init with code from Foxnouns.NET

Hydra.Backend/Utils/AuthUtils.cs

@@ -0,0 +1,51 @@
+using System.Security.Cryptography;
+using Hydra.Backend.Database.Models;
+
+namespace Hydra.Backend.Utils;
+
+public static class AuthUtils
+{
+    public const string ClientCredentials = "client_credentials";
+    public const string AuthorizationCode = "authorization_code";
+    private static readonly string[] ForbiddenSchemes = ["javascript", "file", "data", "mailto", "tel"];
+
+    // TODO: add actual scopes
+    public static readonly string[] Scopes = ["*"];
+
+    public static bool ValidateScopes(Application application, string[] scopes)
+    {
+        return !scopes.Except(application.Scopes).Any();
+    }
+
+    public static bool ValidateRedirectUri(string uri)
+    {
+        try
+        {
+            var scheme = new Uri(uri).Scheme;
+            return !ForbiddenSchemes.Contains(scheme);
+        }
+        catch
+        {
+            return false;
+        }
+    }
+
+    public static bool TryFromBase64String(string b64, out byte[] bytes)
+    {
+        try
+        {
+            bytes = Convert.FromBase64String(b64);
+            return true;
+        }
+        catch
+        {
+            bytes = [];
+            return false;
+        }
+    }
+
+    public static string RandomToken(int bytes = 48) =>
+        Convert.ToBase64String(RandomNumberGenerator.GetBytes(bytes)).Trim('=');
+
+    public const int MaxAuthMethodsPerType = 3; // Maximum of 3 Discord accounts, 3 emails, etc
+}

Hydra.Backend/Utils/PatchRequest.cs

@@ -0,0 +1,35 @@
+using System.Reflection;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Serialization;
+
+namespace Hydra.Backend.Utils;
+
+/// <summary>
+/// A base class used for PATCH requests which stores information on whether a key is explicitly set to null or not passed at all.
+/// </summary>
+public abstract class PatchRequest
+{
+    private readonly HashSet<string> _properties = [];
+    public bool HasProperty(string propertyName) => _properties.Contains(propertyName);
+    public void SetHasProperty(string propertyName) => _properties.Add(propertyName);
+}
+
+/// <summary>
+/// A custom contract resolver to reduce the boilerplate needed to use <see cref="PatchRequest" />.
+/// Based on this StackOverflow answer: https://stackoverflow.com/a/58748036
+/// </summary>
+public class PatchRequestContractResolver : DefaultContractResolver
+{
+    protected override JsonProperty CreateProperty(MemberInfo member, MemberSerialization memberSerialization)
+    {
+        var prop = base.CreateProperty(member, memberSerialization);
+
+        prop.SetIsSpecified += (o, _) =>
+        {
+            if (o is not PatchRequest patchRequest) return;
+            patchRequest.SetHasProperty(prop.UnderlyingName!);
+        };
+
+        return prop;
+    }
+}

Hydra.Backend/Utils/StartupExtensions.cs

@@ -0,0 +1,73 @@
+using Hydra.Backend.Middleware;
+using Serilog;
+using Serilog.Events;
+
+namespace Hydra.Backend.Utils;
+
+public static class StartupExtensions
+{
+    /// <summary>
+    /// Adds Serilog to this service collection. This method also initializes Serilog, so it should be called as early as possible, before any log calls.
+    /// </summary>
+    public static WebApplicationBuilder AddSerilog(this WebApplicationBuilder builder)
+    {
+        var config = builder.Configuration.Get<Config>() ?? new();
+
+        var logCfg = new LoggerConfiguration()
+            .Enrich.FromLogContext()
+            .Enrich.WithEnvironmentName()
+            .Enrich.WithMachineName()
+            .Enrich.WithProcessId()
+            .Enrich.WithProcessName()
+            .MinimumLevel.Is(config.Logging.LogEventLevel)
+            // ASP.NET's built in request logs are extremely verbose, so we use Serilog's instead.
+            // Serilog doesn't disable the built-in logs, so we do it here.
+            .MinimumLevel.Override("Microsoft", LogEventLevel.Information)
+            .MinimumLevel.Override("Microsoft.EntityFrameworkCore.Database.Command",
+                config.Logging.LogQueries ? LogEventLevel.Information : LogEventLevel.Fatal)
+            .MinimumLevel.Override("Microsoft.AspNetCore.Hosting", LogEventLevel.Warning)
+            .MinimumLevel.Override("Microsoft.AspNetCore.Mvc", LogEventLevel.Warning)
+            .MinimumLevel.Override("Microsoft.AspNetCore.Routing", LogEventLevel.Warning)
+            .MinimumLevel.Override("Hangfire", LogEventLevel.Information)
+            .WriteTo.Console();
+
+        if (config.Logging.SeqLogUrl != null)
+        {
+            logCfg.WriteTo.Seq(config.Logging.SeqLogUrl, restrictedToMinimumLevel: LogEventLevel.Verbose);
+        }
+
+        // AddSerilog doesn't seem to add an ILogger to the service collection, so add that manually.
+        builder.Services.AddSerilog().AddSingleton(Log.Logger = logCfg.CreateLogger());
+
+        return builder;
+    }
+
+    public static IServiceCollection AddCustomMiddleware(this IServiceCollection services) => services
+        .AddScoped<AuthenticationMiddleware>()
+        .AddScoped<AuthorizationMiddleware>();
+
+    public static IApplicationBuilder UseCustomMiddleware(this IApplicationBuilder app) => app
+        .UseMiddleware<AuthenticationMiddleware>()
+        .UseMiddleware<AuthorizationMiddleware>();
+
+    public static Config AddConfiguration(this WebApplicationBuilder builder, string[] args)
+    {
+        builder.Configuration.Sources.Clear();
+        builder.Configuration.AddConfiguration(args);
+
+        var config = builder.Configuration.Get<Config>() ?? new();
+        builder.Services.AddSingleton(config);
+        return config;
+    }
+
+    public static IConfigurationBuilder AddConfiguration(this IConfigurationBuilder builder, string[] args)
+    {
+        var file = Environment.GetEnvironmentVariable("HDYRA_CONFIG_FILE") ?? "config.ini";
+
+        return builder
+            .SetBasePath(Directory.GetCurrentDirectory())
+            .AddIniFile(file, optional: false, reloadOnChange: true)
+            .AddEnvironmentVariables()
+            .AddCommandLine(args);
+    }
+}