Api keys with openiddict (#1262)

* Remove OpenIddict

* Add API Key system

* Revert removing OpenIddict

* fix rebase

* fix tests

* pr changes

* fix tests

* fix apikey test

* pr change

* fix db

* add migration attrs

* fix migration error

* PR Changes

* Fix sqlite migration

* change api key to use Authorization Header

* add supportAddForeignKey

* use tempdata status message

* fix add api key css

* remove redirect url + app identifier feature :(

BTCPayServer/Security/APIKeys/APIKeyAuthenticationHandler.cs

@@ -0,0 +1,56 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using System.Threading.Tasks;
+using BTCPayServer.Data;
+using BTCPayServer.Security.Bitpay;
+using BTCPayServer.Services.Stores;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace BTCPayServer.Security.APIKeys
+{
+    public class APIKeyAuthenticationHandler : AuthenticationHandler<APIKeyAuthenticationOptions>
+    {
+        private readonly APIKeyRepository _apiKeyRepository;
+        private readonly IOptionsMonitor<IdentityOptions> _identityOptions;
+
+        public APIKeyAuthenticationHandler(
+            APIKeyRepository apiKeyRepository,
+            IOptionsMonitor<IdentityOptions> identityOptions,
+            IOptionsMonitor<APIKeyAuthenticationOptions> options,
+            ILoggerFactory logger,
+            UrlEncoder encoder,
+            ISystemClock clock) : base(options, logger, encoder, clock)
+        {
+            _apiKeyRepository = apiKeyRepository;
+            _identityOptions = identityOptions;
+        }
+
+        protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+        {
+            if (!Context.Request.HttpContext.GetAPIKey(out var apiKey) || string.IsNullOrEmpty(apiKey))
+                return AuthenticateResult.NoResult();
+
+            var key = await _apiKeyRepository.GetKey(apiKey);
+
+            if (key == null)
+            {
+                return AuthenticateResult.Fail("ApiKey authentication failed");
+            }
+
+            List<Claim> claims = new List<Claim>();
+            
+            claims.Add(new Claim(_identityOptions.CurrentValue.ClaimsIdentity.UserIdClaimType, key.UserId));
+            claims.AddRange(key.GetPermissions()
+                .Select(permission => new Claim(APIKeyConstants.ClaimTypes.Permissions, permission)));
+
+            return AuthenticateResult.Success(new AuthenticationTicket(
+                new ClaimsPrincipal(new ClaimsIdentity(claims, APIKeyConstants.AuthenticationType)), APIKeyConstants.AuthenticationType));
+        }
+    }
+}

BTCPayServer/Security/APIKeys/APIKeyAuthenticationOptions.cs

@@ -0,0 +1,8 @@
+using Microsoft.AspNetCore.Authentication;
+
+namespace BTCPayServer.Security.Bitpay
+{
+    public class APIKeyAuthenticationOptions : AuthenticationSchemeOptions
+    {
+    }
+}

