Remove Original Options from AuthFlowContext and Refactor Session Validation, Fix Mode Based Options not Using

Author: mckaragoz

src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionIssuanceContext.cs

@@ -1,5 +1,6 @@
 using CodeBeam.UltimateAuth.Core.Domain;
 using CodeBeam.UltimateAuth.Core.MultiTenancy;
+using CodeBeam.UltimateAuth.Core.Options;
 
 namespace CodeBeam.UltimateAuth.Core.Contracts;
 
@@ -16,6 +17,7 @@ public sealed class SessionIssuanceContext
     public ClaimsSnapshot? Claims { get; init; }
     public required SessionMetadata Metadata { get; init; }
     public required UAuthMode Mode { get; init; }
+    public required UAuthSessionOptions SessionOptions { get; init; }
 
     /// <summary>
     /// Optional chain identifier.

src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionRotationContext.cs

@@ -1,5 +1,6 @@
 using CodeBeam.UltimateAuth.Core.Domain;
 using CodeBeam.UltimateAuth.Core.MultiTenancy;
+using CodeBeam.UltimateAuth.Core.Options;
 
 namespace CodeBeam.UltimateAuth.Core.Contracts;
 
@@ -13,4 +14,5 @@ public sealed record SessionRotationContext
     public ClaimsSnapshot? Claims { get; init; }
     public required SessionMetadata Metadata { get; init; } = SessionMetadata.Empty;
     public required UAuthMode Mode { get; init; }
+    public required UAuthSessionOptions SessionOptions { get; init; }
 }

src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionValidationContext.cs

@@ -1,5 +1,6 @@
 using CodeBeam.UltimateAuth.Core.Domain;
 using CodeBeam.UltimateAuth.Core.MultiTenancy;
+using CodeBeam.UltimateAuth.Core.Options;
 
 namespace CodeBeam.UltimateAuth.Core.Contracts;
 
@@ -9,4 +10,9 @@ public sealed record SessionValidationContext
     public AuthSessionId SessionId { get; init; }
     public DateTimeOffset Now { get; init; }
     public required DeviceContext Device { get; init; }
+
+    /// <summary>
+    /// Required session options for validation. Remote session validators may not include.
+    /// </summary>
+    public UAuthSessionOptions? SessionOptions { get; init; }
 }

src/CodeBeam.UltimateAuth.Server/Auth/Context/AuthFlowContext.cs

@@ -21,8 +21,7 @@ public sealed class AuthFlowContext
     public bool IsAuthenticated { get; }
     public UserKey? UserKey { get; }
 
-    public UAuthServerOptions OriginalOptions { get; }
-    public EffectiveUAuthServerOptions EffectiveOptions { get; }
+    public UAuthServerOptions Options { get; }
 
     public EffectiveAuthResponse Response { get; }
     public ReturnUrlInfo ReturnUrlInfo { get; }
@@ -46,8 +45,7 @@ internal AuthFlowContext(
         bool isAuthenticated,
         UserKey? userKey,
         SessionSecurityContext? session,
-        UAuthServerOptions originalOptions,
-        EffectiveUAuthServerOptions effectiveOptions,
+        UAuthServerOptions options,
         EffectiveAuthResponse response,
         PrimaryTokenKind primaryTokenKind,
         ReturnUrlInfo returnUrlInfo)
@@ -65,8 +63,7 @@ internal AuthFlowContext(
         IsAuthenticated = isAuthenticated;
         UserKey = userKey;
 
-        OriginalOptions = originalOptions;
-        EffectiveOptions = effectiveOptions;
+        Options = options;
 
