NFC-99 Web eID for Mobile authentication support for web-eid example

Signed-off-by: Sander Kondratjev <[email protected]>

Author: SanderKondratjevNortal

example/src/WebEid.AspNetCore.Example/Controllers/Api/MobileAuthController.cs

@@ -0,0 +1,93 @@
+// Copyright (c) 2021-2024 Estonian Information System Authority
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of
+// this software and associated documentation files (the "Software"), to deal in
+// the Software without restriction, including without limitation the rights to
+// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+// the Software, and to permit persons to whom the Software is furnished to do so,
+// subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+namespace WebEid.AspNetCore.Example.Controllers.Api
+{
+    using System;
+    using System.Text;
+    using Microsoft.AspNetCore.Mvc;
+    using Microsoft.Extensions.Options;
+    using System.Text.Json;
+    using System.Text.Json.Serialization;
+    using WebEid.AspNetCore.Example.Options;
+    using WebEid.Security.Challenge;
+    
+    [ApiController]
+    [Route("auth/mobile")]
+    public class MobileAuthController : ControllerBase
+    {
+        private const string WebEidMobileAuthPath = "auth";
+        private const string MobileLoginPath = "/auth/mobile/login";
+
+        private readonly IChallengeNonceGenerator nonceGenerator;
+        private readonly WebEidMobileOptions mobileOptions;
+
+        public MobileAuthController(
+            IChallengeNonceGenerator nonceGenerator,
+            IOptions<WebEidMobileOptions> mobileOptions)
+        {
+            this.nonceGenerator = nonceGenerator;
+            this.mobileOptions = mobileOptions.Value;
+        }
+
+        [HttpPost("init")]
+        public IActionResult Init()
+        {
+            var challenge = nonceGenerator.GenerateAndStoreNonce(TimeSpan.FromMinutes(5));
+            var challengeBase64 = challenge.Base64EncodedNonce;
+
+            var loginUri = $"{Request.Scheme}://{Request.Host}{MobileLoginPath}";
+
+            var payload = new AuthPayload(
+                challengeBase64,
+                loginUri,
+                mobileOptions.RequestSigningCert ? true : null
+            );
+
+            var json = JsonSerializer.Serialize(payload);
+            var encodedPayload = Convert.ToBase64String(Encoding.UTF8.GetBytes(json));
+
+            var authUri = BuildAuthUri(encodedPayload);
+
+            return Ok(new AuthUri(authUri));
+        }
+
+        private string BuildAuthUri(string encodedPayload)
+        {
+            var baseUri = mobileOptions.BaseRequestUri;
+
+            if (baseUri.StartsWith("http", StringComparison.OrdinalIgnoreCase))
+            {
+                return $"{baseUri.TrimEnd('/')}/{WebEidMobileAuthPath}#{encodedPayload}";
+            }
+            
+            return $"{baseUri}{WebEidMobileAuthPath}#{encodedPayload}";
+        }
+
+        public record AuthPayload(
+            [property: JsonPropertyName("challenge")] string Challenge,
+            [property: JsonPropertyName("login_uri")] string LoginUri,
+            [property: JsonPropertyName("get_signing_certificate")] bool? GetSigningCertificate
+        );
+
+        public record AuthUri(
+            [property: JsonPropertyName("auth_uri")] string AuthUriValue
+        );
+    }
+}

example/src/WebEid.AspNetCore.Example/Dto/AuthenticateRequestDto.cs

@@ -24,7 +24,13 @@
 
     public class AuthenticateRequestDto
     {
-        [JsonPropertyName("auth-token")]
-        public WebEidAuthToken AuthToken { get; set; }
+        // Mobile version uses "auth_token"
+        [JsonPropertyName("auth_token")] public WebEidAuthToken AuthTokenUnderscore { get; set; }
+
+        // Desktop version uses "auth-token"
+        [JsonPropertyName("auth-token")] public WebEidAuthToken AuthTokenDash { get; set; }
+
+        // Unified property for backend logic
+        [JsonIgnore] public WebEidAuthToken AuthToken => AuthTokenDash ?? AuthTokenUnderscore;
     }
 }

example/src/WebEid.AspNetCore.Example/Options/WebEidMobileOptions.cs

@@ -0,0 +1,32 @@
+// Copyright (c) 2021-2024 Estonian Information System Authority
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of
+// this software and associated documentation files (the "Software"), to deal in
+// the Software without restriction, including without limitation the rights to
+// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+// the Software, and to permit persons to whom the Software is furnished to do so,
+// subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+namespace WebEid.AspNetCore.Example.Options
+{
+    using System.ComponentModel.DataAnnotations;
+
+    public class WebEidMobileOptions
+    {
+        [Required]
+        [RegularExpression("^.*(?:[^/]|://)$", ErrorMessage = "Base URI must not have a trailing slash")]
+        public string BaseRequestUri { get; set; } = null!;
+
+        public bool RequestSigningCert { get; set; }
+    }
+}