BTCPayServer/Security/APIKeys/APIKeyAuthorizationHandler.cs

@@ -0,0 +1,84 @@
+using System.Linq;
+using System.Threading.Tasks;
+using BTCPayServer.Data;
+using BTCPayServer.Services.Stores;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Identity;
+
+namespace BTCPayServer.Security.APIKeys
+{
+    public class APIKeyAuthorizationHandler : AuthorizationHandler<PolicyRequirement>
+
+    {
+        private readonly HttpContext _HttpContext;
+        private readonly UserManager<ApplicationUser> _userManager;
+        private readonly StoreRepository _storeRepository;
+
+        public APIKeyAuthorizationHandler(IHttpContextAccessor httpContextAccessor,
+            UserManager<ApplicationUser> userManager,
+            StoreRepository storeRepository)
+        {
+            _HttpContext = httpContextAccessor.HttpContext;
+            _userManager = userManager;
+            _storeRepository = storeRepository;
+        }
+
+        protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context,
+            PolicyRequirement requirement)
+        {
+            if (context.User.Identity.AuthenticationType != APIKeyConstants.AuthenticationType)
+                return;
+
+            bool success = false;
+            switch (requirement.Policy)
+            {
+                case Policies.CanListStoreSettings.Key:
+                    var selectiveStorePermissions =
+                        APIKeyConstants.Permissions.ExtractStorePermissionsIds(context.GetPermissions());
+                    success = context.HasPermissions(APIKeyConstants.Permissions.StoreManagement) ||
+                              selectiveStorePermissions.Any();
+                    break;
+                case Policies.CanModifyStoreSettings.Key:
+                    string storeId = _HttpContext.GetImplicitStoreId();
+                    if (!context.HasPermissions(APIKeyConstants.Permissions.StoreManagement) &&
+                        !context.HasPermissions(APIKeyConstants.Permissions.GetStorePermission(storeId)))
+                        break;
+
+                    if (storeId == null)
+                    {
+                        success = true;
+                    }
+                    else
+                    {
+                        var userid = _userManager.GetUserId(context.User);
+                        if (string.IsNullOrEmpty(userid))
+                            break;
+                        var store = await _storeRepository.FindStore((string)storeId, userid);
+                        if (store == null)
+                            break;
+                        success = true;
+                        _HttpContext.SetStoreData(store);
+                    }
+
+                    break;
+                case Policies.CanModifyServerSettings.Key:
+                    if (!context.HasPermissions(APIKeyConstants.Permissions.ServerManagement))
+                        break;
+                    // For this authorization, we stil check in database because it is super sensitive.
+                    var user = await _userManager.GetUserAsync(context.User);
+                    if (user == null)
+                        break;
+                    if (!await _userManager.IsInRoleAsync(user, Roles.ServerAdmin))
+                        break;
+                    success = true;
+                    break;
+            }
+
+            if (success)
+            {
+                context.Succeed(requirement);
+            }
+        }
+    }
+}

BTCPayServer/Security/APIKeys/APIKeyConstants.cs

@@ -0,0 +1,36 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Linq;
+
+namespace BTCPayServer.Security.APIKeys
+{
+    public static class APIKeyConstants
+    {
+        public const string AuthenticationType = "APIKey";
+
+        public static class ClaimTypes
+        {
+            public const string Permissions = nameof(APIKeys) + "." + nameof(Permissions);
+        }
+
+        public static class Permissions
+        {
+            public const string ServerManagement = nameof(ServerManagement);
+            public const string StoreManagement = nameof(StoreManagement);
+
+            public static readonly Dictionary<string, (string Title, string Description)> PermissionDescriptions = new Dictionary<string, (string Title, string Description)>()
+            {
+                {StoreManagement, ("Manage your stores", "The app will be able to create, modify and delete all your stores.")},
+                {$"{nameof(StoreManagement)}:", ("Manage selected stores", "The app will be able to modify and delete selected stores.")},
+                {ServerManagement, ("Manage your server", "The app will have total control on your server")},
+            };
+
+            public static string GetStorePermission(string storeId) => $"{nameof(StoreManagement)}:{storeId}";
+
+            public static IEnumerable<string> ExtractStorePermissionsIds(IEnumerable<string> permissions) => permissions
+                .Where(s => s.StartsWith($"{nameof(StoreManagement)}:", StringComparison.InvariantCulture))
+                .Select(s => s.Split(":")[1]);
+        }
+    }
+}