         Response = response;
         PrimaryTokenKind = primaryTokenKind;

src/CodeBeam.UltimateAuth.Server/Auth/Context/AuthFlowContextFactory.cs

@@ -2,7 +2,6 @@
 using CodeBeam.UltimateAuth.Core.Contracts;
 using CodeBeam.UltimateAuth.Core.Domain;
 using CodeBeam.UltimateAuth.Core.Infrastructure;
-using CodeBeam.UltimateAuth.Core.MultiTenancy;
 using CodeBeam.UltimateAuth.Core.Options;
 using CodeBeam.UltimateAuth.Server.Abstractions;
 using CodeBeam.UltimateAuth.Server.Extensions;
@@ -50,19 +49,20 @@ public async ValueTask<AuthFlowContext> CreateAsync(HttpContext ctx, AuthFlowTyp
         var user = ctx.GetUserContext();
 
         var clientProfile = await _clientProfileReader.ReadAsync(ctx);
-        var originalOptions = _serverOptionsProvider.GetOriginal(ctx);
-        var effectiveOptions = _serverOptionsProvider.GetEffective(ctx, flowType, clientProfile);
 
-        var allowedModes = originalOptions.AllowedModes;
+        var effective = _serverOptionsProvider.GetEffective(ctx, clientProfile);
+        var options = effective.Options;
 
-        if (allowedModes is { Count: > 0 } && !allowedModes.Contains(effectiveOptions.Mode))
+        var effectiveMode = effective.Mode;
+        var allowedModes = options.AllowedModes;
+
+        if (allowedModes is { Count: > 0 } && !allowedModes.Contains(effectiveMode))
         {
-            throw new InvalidOperationException($"Auth mode '{effectiveOptions.Mode}' is not allowed by server configuration.");
+            throw new InvalidOperationException($"Auth mode '{effectiveMode}' is not allowed by server configuration.");
         }
 
-        var effectiveMode = effectiveOptions.Mode;
         var primaryTokenKind = _primaryTokenResolver.Resolve(effectiveMode);
-        var response = _authResponseResolver.Resolve(effectiveMode, flowType, clientProfile, effectiveOptions);
+        var response = _authResponseResolver.Resolve(effectiveMode, flowType, clientProfile, effective);
         var deviceInfo = await _deviceResolver.ResolveAsync(ctx);
         var deviceContext = _deviceContextFactory.Create(deviceInfo);
         var returnUrl = await ctx.GetReturnUrlAsync();
@@ -78,6 +78,7 @@ public async ValueTask<AuthFlowContext> CreateAsync(HttpContext ctx, AuthFlowTyp
                     Tenant = tenant,
                     SessionId = sessionCtx.SessionId!.Value,
                     Device = deviceContext,
+                    SessionOptions = options.Session,
                     Now = _clock.UtcNow
                 },
                 ct);
@@ -100,8 +101,7 @@ public async ValueTask<AuthFlowContext> CreateAsync(HttpContext ctx, AuthFlowTyp
             user?.IsAuthenticated ?? false,
             user?.UserId,
             sessionSecurityContext,
-            originalOptions,
-            effectiveOptions,
+            options,
             response,
             primaryTokenKind,
             returnUrlInfo
@@ -113,19 +113,19 @@ public async ValueTask<AuthFlowContext> RecreateWithClientProfileAsync(AuthFlowC
         var flowType = existing.FlowType;
         var tenant = existing.Tenant;
 
-        var originalOptions = existing.OriginalOptions;
-        var effectiveOptions = _serverOptionsProvider.GetEffective(tenant, flowType, overriddenProfile);
+        var effective = _serverOptionsProvider.GetEffective(tenant, overriddenProfile);
+        var options = effective.Options;
+        var effectiveMode = effective.Mode;
 
-        var allowedModes = originalOptions.AllowedModes;
+        var allowedModes = options.AllowedModes;
 
-        if (allowedModes is { Count: > 0 } && !allowedModes.Contains(effectiveOptions.Mode))
+        if (allowedModes is { Count: > 0 } && !allowedModes.Contains(effectiveMode))
         {
-            throw new InvalidOperationException($"Auth mode '{effectiveOptions.Mode}' is not allowed by server configuration.");
+            throw new InvalidOperationException($"Auth mode '{effectiveMode}' is not allowed by server configuration.");
         }
 
