OnlineSalesAutoCrop/Api/OnlineSalesAutoCrop.CoreAPI.Services/Services/Auth/RefreshTokenService.cs

using Ease.NetCore.DataAccess;
using Ease.NetCore.DataAccess.SQL;
using Microsoft.Data.SqlClient;
using Microsoft.Extensions.Options;
using OnlineSalesAutoCrop.CoreAPI.Models.Global;
using OnlineSalesAutoCrop.CoreAPI.Models.Objects.Systems;
using OnlineSalesAutoCrop.CoreAPI.Models.Requests.Integrations;
using OnlineSalesAutoCrop.CoreAPI.Models.Responses.Integrations;
using OnlineSalesAutoCrop.CoreAPI.Services.Contracts.Auth;
using System;
using System.Data;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

namespace OnlineSalesAutoCrop.CoreAPI.Services.Services.Auth;

public class RefreshTokenService : IRefreshTokenService
{
    private readonly AppSettings _settings;
    public RefreshTokenService(IOptions<AppSettings> settings)
    {
        _settings = settings.Value;
    }


    public async Task<bool> AddAsync(InsertRefreshTokenRequest refreshToken)
    {
        bool returnValue = false;
        try
        {
            using TransactionContext tc = await TransactionContext.BeginAsync(_settings.DefaultConnection.ConnectionNode, true);
            AddAsync(tc, refreshToken);

            tc.End();
        }
        catch (Exception e)
        {
            throw new InvalidOperationException(e.Message, e);
        }

        return returnValue;
    }

    private  bool AddAsync( TransactionContext tc, InsertRefreshTokenRequest refreshToken)
    {
        bool returnValue = false;

        try
        {
            SqlParameter[] p =
            [
                SqlHelperExtension.CreateInParam(pName: "@UserId", pType: SqlDbType.VarChar, pValue: refreshToken.UserId),
                SqlHelperExtension.CreateInParam(pName: "@TokenHash", pType: SqlDbType.VarChar, pValue: refreshToken.TokenHash),
                SqlHelperExtension.CreateInParam(pName: "@IpAddress", pType: SqlDbType.VarChar, pValue: refreshToken.IpAddress),
                SqlHelperExtension.CreateInParam(pName: "@CreatedAt", pType: SqlDbType.DateTime, pValue: DateTime.Now),
                SqlHelperExtension.CreateInParam(pName: "@ExpiredAt", pType: SqlDbType.DateTime, pValue: DateTime.Now.AddMinutes(_settings.RefreshTokenDuration)),
            ];
            _ = tc.ExecuteNonQuerySp(spName: "dbo.InsertRefreshToken", parameterValues: p);

            returnValue = true;
        }
        catch (Exception e)
        {
            throw new InvalidOperationException(e.Message, e);
        }

        return returnValue;
    }


    public async Task<RefreshTokenResponse> GetByTokenHashAsync(string tokenHash)
    {
        RefreshTokenResponse response = new();
        try
        {
            using TransactionContext tc = await TransactionContext.BeginAsync(_settings.DefaultConnection.ConnectionNode);
            try
            {
                await GetByTokenHashAsync(tc, tokenHash);
                tc.End();
            }
            catch (Exception ie)
            {
                tc?.HandleError();

                throw DBCustomError.GenerateCustomError(ie);
            }
        }
        catch (Exception e)
        {
            throw new InvalidOperationException(e.Message, e);
        }

        return response;
    }

    private async Task<RefreshTokenResponse> GetByTokenHashAsync(TransactionContext tc, string tokenHash)
    {
        RefreshTokenResponse response = new();
        try
        {
            SqlParameter[] p =
            [
               SqlHelperExtension.CreateInParam(pName: "@RefreshToken", pType: SqlDbType.VarChar, pValue: tokenHash),
            ];
            using (IDataReader dr = await tc.ExecuteReaderSpAsync("dbo.GetRefreshTokenByTokenHash", parameterValues: p))
            {
                if (dr.Read())
                {
                    response.UserId = dr.GetString(0);
                    response.TokenHash = dr.GetString(1);
                    response.IpAddress = dr.GetString(2);
                    response.ExpiredAt = dr.GetDateTime(3);
                    response.RevokedAt = dr.IsDBNull(4) ? null : dr.GetDateTime(4);
                }
                dr.Close();
            }
        }
        catch (Exception e)
        {
            throw new InvalidOperationException(e.Message, e);
        }

