if (chosen == null)
|
|
{
|
|
ignored.Add("name=absent");
|
|
}
|
|
else if (string.Equals(chosen, profile.username, StringComparison.Ordinal))
|
|
{
|
|
ignored.Add($"name={chosen}(already its name)");
|
|
nameChosen = true;
|
|
}
|
|
else if (profile.NameLocked)
|
|
{
|
|
ignored.Add($"name={chosen}(locked)");
|
|
}
|
|
else if (!await PlayerUtils.IsChoosingTheirAccountNameAsync(db, accountId) && !PlayerUtils.IsNewPlayer(plrData))
|
|
{
|
|
ignored.Add($"name={chosen}(flow over for account '{profile.username}')");
|
|
}
|
|
else if (await PlayerUtils.IsNameTakenAsync(db, chosen))
|
|
{
|
|
ignored.Add($"name={chosen}(taken)");
|
|
}
|
|
else
|
|
{
|
|
var previous = profile.username;
|
|
profile.username = chosen;
|
|
profile.displayName = chosen;
|
|
applied.Add($"name={chosen}(was '{previous}')");
|
|
nameApplied = true;
|
|
nameChosen = true;
|
|
}
|
|
|
|
var birthday = PlayerUtils.ReadBirthday(data.birthday ?? data.birthdayUTC);
|
|
if (birthday == null)
|
|
{
|
|
ignored.Add("birthday=absent");
|
|
}
|
|
else if (plrData.Birthday != null && plrData.Birthday.Value.Year > 1900)
|
|
{
|
|
ignored.Add($"birthday={birthday:yyyy-MM-dd}(account already gave {plrData.Birthday:yyyy-MM-dd})");
|
|
}
|
|
else
|
|
{
|
|
plrData.Birthday = birthday;
|
|
plrData.IsJunior = PlayerUtils.IsJuniorByBirthday(birthday);
|
|
profile.isJunior = plrData.IsJunior;
|
|
applied.Add($"birthday={birthday:yyyy-MM-dd}");
|
|
}
|
|
|
|
if (string.IsNullOrWhiteSpace(data.password))
|
|
{
|
|
ignored.Add("password=absent");
|
|
}
|
|
else if (!string.IsNullOrWhiteSpace(plrData.Hashword))
|
|
{
|
|
ignored.Add("password=(account already has one)");
|
|
}
|
|
else
|
|
{
|
|
plrData.Hashword = new PasswordHasher<PlayerData>().HashPassword(plrData, data.password);
|
|
applied.Add("password=set");
|
|
}
|
|
|
|
if (applied.Count > 0 || isOnboarding) await db.SaveChangesAsync();
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (isOnboarding || nameApplied)
|
|
await PlayerUtils.RefreshAccountCreationMarkersAsync(db, accountId, nameChosen ? true : null);
|
|
|
|
var line =
|
|
$"[SignUp] account {accountId} resumed its sign-up on an identity that was already linked: " +
|
|
$"applied [{string.Join(", ", applied)}], ignored [{string.Join(", ", ignored)}]; " +
|
|
$"name is now '{profile.username}', birthday {(plrData.Birthday == null ? "none" : plrData.Birthday.Value.ToString("yyyy-MM-dd"))}, " +
|
|
$"password {(string.IsNullOrWhiteSpace(plrData.Hashword) ? "unset" : "set")}.";
|
|
}
|
|
|
|
[NonAction]
|
|
private async Task<AuthResponse?> TryProvisionOnboardingAccountAsync(TokenConnectData data)
|
|
{
|
|
var platformId = data.platform_id?.Trim() ?? string.Empty;
|
|
var deviceId = data.device_id?.Trim() ?? string.Empty;
|
|
|
|
|
|
|
|
if (platformId.Length == 0 || deviceId.Length == 0 || platformId.Length > 64 || deviceId.Length > 256)
|
|
{
|
|
return new AuthResponse("Account creation failed.", "A valid platform ID and device ID are required.");
|
|
}
|
|
|
|
var clientIp = Request.GetClientIp();
|
|
if (await db.IsIpBanned(clientIp))
|
|
return new AuthResponse("Account creation failed.", "This IP address is banned from creating new accounts.");
|
|
if (await db.IsAccountCreationBlocked(clientIp))
|
|