-        var effectiveMode = effectiveOptions.Mode;
         var primaryTokenKind = _primaryTokenResolver.Resolve(effectiveMode);
-        var response = _authResponseResolver.Resolve(effectiveMode, flowType, overriddenProfile, effectiveOptions);
+        var response = _authResponseResolver.Resolve(effectiveMode, flowType, overriddenProfile, effective);
 
         var returnUrlInfo = existing.ReturnUrlInfo;
         var deviceContext = existing.Device;
@@ -140,8 +140,7 @@ public async ValueTask<AuthFlowContext> RecreateWithClientProfileAsync(AuthFlowC
             existing.IsAuthenticated,
             existing.UserKey,
             session,
-            originalOptions,
-            effectiveOptions,
+            options,
             response,
             primaryTokenKind,
             returnUrlInfo
@@ -162,8 +161,7 @@ public ValueTask<AuthFlowContext> RecreateWithDeviceAsync(AuthFlowContext existi
             existing.IsAuthenticated,
             existing.UserKey,
             existing.Session,
-            existing.OriginalOptions,
-            existing.EffectiveOptions,
+            existing.Options,
             existing.Response,
             existing.PrimaryTokenKind,
             existing.ReturnUrlInfo

src/CodeBeam.UltimateAuth.Server/Auth/EffectiveServerOptionsProvider.cs

@@ -24,16 +24,16 @@ public UAuthServerOptions GetOriginal(HttpContext context)
         return _baseOptions.Value;
     }
 
-    public EffectiveUAuthServerOptions GetEffective(HttpContext context, AuthFlowType flowType, UAuthClientProfile clientProfile)
+    public EffectiveUAuthServerOptions GetEffective(HttpContext context, UAuthClientProfile clientProfile)
     {
         var tenant = context.GetTenant();
-        return GetEffective(tenant, flowType, clientProfile);
+        return GetEffective(tenant, clientProfile);
     }
 
-    public EffectiveUAuthServerOptions GetEffective(TenantKey tenant, AuthFlowType flowType, UAuthClientProfile clientProfile)
+    public EffectiveUAuthServerOptions GetEffective(TenantKey tenant, UAuthClientProfile clientProfile)
     {
         var original = _baseOptions.Value;
-        var effectiveMode = _modeResolver.Resolve(clientProfile, flowType);
+        var effectiveMode = _modeResolver.Resolve(clientProfile);
         var options = original.Clone();
 
         ConfigureDefaults.ApplyModeDefaults(effectiveMode, options);

src/CodeBeam.UltimateAuth.Server/Auth/Response/EffectiveAuthModeResolver.cs

@@ -6,7 +6,7 @@ namespace CodeBeam.UltimateAuth.Server.Auth;
 
 internal sealed class EffectiveAuthModeResolver : IEffectiveAuthModeResolver
 {
-    public UAuthMode Resolve(UAuthClientProfile clientProfile, AuthFlowType flowType)
+    public UAuthMode Resolve(UAuthClientProfile clientProfile)
     {
         return clientProfile switch
         {

src/CodeBeam.UltimateAuth.Server/Auth/Response/IEffectiveAuthModeResolver.cs

@@ -6,5 +6,5 @@ namespace CodeBeam.UltimateAuth.Server.Auth;
 
 public interface IEffectiveAuthModeResolver
 {
-    UAuthMode Resolve(UAuthClientProfile clientProfile, AuthFlowType flowType);
+    UAuthMode Resolve(UAuthClientProfile clientProfile);
 }

src/CodeBeam.UltimateAuth.Server/Authentication/AspNetCore/UAuthAuthenticationHandler.cs

@@ -61,6 +61,7 @@ protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
                 Tenant = tenant,
                 SessionId = sessionId,
                 Device = _deviceContextFactory.Create(credential.Device),
+                SessionOptions = _serverOptions.Session,
                 Now = _clock.UtcNow
             });
 

src/CodeBeam.UltimateAuth.Server/Authentication/AspNetCore/UAuthResourceAuthenticationHandler.cs

@@ -1,8 +1,10 @@
 using CodeBeam.UltimateAuth.Core.Abstractions;
 using CodeBeam.UltimateAuth.Core.Contracts;
 using CodeBeam.UltimateAuth.Core.Domain;
+using CodeBeam.UltimateAuth.Server.Auth;
 using CodeBeam.UltimateAuth.Server.Extensions;
 using CodeBeam.UltimateAuth.Server.Infrastructure;
+using CodeBeam.UltimateAuth.Server.Options;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;