        return response;
    }

    public async Task<bool> RevokeAllForUserAsync(int userId)
    {
        bool returnValue = false;
        try
        {
            using TransactionContext tc = await TransactionContext.BeginAsync(_settings.DefaultConnection.ConnectionNode, true);
            try
            {
                SqlParameter[] p =
                [
                    SqlHelperExtension.CreateInParam(pName: "@UserId", pType: SqlDbType.Int, pValue: userId)
                ];
                _ = await tc.ExecuteNonQuerySpAsync(spName: "dbo.RevokedAllRefreshToken", parameterValues: p);

                returnValue = true;

                tc.End();
            }
            catch (Exception ie)
            {
                tc?.HandleError();

                throw DBCustomError.GenerateCustomError(ie);
            }
        }
        catch (Exception e)
        {
            throw new InvalidOperationException(e.Message, e);
        }

        return returnValue;
    }

    public async Task<bool> RevokeAsync(RevokedRefreshTokenRequest token)
    {
        bool returnValue = false;
        try
        {
            using TransactionContext tc = await TransactionContext.BeginAsync(_settings.DefaultConnection.ConnectionNode, true);
            try
            {
                returnValue = RevokeAsync(tc, token);

                tc.End();
            }
            catch (Exception ie)
            {
                tc?.HandleError();

                throw DBCustomError.GenerateCustomError(ie);
            }
        }
        catch (Exception e)
        {
            throw new InvalidOperationException(e.Message, e);
        }

        return returnValue;
    }

    private bool RevokeAsync(TransactionContext tc, RevokedRefreshTokenRequest token)
    {
        bool returnValue = false;
        try
        {
            SqlParameter[] p =
                [
                    SqlHelperExtension.CreateInParam(pName: "@RefreshToken", pType: SqlDbType.NVarChar, pValue: token.RefreshToken)
                ];
            _ = tc.ExecuteNonQuerySp(spName: "dbo.RevokedAllRefreshToken", parameterValues: p);

            returnValue = true;

        }
        catch (Exception e)
        {
            throw new InvalidOperationException(e.Message, e);
        }

        return returnValue;
    }
    public async Task<GenerateRefreshTokenResponse> GenerateRefreshToken(GenerateRefreshTokenRequest request)
    {
        GenerateRefreshTokenResponse refreshTokenResponse = new();
        try
        {
            using TransactionContext tc = await TransactionContext.BeginAsync(_settings.DefaultConnection.ConnectionNode, true);
            try
            {
                var tokenHash = HashToken(request.RawRefreshToken);

                var storedToken = await GetByTokenHashAsync(tc, tokenHash);

                if (storedToken.UserId is not null && !storedToken.IsActive)
                    throw new UnauthorizedAccessException("Refresh token has expired or been revoked.");

                // Rotate: revoke old token, issue new one
                RevokeAsync(tc,new RevokedRefreshTokenRequest() { RefreshToken = storedToken.TokenHash });

                refreshTokenResponse=  await IssueTokensAsync(tc,request.User, request.IpAddress);

                tc.End();
            }
            catch (Exception ie)
            {
                tc?.HandleError();

                throw DBCustomError.GenerateCustomError(ie);
            }
        }
        catch (Exception e)
        {
            throw new InvalidOperationException(e.Message, e);
        }

        return refreshTokenResponse;
    }


    // ----- private helpers -----

    private async Task<GenerateRefreshTokenResponse> IssueTokensAsync(TransactionContext tc, User user, string ipAddress)
    {
        string rawRefreshToken = GenerateRowToken();
        var refreshToken = new InsertRefreshTokenRequest
        {
            UserId = user.UserId,
            TokenHash = HashToken(rawRefreshToken),
            IpAddress = ipAddress,
            CreatedAt = DateTime.UtcNow,
            ExpiresAt = DateTime.UtcNow.AddDays(_settings.RefreshTokenDuration)
        };

        AddAsync(tc,refreshToken);

        return new GenerateRefreshTokenResponse
        {
            RefreshToken = rawRefreshToken,
            ExpireTime = DateTime.UtcNow.AddMinutes(_settings.RefreshTokenDuration)
        };
    }

    private static string HashToken(string token)
    {
        var bytes = SHA256.HashData(Encoding.UTF8.GetBytes(token));
        return Convert.ToBase64String(bytes);
    }

    private string GenerateRowToken()
    {
        var bytes = new byte[64];
        using var rng = RandomNumberGenerator.Create();
        rng.GetBytes(bytes);
        return Convert.ToBase64String(bytes);
    }
}