Add session handling component

Author: Kaliumhexacyanoferrat

API/Protocol/IResponse.cs

@@ -52,6 +52,12 @@ public interface IResponse : IDisposable
         /// </summary>
         bool HasCookies { get; }
 
+        /// <summary>
+        /// Adds the given cookie to the cookie collection of this response.
+        /// </summary>
+        /// <param name="cookie">The cookie to be added</param>
+        void SetCookie(Cookie cookie);
+
         #endregion
 
         #region Content

Engine/Protocol/Response.cs

@@ -76,6 +76,15 @@ internal Response()
 
         #endregion
 
+        #region Functionality
+
+        public void SetCookie(Cookie cookie)
+        {
+            WriteableCookies[cookie.Name] = cookie;
+        }
+
+        #endregion
+
         #region IDisposable Support
 
         private bool disposed = false;

Modules/Authentication.Web/Concern/WebAuthenticationBuilder.cs

@@ -1,15 +1,32 @@
 using GenHTTP.Api.Content;
+using GenHTTP.Api.Infrastructure;
 using System;
 
 namespace GenHTTP.Modules.Authentication.Web.Concern
 {
 
     public sealed class WebAuthenticationBuilder : IConcernBuilder
     {
+        private bool _AllowAnonymous;
+
+        private SessionConfig? _SessionConfig;
+
         private SetupConfig? _SetupConfig;
 
         #region Functionality
 
+        public WebAuthenticationBuilder AllowAnonymous()
+        {
+            _AllowAnonymous = true;
+            return this;
+        }
+
+        public WebAuthenticationBuilder SessionHandling(SessionConfig sessionConfig)
+        {
+            _SessionConfig = sessionConfig;
+            return this;
+        }
+
         public WebAuthenticationBuilder EnableSetup(SetupConfig setupConfig)
         {
             _SetupConfig = setupConfig;
@@ -18,7 +35,9 @@ public WebAuthenticationBuilder EnableSetup(SetupConfig setupConfig)
 
         public IConcern Build(IHandler parent, Func<IHandler, IHandler> contentFactory)
         {
-            return new WebAuthenticationConcern(parent, contentFactory, _SetupConfig);
+            var sessionConfig = _SessionConfig ?? throw new BuilderMissingPropertyException("Sessions");
+
+            return new WebAuthenticationConcern(parent, contentFactory, _AllowAnonymous, sessionConfig, _SetupConfig);
         }
 
         #endregion

Modules/Authentication.Web/Concern/WebAuthenticationConcern.cs

@@ -1,7 +1,9 @@
 using GenHTTP.Api.Content;
+using GenHTTP.Api.Content.Authentication;
 using GenHTTP.Api.Protocol;
 using GenHTTP.Api.Routing;
 using GenHTTP.Modules.Basics;
+using Microsoft.AspNetCore.Razor.Language.Intermediate;
 using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
@@ -18,6 +20,10 @@ public sealed class WebAuthenticationConcern : IConcern, IRootPathAppender, IHan
 
         public IHandler Parent { get; }
 
+        private bool AllowAnonymous { get; }
+
+        private SessionConfig SessionConfig { get; }
+
         private SetupConfig? SetupConfig { get; }
 
         private IHandler? SetupHandler { get; }
@@ -26,12 +32,15 @@ public sealed class WebAuthenticationConcern : IConcern, IRootPathAppender, IHan
 
         #region Initialization
 
-        public WebAuthenticationConcern(IHandler parent, Func<IHandler, IHandler> contentFactory,
-                                        SetupConfig? setupConfig)
+        public WebAuthenticationConcern(IHandler parent, Func<IHandler, IHandler> contentFactory, bool allowAnonymous,
+                                        SessionConfig sessionConfig, SetupConfig? setupConfig)
         {
             Parent = parent;
             Content = contentFactory(this);
 