return new AuthResponse("Account creation failed.", "This IP address is blocked from creating new accounts.");
|
|
if (await db.IsHardwareBanned(deviceId))
|
|
return new AuthResponse("Account creation failed.", "This device is banned.");
|
|
|
|
|
|
|
|
|
|
var throttled = RegistrationGuard.Check(clientIp, deviceId);
|
|
if (throttled != null)
|
|
{
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Registration] refused a new account for platform " +
|
|
$"{data.platform} identity {platformId} ({RegistrationGuard.Describe(clientIp, deviceId)}): {throttled}");
|
|
return new AuthResponse("Account creation failed.", throttled);
|
|
}
|
|
|
|
data.platform_id = platformId;
|
|
data.device_id = deviceId;
|
|
|
|
var created = await PlayerUtils.CreateAccount(new AccountCreationData
|
|
{
|
|
platform = data.platform,
|
|
platformId = platformId,
|
|
deviceId = deviceId,
|
|
deviceClass = data.device_class,
|
|
password = data.password,
|
|
username = data.username,
|
|
birthday = data.birthday,
|
|
birthdayUTC = data.birthdayUTC,
|
|
email = data.email,
|
|
avatar = data.avatar,
|
|
avatarJson = data.avatarJson
|
|
}, clientIp, accountCreationInProgress: true);
|
|
|
|
if (!created.success || created.value is not Profile profile)
|
|
return new AuthResponse("Account creation failed.", created.error ?? "Could not create the account.");
|
|
|
|
data.account_id = profile.accountId;
|
|
return null;
|
|
}
|
|
|
|
[NonAction]
|
|
private static bool HasSignUpPayload(TokenConnectData data) =>
|
|
!string.IsNullOrWhiteSpace(data.username) ||
|
|
!string.IsNullOrWhiteSpace(data.password) ||
|
|
data.birthday != null ||
|
|
data.birthdayUTC != null ||
|
|
!string.IsNullOrWhiteSpace(data.avatar) ||
|
|
!string.IsNullOrWhiteSpace(data.avatarJson) ||
|
|
!string.IsNullOrWhiteSpace(data.email);
|
|
|
|
[NonAction]
|
|
private static ObjectResult TokenRefusal(AuthResponse refusal)
|
|
{
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Auth] sign-in refused: error={refusal.error} detail=\"{refusal.error_description}\"");
|
|
return new(refusal) { StatusCode = 400 };
|
|
}
|
|
|
|
private const string SteamAppId = "471710";
|
|
private static readonly string[] SteamAllowedAppIds = ["480", SteamAppId];
|
|
|
|
[NonAction]
|
|
protected virtual async Task<string?> AuthenticateSteamTicketAsync(string ticket, string appId, CancellationToken cancellationToken)
|
|
{
|
|
|
|
|
|
|
|
|
|
|
|
foreach (var candidate in CandidateSteamAppIds(appId))
|
|
{
|
|
var result = await PlatformIdentity.AuthenticateTicketAsync(ticket, candidate, cancellationToken);
|
|
if (result.OtherApp) continue;
|
|
return result.Ok ? result.SteamId : null;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
[NonAction]
|
|
private static IEnumerable<string> CandidateSteamAppIds(string appId) =>
|
|
new[] { appId }.Concat(SteamAllowedAppIds)
|
|
.Where(candidate => !string.IsNullOrWhiteSpace(candidate))
|
|
.Distinct(StringComparer.Ordinal);
|
|
|
|
[NonAction]
|
|
private static string GetSteamAppId(string platformAuth)
|
|
{
|
|
using var document = JsonDocument.Parse(platformAuth);
|
|
var appId = document.RootElement.GetProperty("AppId");
|
|
return appId.ValueKind == JsonValueKind.String ? appId.GetString() ?? SteamAppId : appId.ToString();