BTCPayServer/Security/APIKeys/APIKeyExtensions.cs

@@ -0,0 +1,75 @@
+using System;
+using System.Linq;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using BTCPayServer.Data;
+using BTCPayServer.Security.Bitpay;
+using BTCPayServer.Services.Stores;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Primitives;
+
+namespace BTCPayServer.Security.APIKeys
+{
+    public static class APIKeyExtensions
+    {
+        public static bool GetAPIKey(this HttpContext httpContext, out StringValues apiKey)
+        {
+            if (httpContext.Request.Headers.TryGetValue("Authorization", out var value) &&
+                value.ToString().StartsWith("token ", StringComparison.InvariantCultureIgnoreCase))
+            {
+                apiKey = value.ToString().Substring("token ".Length);
+                return true;
+            }
+
+            return false;
+        }
+
+        public static Task<StoreData[]> GetStores(this ClaimsPrincipal claimsPrincipal,
+            UserManager<ApplicationUser> userManager, StoreRepository storeRepository)
+        {
+            var permissions =
+                claimsPrincipal.Claims.Where(claim => claim.Type == APIKeyConstants.ClaimTypes.Permissions)
+                    .Select(claim => claim.Value).ToList();
+
+            if (permissions.Contains(APIKeyConstants.Permissions.StoreManagement))
+            {
+                return storeRepository.GetStoresByUserId(userManager.GetUserId(claimsPrincipal));
+            }
+
+            var storeIds = APIKeyConstants.Permissions.ExtractStorePermissionsIds(permissions);
+            return storeRepository.GetStoresByUserId(userManager.GetUserId(claimsPrincipal), storeIds);
+        }
+
+        public static AuthenticationBuilder AddAPIKeyAuthentication(this AuthenticationBuilder builder)
+        {
+            builder.AddScheme<APIKeyAuthenticationOptions, APIKeyAuthenticationHandler>(AuthenticationSchemes.ApiKey,
+                o => { });
+            return builder;
+        }
+
+        public static IServiceCollection AddAPIKeyAuthentication(this IServiceCollection serviceCollection)
+        {
+            serviceCollection.AddSingleton<APIKeyRepository>();
+            serviceCollection.AddScoped<IAuthorizationHandler, APIKeyAuthorizationHandler>();
+            return serviceCollection;
+        }
+
+        public static string[] GetPermissions(this AuthorizationHandlerContext context)
+        {
+            return context.User.Claims.Where(c =>
+                    c.Type.Equals(APIKeyConstants.ClaimTypes.Permissions, StringComparison.InvariantCultureIgnoreCase))
+                .Select(claim => claim.Value).ToArray();
+        }
+
+        public static bool HasPermissions(this AuthorizationHandlerContext context, params string[] scopes)
+        {
+            return scopes.All(s => context.User.HasClaim(c =>
+                c.Type.Equals(APIKeyConstants.ClaimTypes.Permissions, StringComparison.InvariantCultureIgnoreCase) &&
+                c.Value.Split(' ').Contains(s)));
+        }
+    }
+}

BTCPayServer/Security/APIKeys/APIKeyRepository.cs

@@ -0,0 +1,72 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using BTCPayServer.Data;
+using Microsoft.EntityFrameworkCore;
+
+namespace BTCPayServer.Security.APIKeys
+{
+    public class APIKeyRepository
+    {
+        private readonly ApplicationDbContextFactory _applicationDbContextFactory;
+
+        public APIKeyRepository(ApplicationDbContextFactory applicationDbContextFactory)
+        {
+            _applicationDbContextFactory = applicationDbContextFactory;
+        }
+
+        public async Task<APIKeyData> GetKey(string apiKey)
+        {
+            using (var context = _applicationDbContextFactory.CreateContext())
+            {
+                return await EntityFrameworkQueryableExtensions.SingleOrDefaultAsync(context.ApiKeys,
+                    data => data.Id == apiKey && data.Type != APIKeyType.Legacy);
+            }
+        }
+
+        public async Task<List<APIKeyData>> GetKeys(APIKeyQuery query)
+        {
+            using (var context = _applicationDbContextFactory.CreateContext())
+            {
+                var queryable = context.ApiKeys.AsQueryable();
+                if (query?.UserId != null && query.UserId.Any())
+                {
+                    queryable = queryable.Where(data => query.UserId.Contains(data.UserId));
+                }
+
+                return await queryable.ToListAsync();
+            }
+        }
+
+        public async Task CreateKey(APIKeyData key)
+        {
+            if (key.Type == APIKeyType.Legacy || !string.IsNullOrEmpty(key.StoreId) || string.IsNullOrEmpty(key.UserId))
+            {
+                throw new InvalidOperationException("cannot save a bitpay legacy api key with this repository");
+            }
+
+            using (var context = _applicationDbContextFactory.CreateContext())
+            {
+                await context.ApiKeys.AddAsync(key);
+                await context.SaveChangesAsync();
+            }
+        }
+
+        public async Task Remove(string id, string getUserId)
+        {
+            using (var context = _applicationDbContextFactory.CreateContext())
+            {
+                var key = await EntityFrameworkQueryableExtensions.SingleOrDefaultAsync(context.ApiKeys,
+                    data => data.Id == id && data.UserId == getUserId);
+                context.ApiKeys.Remove(key);
+                await context.SaveChangesAsync();
+            }
+        }
+
+        public class APIKeyQuery
+        {
+            public string[] UserId { get; set; }
+        }
+    }
+}