+            AllowAnonymous = allowAnonymous;
+            SessionConfig = sessionConfig;
+
             SetupConfig = setupConfig;
             SetupHandler = setupConfig?.Handler.Build(this);
         }
@@ -54,6 +63,7 @@ public WebAuthenticationConcern(IHandler parent, Func<IHandler, IHandler> conten
                 {
                     if (segment?.Value != SetupConfig.Route)
                     {
+                        // enforce setup wizard
                         return await Redirect.To("{setup}/", true)
                                              .Build(this)
                                              .HandleAsync(request);
@@ -67,9 +77,44 @@ public WebAuthenticationConcern(IHandler parent, Func<IHandler, IHandler> conten
                         return await SetupHandler.HandleAsync(request);
                     }
                 }
+                else if (segment?.Value == SetupConfig.Route) 
+                {
+                    // do not allow setup to be called again
+                    return await Redirect.To("{web-auth}", true)
+                                         .Build(this)
+                                         .HandleAsync(request);
+                }
             }
 
-            return await Content.HandleAsync(request);
+            var token = await SessionConfig.ReadToken(request);
+
+            if (token != null)
+            {
+                var authenticatedUser = await SessionConfig.VerifyToken(token);
+
+                if (authenticatedUser != null)
+                {
+                    // we're logged in
+                    return await Content.HandleAsync(request);
+                }
+            }
+
+            if (AllowAnonymous)
+            {
+                var response = await Content.HandleAsync(request);
+
+                if ((response != null) && (token != null))
+                {
+                    // clear the invalid cookie
+                    SessionConfig.ClearToken(response);
+                }
+
+                return null;
+            }
+
+            // enforce login (todo)
+
+            return null;
         }
 
         public void Append(PathBuilder path, IRequest request, IHandler? child = null)

Modules/Authentication.Web/GenHTTP.Modules.Authentication.Web.csproj

@@ -54,8 +54,4 @@
 
   </ItemGroup>
 
-  <ItemGroup>
-    <Folder Include="Sessions\" />
-  </ItemGroup>
-
 </Project>

Modules/Authentication.Web/ISessionNegotiation.cs

@@ -0,0 +1,61 @@
+using System;
+using System.Threading.Tasks;
+
+using GenHTTP.Api.Content.Authentication;
+using GenHTTP.Api.Protocol;
+
+namespace GenHTTP.Modules.Authentication.Web
+{
+
+    public record class SessionConfig
+    (
+
+        Func<IRequest, ValueTask<string?>> ReadToken,
+
+        Action<IResponseBuilder, string> WriteToken,
+
+        Action<IResponse> ClearToken,
+
+        Func<string, ValueTask<IUser?>> VerifyToken
+
+    );
+
+    public static class SessionHandling
+    {
+        private const string COOKIE_NAME = "wa_session";
+
+        private const ulong COOKIE_TIMEOUT = 2592000; // 30d
+
+        public static SessionConfig BuiltIn(Func<string, ValueTask<IUser?>> verifyToken)
+        {
+            return new(ReadToken, WriteToken, ClearToken, verifyToken);
+        }
+
+        public static SessionConfig Custom(Func<IRequest, ValueTask<string?>> readToken, Action<IResponseBuilder, string> writeToken, Action<IResponse> clearToken, Func<string, ValueTask<IUser?>> verifyToken)
+        {
+            return new(readToken, writeToken, clearToken, verifyToken);
+        }
+
+        private static ValueTask<string?> ReadToken(IRequest request)
+        {
+            if (request.Cookies.TryGetValue(COOKIE_NAME, out var token))
+            {
+                return new(token.Value);
+            }
+
+            return new();
+        }
+
+        private static void WriteToken(IResponseBuilder response, string value)
+        {
+            response.Cookie(new(COOKIE_NAME, value, COOKIE_TIMEOUT));
+        }
+
+        private static void ClearToken(IResponse response)
+        {
+            response.SetCookie(new(COOKIE_NAME, string.Empty, 0));
+        }
+
+    }
+
+}

Modules/Authentication.Web/SessionHandling.cs

@@ -11,7 +11,13 @@
     performSetup: (req, u, p) => { setupDone = true; return new(SetupResult.Success); }
 );
 
+var sessionHandling = SessionHandling.BuiltIn
+(
+    verifyToken: (token) => new()
+);
+
 var auth = WebAuthentication.Create()
+                            .SessionHandling(sessionHandling)
                             .EnableSetup(setup);
 
 Host.Create()