|
|
}
|
|
|
|
[NonAction]
|
|
private static bool TryReadSteamTicket(string platformAuth, out string ticket)
|
|
{
|
|
ticket = string.Empty;
|
|
try
|
|
{
|
|
using var document = JsonDocument.Parse(platformAuth);
|
|
if (!document.RootElement.TryGetProperty("Ticket", out var ticketElement) ||
|
|
ticketElement.ValueKind != JsonValueKind.String)
|
|
return false;
|
|
|
|
ticket = ticketElement.GetString() ?? string.Empty;
|
|
return ticket.Length > 0;
|
|
}
|
|
catch (JsonException)
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[NonAction]
|
|
private ActionResult SteamIdentityRefusal(string stage, string detail, TokenConnectData data)
|
|
{
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Auth] connect/token refused at {stage} for " +
|
|
$"platform {data.platform} identity {OrAbsent(data.platform_id)} " +
|
|
$"grant_type {OrAbsent(data.grant_type)}: {detail}");
|
|
return Unauthorized();
|
|
}
|
|
|
|
[NonAction]
|
|
private static string OrAbsent(string? value) =>
|
|
string.IsNullOrWhiteSpace(value) ? "<absent>" : value.Trim();
|
|
|
|
[NonAction]
|
|
private static bool TryValidateSteamPlatformAuth(string platformAuth, out string reason)
|
|
{
|
|
reason = "unknown";
|
|
if (platformAuth[0] != '{' || platformAuth[^1] != '}')
|
|
{
|
|
reason = $"not a JSON object (len={platformAuth.Length})";
|
|
return false;
|
|
}
|
|
|
|
try
|
|
{
|
|
using var doc = JsonDocument.Parse(platformAuth);
|
|
var root = doc.RootElement;
|
|
if (root.ValueKind != JsonValueKind.Object)
|
|
{
|
|
reason = "platform_auth is valid JSON but not an object";
|
|
return false;
|
|
} if (!root.TryGetProperty("Ticket", out var ticketElement) || ticketElement.ValueKind != JsonValueKind.String)
|
|
{
|
|
reason = $"no string 'Ticket' property (properties: {DescribeProperties(root)})";
|
|
return false;
|
|
}
|
|
|
|
var ticket = ticketElement.GetString() ?? string.Empty;
|
|
if (ticket.Length == 0 || !ticket.StartsWith("140", StringComparison.Ordinal))
|
|
{
|
|
reason = $"'Ticket' has an unexpected format (len={ticket.Length})";
|
|
return false;
|
|
}
|
|
|
|
if (!root.TryGetProperty("AppId", out var appIdElement))
|
|
{
|
|
reason = $"no 'AppId' property (properties: {DescribeProperties(root)})";
|
|
return false;
|
|
}
|
|
|
|
var appId = appIdElement.ValueKind == JsonValueKind.String ? appIdElement.GetString() : appIdElement.ToString();
|
|
if (!SteamAllowedAppIds.Contains(appId, StringComparer.Ordinal))
|
|
{
|
|
reason = "'AppId' is not supported for Steam ticket verification";
|
|
return false;
|
|
}
|
|
|
|
reason = "ok";
|
|
return true;
|
|
}
|
|
catch (JsonException ex)
|
|
{
|
|
reason = $"invalid JSON ({ex.GetType().Name})";
|
|
return false;
|
|
}
|
|
}
|
|
|
|
|
|
[NonAction]
|
|
private static string DescribeProperties(JsonElement root)
|
|
{
|
|
var names = new List<string>();
|
|
foreach (var property in root.EnumerateObject())
|
|
names.Add(property.Name);
|
|
return names.Count == 0 ? "none" : string.Join(",", names);
|
|
}
|
|
|
|
[NonAction]
|
|
private async Task<AuthResponse> TokenRefresh(TokenConnectData data, bool verifiedByPassword = false)
|
|
{
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (data.account_id <= 0)
|
|
{
|
|
long resolvedAccountId = 0;
