CryptographySuite.cs

Go to the documentation of this file.

using System;
using System.Globalization;
using System.Security.Cryptography;
 
using Microsoft.AspNetCore.Identity;
 
using Tgstation.Server.Host.Models;
 
namespace Tgstation.Server.Host.Security
{
    sealed class CryptographySuite : ICryptographySuite
    {
        const uint SecureStringLength = 30;
 
        readonly IPasswordHasher<User> passwordHasher;
 
        public CryptographySuite(IPasswordHasher<User> passwordHasher)
        {
            this.passwordHasher = passwordHasher ?? throw new ArgumentNullException(nameof(passwordHasher));
        }
 
        public byte[] GetSecureBytes(uint amount)
        {
            using var rng = RandomNumberGenerator.Create(); // uses RNGCryptoServiceProvider under the hood https://khalidabuhakmeh.com/creating-random-numbers-with-dotnet-core
            var byt = new byte[amount];
            rng.GetBytes(byt);
            return byt;
        }
 
        public void SetUserPassword(User user, string newPassword, bool newUser)
        {
            ArgumentNullException.ThrowIfNull(user);
            ArgumentNullException.ThrowIfNull(newPassword);
            user.PasswordHash = passwordHasher.HashPassword(user, newPassword);
            if (!newUser)
                user.LastPasswordUpdate = DateTimeOffset.UtcNow;
        }
 
        public bool CheckUserPassword(User user, string password)
        {
            ArgumentNullException.ThrowIfNull(user);
            ArgumentNullException.ThrowIfNull(password);
 
            if (user.PasswordHash == null)
                throw new ArgumentException("user must have PasswordHash!", nameof(user));
 
            var result = passwordHasher.VerifyHashedPassword(user, user.PasswordHash, password);
            switch (result)
            {
                case PasswordVerificationResult.Failed:
                    return false;
                case PasswordVerificationResult.SuccessRehashNeeded:
                    SetUserPassword(user, password, false);
                    break;
                case PasswordVerificationResult.Success:
                    break;
                default:
                    throw new InvalidOperationException(String.Format(CultureInfo.InvariantCulture, "Password hasher return unknown PasswordVerificationResult: {0}", result));
            }
 
            return true;
        }
 
        public string GetSecureString() => Convert.ToBase64String(GetSecureBytes(SecureStringLength));
    }
}