From 73545a16bdea6c9e928d09d48b9221b7462b0c33 Mon Sep 17 00:00:00 2001 From: StuartFerguson Date: Tue, 27 Oct 2026 19:44:58 +0000 Subject: [PATCH 1/4] fix repeating string value --- .../RequestHandlers/LoginRequestHandler.cs | 137 ++++++++---------- 1 file changed, 63 insertions(+), 74 deletions(-) diff --git a/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs b/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs index ac79fec..32dd328 100644 --- a/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs +++ b/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs @@ -27,8 +27,7 @@ public LoginRequestHandler(SignInManager signInManager, IMfaPolicyService mfaPolicyService, MfaAccountService mfaAccountService, MfaSignInTransactionProtector transactionProtector, - MfaEnrollmentTransactionProtector enrollmentTransactionProtector) - { + MfaEnrollmentTransactionProtector enrollmentTransactionProtector) { this.SignInManager = signInManager; this.UserManager = userManager; this.MfaPolicyService = mfaPolicyService; @@ -37,100 +36,94 @@ public LoginRequestHandler(SignInManager signInManager, this.EnrollmentTransactionProtector = enrollmentTransactionProtector; } - public async Task>> Handle(SecurityServiceQueries.GetExternalProvidersQuery query, CancellationToken cancellationToken) - { - var providers = (await this.SignInManager.GetExternalAuthenticationSchemesAsync()) - .Select(scheme => new ExternalProviderDetails(scheme.Name, scheme.DisplayName ?? scheme.Name)) - .OrderBy(provider => provider.DisplayName, StringComparer.OrdinalIgnoreCase) - .ToList(); + public async Task>> Handle(SecurityServiceQueries.GetExternalProvidersQuery query, CancellationToken cancellationToken) { + List providers = (await this.SignInManager.GetExternalAuthenticationSchemesAsync()) + .Select(scheme => new ExternalProviderDetails(scheme.Name, scheme.DisplayName ?? scheme.Name)) + .OrderBy(provider => provider.DisplayName, StringComparer.OrdinalIgnoreCase) + .ToList(); return Result.Success(providers); } - public async Task Handle(SecurityServiceCommands.LoginCommand command, CancellationToken cancellationToken) - { - var result = await this.SignInManager.PasswordSignInAsync(command.Username, command.Password, command.RememberLogin, lockoutOnFailure: true); + public async Task Handle(SecurityServiceCommands.LoginCommand command, CancellationToken cancellationToken) { + SignInResult result = await this.SignInManager.PasswordSignInAsync(command.Username, command.Password, command.RememberLogin, lockoutOnFailure: true); - if (result.Succeeded) - { + if (result.Succeeded) { return Result.Success(); } - if (result.IsLockedOut) - { - return Result.Failure("Your account has been locked. Please try again later or contact support."); + if (result.IsLockedOut) { + return Result.Failure(AuthenticationErrors.AccountLocked); } - if (result.IsNotAllowed) - { - return Result.Failure("You are not allowed to sign in. Please confirm your email address."); + if (result.IsNotAllowed) { + return Result.Failure(AuthenticationErrors.EmailNotConfirmed); } - if (result.RequiresTwoFactor) - { - return Result.Failure("Two-factor authentication is required."); + if (result.RequiresTwoFactor) { + return Result.Failure(AuthenticationErrors.TwoFactorRequired); } - return Result.Failure("Invalid username or password."); + return Result.Failure(AuthenticationErrors.InvalidUserNameOrPassword); } - public async Task> Handle(SecurityServiceCommands.BeginLoginCommand command, CancellationToken cancellationToken) - { - var user = await this.UserManager.FindByNameAsync(command.Username); - if (user is null) - { - return Result.Success(new LoginRejected("Invalid username or password.")); + public class AuthenticationErrors { + public const String InvalidUserNameOrPassword = "Invalid username or password."; + public const String AccountLocked = "Your account has been locked. Please try again later or contact support"; + public const String EmailNotConfirmed = "You are not allowed to sign in. Please confirm your email address."; + public const String TwoFactorRequired = "Two-factor authentication is required."; + + public const String MFAExpired = "The MFA sign-in request has expired. Start signing in again."; + public const String MFANoLongerValid = "The MFA sign-in request is no longer valid."; + public const String AuthenticatorOrRecoverCodeInvalid = "The authenticator or recovery code was invalid."; + } + + public async Task> Handle(SecurityServiceCommands.BeginLoginCommand command, CancellationToken cancellationToken) { + ApplicationUser? user = await this.UserManager.FindByNameAsync(command.Username); + if (user is null) { + return Result.Success(new LoginRejected(AuthenticationErrors.InvalidUserNameOrPassword)); } - var policyRequiresMfa = await this.MfaPolicyService.IsMfaRequiredAsync(user, cancellationToken); - var mfaEnabled = await this.UserManager.GetTwoFactorEnabledAsync(user); + Boolean policyRequiresMfa = await this.MfaPolicyService.IsMfaRequiredAsync(user, cancellationToken); + Boolean mfaEnabled = await this.UserManager.GetTwoFactorEnabledAsync(user); - if (mfaEnabled) - { - var passwordResult = await this.SignInManager.PasswordSignInAsync(user, command.Password, command.RememberLogin, lockoutOnFailure: true); - if (passwordResult.Succeeded) - { + if (mfaEnabled) { + SignInResult passwordResult = await this.SignInManager.PasswordSignInAsync(user, command.Password, command.RememberLogin, lockoutOnFailure: true); + if (passwordResult.Succeeded) { return Result.Success(new LoginCompleted(command.ReturnUrl)); } - if (passwordResult.IsLockedOut) - { - return Result.Success(new LoginRejected("Your account has been locked. Please try again later or contact support.")); + if (passwordResult.IsLockedOut) { + return Result.Success(new LoginRejected(AuthenticationErrors.AccountLocked)); } - if (passwordResult.IsNotAllowed) - { - return Result.Success(new LoginRejected("You are not allowed to sign in. Please confirm your email address.")); + if (passwordResult.IsNotAllowed) { + return Result.Success(new LoginRejected(AuthenticationErrors.EmailNotConfirmed)); } - if (passwordResult.RequiresTwoFactor) - { - var transaction = this.TransactionProtector.Protect(user.Id, command.ReturnUrl, command.RememberLogin); + if (passwordResult.RequiresTwoFactor) { + String transaction = this.TransactionProtector.Protect(user.Id, command.ReturnUrl, command.RememberLogin); return Result.Success(new LoginRequiresMfa(transaction)); } - return Result.Success(new LoginRejected("Invalid username or password.")); + return Result.Success(new LoginRejected(AuthenticationErrors.InvalidUserNameOrPassword)); } - var passwordCheck = await this.SignInManager.CheckPasswordSignInAsync(user, command.Password, lockoutOnFailure: true); - if (passwordCheck.Succeeded == false) - { - if (passwordCheck.IsLockedOut) - { - return Result.Success(new LoginRejected("Your account has been locked. Please try again later or contact support.")); + SignInResult passwordCheck = await this.SignInManager.CheckPasswordSignInAsync(user, command.Password, lockoutOnFailure: true); + if (passwordCheck.Succeeded == false) { + if (passwordCheck.IsLockedOut) { + return Result.Success(new LoginRejected(AuthenticationErrors.AccountLocked)); } - if (passwordCheck.IsNotAllowed) - { - return Result.Success(new LoginRejected("You are not allowed to sign in. Please confirm your email address.")); + if (passwordCheck.IsNotAllowed) { + return Result.Success(new LoginRejected(AuthenticationErrors.EmailNotConfirmed)); } - return Result.Success(new LoginRejected("Invalid username or password.")); + return Result.Success(new LoginRejected(AuthenticationErrors.InvalidUserNameOrPassword)); } - if (policyRequiresMfa) - { - var transaction = this.EnrollmentTransactionProtector.Protect(user.Id, command.ReturnUrl); + if (policyRequiresMfa) { + String transaction = this.EnrollmentTransactionProtector.Protect(user.Id, command.ReturnUrl); return Result.Success(new LoginRequiresMfaEnrollment(transaction)); } @@ -138,28 +131,24 @@ public async Task> Handle(SecurityServiceCommands.BeginLogi return Result.Success(new LoginCompleted(command.ReturnUrl)); } - public async Task> Handle(SecurityServiceCommands.CompleteMfaLoginCommand command, CancellationToken cancellationToken) - { - if (this.TransactionProtector.TryUnprotect(command.Transaction, out var transaction) == false || transaction is null) - { - return Result.Success(new LoginRejected("The MFA sign-in request has expired. Start signing in again.")); + public async Task> Handle(SecurityServiceCommands.CompleteMfaLoginCommand command, CancellationToken cancellationToken) { + if (this.TransactionProtector.TryUnprotect(command.Transaction, out MfaSignInTransaction? transaction) == false || transaction is null) { + return Result.Success(new LoginRejected(AuthenticationErrors.MFAExpired)); } - var user = await this.SignInManager.GetTwoFactorAuthenticationUserAsync(); - if (user is null || !string.Equals(user.Id, transaction.UserId, StringComparison.Ordinal) || await this.UserManager.GetTwoFactorEnabledAsync(user) == false || await this.UserManager.IsLockedOutAsync(user)) - { - return Result.Success(new LoginRejected("The MFA sign-in request is no longer valid.")); + ApplicationUser? user = await this.SignInManager.GetTwoFactorAuthenticationUserAsync(); + if (user is null || !string.Equals(user.Id, transaction.UserId, StringComparison.Ordinal) || await this.UserManager.GetTwoFactorEnabledAsync(user) == false || await this.UserManager.IsLockedOutAsync(user)) { + return Result.Success(new LoginRejected(AuthenticationErrors.MFANoLongerValid)); } - var valid = await this.UserManager.VerifyTwoFactorTokenAsync(user, "Authenticator", command.Code); - if (valid == false) - { + Boolean valid = await this.UserManager.VerifyTwoFactorTokenAsync(user, "Authenticator", command.Code); + if (valid == false) { valid = await this.MfaAccountService.RedeemRecoveryCodeAsync(user, command.Code, cancellationToken); } - if (valid == false) - { + + if (valid == false) { await this.UserManager.AccessFailedAsync(user); - return Result.Success(new LoginRejected("The authenticator or recovery code was invalid.")); + return Result.Success(new LoginRejected(AuthenticationErrors.AuthenticatorOrRecoverCodeInvalid)); } await this.UserManager.ResetAccessFailedCountAsync(user); From 5b11f35e9a4ff4e6ac1ba38fd2ebafb51e928042 Mon Sep 17 00:00:00 2001 From: StuartFerguson Date: Tue, 27 Oct 2026 20:15:38 +0000 Subject: [PATCH 2/4] :| --- .../RequestHandlers/LoginRequestHandler.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs b/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs index 32dd328..0515d5f 100644 --- a/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs +++ b/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs @@ -67,7 +67,7 @@ public async Task Handle(SecurityServiceCommands.LoginCommand command, C return Result.Failure(AuthenticationErrors.InvalidUserNameOrPassword); } - public class AuthenticationErrors { + protected class AuthenticationErrors { public const String InvalidUserNameOrPassword = "Invalid username or password."; public const String AccountLocked = "Your account has been locked. Please try again later or contact support"; public const String EmailNotConfirmed = "You are not allowed to sign in. Please confirm your email address."; From 7883e527f8bf1df9540bc6605e8844c1b6718ad6 Mon Sep 17 00:00:00 2001 From: StuartFerguson Date: Tue, 27 Oct 2026 20:24:35 +0000 Subject: [PATCH 3/4] :| --- .../RequestHandlers/LoginRequestHandler.cs | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs b/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs index 0515d5f..15bd5c4 100644 --- a/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs +++ b/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs @@ -68,14 +68,14 @@ public async Task Handle(SecurityServiceCommands.LoginCommand command, C } protected class AuthenticationErrors { - public const String InvalidUserNameOrPassword = "Invalid username or password."; - public const String AccountLocked = "Your account has been locked. Please try again later or contact support"; - public const String EmailNotConfirmed = "You are not allowed to sign in. Please confirm your email address."; - public const String TwoFactorRequired = "Two-factor authentication is required."; - - public const String MFAExpired = "The MFA sign-in request has expired. Start signing in again."; - public const String MFANoLongerValid = "The MFA sign-in request is no longer valid."; - public const String AuthenticatorOrRecoverCodeInvalid = "The authenticator or recovery code was invalid."; + public static readonly String InvalidUserNameOrPassword = "Invalid username or password."; + public static readonly String AccountLocked = "Your account has been locked. Please try again later or contact support"; + public static readonly String EmailNotConfirmed = "You are not allowed to sign in. Please confirm your email address."; + public static readonly String TwoFactorRequired = "Two-factor authentication is required."; + + public static readonly String MFAExpired = "The MFA sign-in request has expired. Start signing in again."; + public static readonly String MFANoLongerValid = "The MFA sign-in request is no longer valid."; + public static readonly String AuthenticatorOrRecoverCodeInvalid = "The authenticator or recovery code was invalid."; } public async Task> Handle(SecurityServiceCommands.BeginLoginCommand command, CancellationToken cancellationToken) { From a60822fefd3745ab13a637369ae58d0faa3efe20 Mon Sep 17 00:00:00 2001 From: StuartFerguson Date: Tue, 27 Oct 2026 20:34:29 +0000 Subject: [PATCH 4/4] :| --- .../RequestHandlers/LoginRequestHandler.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs b/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs index 15bd5c4..1315480 100644 --- a/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs +++ b/SecurityService.BusinessLogic/RequestHandlers/LoginRequestHandler.cs @@ -67,7 +67,7 @@ public async Task Handle(SecurityServiceCommands.LoginCommand command, C return Result.Failure(AuthenticationErrors.InvalidUserNameOrPassword); } - protected class AuthenticationErrors { + protected static class AuthenticationErrors { public static readonly String InvalidUserNameOrPassword = "Invalid username or password."; public static readonly String AccountLocked = "Your account has been locked. Please try again later or contact support"; public static readonly String EmailNotConfirmed = "You are not allowed to sign in. Please confirm your email address.";