|
|
|
|
|
|
|
|
if (!string.IsNullOrWhiteSpace(data.refresh_token) &&
|
|
Guid.TryParse(data.refresh_token, out var tokenGuid))
|
|
{
|
|
var tokenBytes = tokenGuid.ToByteArray();
|
|
var embedded = BitConverter.ToInt64(tokenBytes, 0);
|
|
if (embedded > 0 && await db.Players.AnyAsync(x => x.AccountId == embedded))
|
|
resolvedAccountId = embedded;
|
|
}
|
|
|
|
|
|
|
|
if (resolvedAccountId <= 0)
|
|
{
|
|
var headerAuth = base.Request.Headers.Authorization.ToString();
|
|
if (!string.IsNullOrWhiteSpace(headerAuth))
|
|
{
|
|
var headerUserId = headerAuth.GetUserId();
|
|
if (headerUserId.HasValue && headerUserId.Value > 0 && await db.Players.AnyAsync(x => x.AccountId == headerUserId.Value))
|
|
resolvedAccountId = headerUserId.Value;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
if (resolvedAccountId <= 0)
|
|
{
|
|
if (!string.IsNullOrWhiteSpace(data.device_id))
|
|
{
|
|
var devicePlayer = await db.Players
|
|
.Where(x => x.DeviceId == data.device_id)
|
|
.OrderByDescending(x => x.AccountId)
|
|
.FirstOrDefaultAsync();
|
|
if (devicePlayer != null) resolvedAccountId = devicePlayer.AccountId;
|
|
}
|
|
else if (!string.IsNullOrWhiteSpace(data.platform_id))
|
|
{
|
|
var recentLogin = await db.CachedLogins
|
|
.Where(x => x.platformId == data.platform_id && x.platform == data.platform)
|
|
.OrderByDescending(x => x.lastLoginTime)
|
|
.FirstOrDefaultAsync();
|
|
if (recentLogin != null) resolvedAccountId = recentLogin.accountId;
|
|
}
|
|
}
|
|
|
|
if (resolvedAccountId > 0) data.account_id = resolvedAccountId; } PlayerData? player = await db.Players.FirstOrDefaultAsync(x => x.AccountId == data.account_id);
|
|
|
|
if (player == null)
|
|
{
|
|
var hasIdentity = await db.CachedLogins.AnyAsync(l => l.accountId == data.account_id)
|
|
|| await db.Profiles.AnyAsync(p => p.accountId == data.account_id);
|
|
if (hasIdentity)
|
|
{
|
|
|
|
player = new PlayerData
|
|
{
|
|
AccountId = data.account_id,
|
|
Phone = "",
|
|
AppVersion = data.ver ?? DBConfig.GameVersion,
|
|
DeviceClass = data.device_class,
|
|
NameChanges = 99,
|
|
Email = "",
|
|
Hashword = "",
|
|
JuniorState = JuniorState.BasedOnBirthday,
|
|
Visibility = StatusVisibility.Public,
|
|
DeviceId = data.device_id ?? "",
|
|
LastIpAddress = Request.GetClientIp() ?? ""
|
|
};
|
|
await db.AddRangeAsync(
|
|
player,
|
|
new PlayerAvatar { Avatar = DBConfig.DefaultAvatar, Outfits = "[]", AccountId = data.account_id },
|
|
new Reputation { AccountId = data.account_id },
|
|
new PlayerSettings { AccountId = data.account_id, Settings = DBConfig.NewAccountSettings2023 },
|
|
new ProgressionData { PlayerId = data.account_id, XP = 0, Level = 1, Progress = new ProgressionJson().ToJson() },
|
|
new RealPresence { playerId = data.account_id, deviceClass = data.device_class, statusVisibility = StatusVisibility.Public, vRMovementMode = VRMovementModes.TELEPORT },
|
|
new Currency { AccountId = data.account_id },
|
|
new PlayerUnlocks { AccountId = data.account_id, AvatarItems = DBConfig.DefaultAvatarUnlocks }
|
|
);
|
|
await db.SaveChangesAsync();
|
|
await RoomUtils.GetOrCreateDorm(data.account_id);
|
|
}
|
|
}
|
|
|
|
CachedLogin? cachedLogin = await db.CachedLogins.FirstOrDefaultAsync(
|
|
l => l.accountId == data.account_id &&
|
|
l.platformId == data.platform_id &&
|
|
l.platform == data.platform);
|
|
|
|
if (data.account_id == 1)
|
|
{
|
|
return new AuthResponse("Failed to login.", "System account cannot log in.");
|
|
}
|
|
if (player == null)
|
|
{
|
|
return new AuthResponse("Failed to login.", "Missing player data.");
|
|
}
|
|
|
|
if (await AccountLock.IsLockedAsync(db, data.account_id) && cachedLogin == null)
|
|
{
|
|
var lockedUsername = await AccountLock.ResolveUsernameAsync(db, data.account_id);
|
|
Console.WriteLine($"[{DateTime.Now:HH:mm:ss}] [Security] refused {data.grant_type} sign-in for locked account {data.account_id} (platform={data.platform}, platformId={data.platform_id})");
|
|
return new AuthResponse(AccountLock.ErrorCode, AccountLock.LoginErrorMessage(lockedUsername));
|
|
}
|
|
if (cachedLogin == null)
|
|
{
|
|
return new AuthResponse("Failed to login.", "Missing cached login.");
|
|
}
|
|
|
|
AuthResponse response = new AuthResponse();
|
|
string authorization = data.platform == Platforms.Standalone ? string.Empty : base.Request.Headers.Authorization.ToString();
|
|
|
|
bool hasToken = !string.IsNullOrEmpty(authorization);
|
|
bool isPlatform = false;
|
|
|
|
if (cachedLogin != null)
|
|
{
|
|
if (cachedLogin.platformId == data.platform_id &&
|
|
cachedLogin.platform == data.platform &&
|
|
(player.DeviceId == data.device_id || string.IsNullOrEmpty(player.DeviceId)) &&
|
|
data.client_id == "recroom")
|
|
{
|
|
isPlatform = true;
|
|
}
|
|
}
|
|
|
|
if (!hasToken && !isPlatform && !verifiedByPassword)
|
|
{
|
|
base.Response.StatusCode = 401;
|
|
return new AuthResponse("Failed to login.", "Invalid platform session.");
|
|
}
|
|
else
|
|
{
|
|
long userId = data.account_id;
|
|
if (hasToken)
|
|
{
|
|
var headerUserId = authorization.GetUserId();
|
|
if (headerUserId.HasValue)
|
|
{
|
|
userId = headerUserId.Value;
|
|
}
|
|
else
|
|
{
|
|
hasToken = false;
|
|
}
|
|
}
|
|
|
|
Success newToken = await GenerateToken(db, data.account_id, data.ver!, data.device_class, data.platform, data.platform_id);
|
|
player.DeviceId = data.device_id!;
|
|
|
|
|
|
if (data.device_class != DeviceClass.Unknown)
|
|
player.DeviceClass = data.device_class;
|
|
|
|
|
|
var loginIp = Request.GetClientIp();
|
|
if (!string.IsNullOrWhiteSpace(loginIp))
|
|
player.LastIpAddress = loginIp;
|
|
await db.SaveChangesAsync();
|
|
|
|
if (!newToken.success || newToken.value == null)
|
|
{
|
|
response = new AuthResponse
|
|
{
|
|
error = "Error",
|
|
error_description = newToken.error
|
|
};
|
|
return response;
|
|
}
|
|
else
|
|
{
|
|
response.access_token = (string)newToken.value;
|
|
if (data.platform == Platforms.Standalone)
|
|
Response.Headers[QuestRememberedSession.Header] = response.access_token;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
var accountBytes = BitConverter.GetBytes(data.account_id);
|
|
var refreshGuidBytes = new byte[16];
|
|
Array.Copy(accountBytes, 0, refreshGuidBytes, 0, 8); response.refresh_token = new Guid(refreshGuidBytes).ToString();
|
|
response.key = "c3Vja215ZGlja25nYQ==";
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return response;
|
|
}
|
|
}
|
|
}
|
|
|
|
[NonAction]
|
|
internal static async Task<Success> GenerateToken(RecDBContext db, long userId, string version, DeviceClass deviceClass, Platforms platform, string platformId)
|
|
{
|
|
|
|
CachedLogin? cachedLogin = await db.CachedLogins.FirstOrDefaultAsync(
|
|
login => login.accountId == userId &&
|
|
login.platformId == platformId &&
|
|
login.platform == platform);
|
|
|
|
Profile? profile = await db.Profiles.FirstOrDefaultAsync((plr) => plr.accountId == userId);
|
|
|
|
if (profile == null)
|
|
return AuthResponses.MissingProfile;
|
|
|
|
if (await AccountLock.IsLockedAsync(db, userId) && cachedLogin == null)
|
|
return new Success(false, AccountLock.ErrorCode, null);
|
|
RealPresence? presence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == userId);
|
|
if (presence == null) return AuthResponses.MissingPresence;
|
|
presence.deviceClass = deviceClass;
|
|
|
|
PlayerData? player = await db.Players.FirstOrDefaultAsync((plr) => plr.AccountId == userId);
|
|
if (player == null) return AuthResponses.MissingPlayer;
|
|
player.AppVersion = version;
|
|
|
|
if (cachedLogin != null)
|
|
{
|
|
cachedLogin.lastLoginTime = DateTime.UtcNow;
|
|
}
|
|
await db.SaveChangesAsync();
|
|
|
|
MatchmakingUtils.ClearInRoom(userId);
|
|
|
|
List<Claim> claims = new List<Claim>();
|
|
|
|
claims.Add(new Claim("iss", DBConfig.TokenIssuer));
|
|
claims.Add(new Claim("client_id", "recroom"));
|
|
claims.Add(new Claim("role", "gameClient"));
|
|
if (RadicadeServer.RecNet.Keepsakes.KeepsakeFeature.Enabled)
|
|
{
|
|
claims.Add(new Claim("role", "keepsake"));
|
|
claims.Add(new Claim("role", "livekeepsakeeventroomsaveoverride"));
|
|
}
|
|
claims.Add(new Claim("rn.plat", ((int)platform).ToString()));
|
|
claims.Add(new Claim("rn.platid", platformId));
|
|
claims.Add(new Claim("rn.deviceclass", deviceClass.ToString()));
|
|
claims.Add(new Claim("rn.ver", version));
|
|
claims.Add(new Claim("idp", "local"));
|
|
claims.Add(new Claim("userId", userId.ToString()));
|
|
claims.Add(new Claim(ClaimTypes.NameIdentifier, userId.ToString()));
|
|
|
|
|
|
|
|
claims.Add(new Claim("tver", player.TokenVersion.ToString()));
|
|
if (platform == Platforms.Standalone)
|
|
claims.Add(new Claim("q.pwd", QuestRememberedSession.PasswordVersion(player.Hashword)));
|
|
|
|
|
|
if (profile.isJunior || PlayerUtils.IsJuniorByBirthday(player.Birthday))
|
|
claims.Add(new Claim("role", "junior"));
|
|
if (profile.HasRole("developer")) claims.Add(new Claim("role", "developer"));
|
|
if (profile.HasRole("betastudio")) claims.Add(new Claim("role", "betastudio"));
|
|
if (profile.HasRole("moderator")) claims.Add(new Claim("role", "moderator"));
|
|
if (profile.HasRole("screenshare")) claims.Add(new Claim("role", "screenshare"));
|
|
if (profile.HasRole("influencer")) claims.Add(new Claim("role", "influencer"));
|
|
|
|
var tokenHandler = new JwtSecurityTokenHandler();
|
|
var key = Encoding.ASCII.GetBytes(DBConfig.JwtKey);
|
|
var tokenDescriptor = new SecurityTokenDescriptor
|
|
{
|
|
Subject = new ClaimsIdentity(claims.ToArray()),
|
|
Expires = DateTime.Now.AddDays(7),
|
|
SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
|
|
};
|
|
var token = tokenHandler.CreateToken(tokenDescriptor);
|
|
var tokenWritten = tokenHandler.WriteToken(token);
|
|
return new Success(true, null, tokenWritten);
|
|
}
|
|
}
|
|
}
|