Feature(Auth): Add Login and Refresh Token

RT.Application/Services/Contract/IAuthService.cs

@@ -0,0 +1,10 @@
+using RT.Domain.DTOs.Auth;
+
+namespace RT.Application.Services.Contract;
+
+public interface IAuthService
+{
+    Task<LoginResponseDto> LoginAsync(LoginRequestDto dto, CancellationToken ct = default);
+    Task<LoginResponseDto> RefreshAsync(RefreshRequestDto dto, CancellationToken ct = default);
+    Task RevokeAsync(RefreshRequestDto dto, CancellationToken ct = default);
+}

RT.Application/Services/Contract/ITokenService.cs

@@ -0,0 +1,7 @@
+namespace RT.Application.Services.Contract;
+
+public interface ITokenService
+{
+    (string token, DateTime expiresAt) GenerateToken(string userId, string email, string userName);
+    (string token, DateTime expiresAt) GenerateRefreshToken();
+}

RT.Application/Services/Implementation/AuthService.cs

@@ -0,0 +1,71 @@
+using Microsoft.AspNetCore.Identity;
+using Microsoft.EntityFrameworkCore;
+using RT.Application.Services.Contract;
+using RT.Domain.DTOs.Auth;
+using RT.Domain.Entities;
+using RT.Infrastructure.Data;
+using RT.Infrastructure.Identity;
+
+namespace RT.Application.Services.Implementation;
+
+public class AuthService(
+    UserManager<ApplicationUser> userManager,
+    ITokenService tokenService,
+    AppDbContext db) : IAuthService
+{
+    public async Task<LoginResponseDto> LoginAsync(LoginRequestDto dto, CancellationToken ct = default)
+    {
+        var user = await userManager.FindByEmailAsync(dto.Email)
+            ?? throw new UnauthorizedAccessException("Invalid credentials.");
+
+        if (!await userManager.CheckPasswordAsync(user, dto.Password))
+            throw new UnauthorizedAccessException("Invalid credentials.");
+
+        return await BuildResponseAsync(user, ct);
+    }
+
+    public async Task<LoginResponseDto> RefreshAsync(RefreshRequestDto dto, CancellationToken ct = default)
+    {
+        var stored = await db.RefreshTokens.FirstOrDefaultAsync(r => r.Token == dto.RefreshToken, ct)
+            ?? throw new UnauthorizedAccessException("Invalid refresh token.");
+
+        if (stored.IsRevoked)
+            throw new UnauthorizedAccessException("Refresh token revoked.");
+
+        if (stored.ExpiresAt < DateTime.UtcNow)
+            throw new UnauthorizedAccessException("Refresh token expired.");
+
+        stored.IsRevoked = true;
+        await db.SaveChangesAsync(ct);
+
+        var user = await userManager.FindByIdAsync(stored.UserId)
+            ?? throw new UnauthorizedAccessException("User not found.");
+
+        return await BuildResponseAsync(user, ct);
+    }
+
+    public async Task RevokeAsync(RefreshRequestDto dto, CancellationToken ct = default)
+    {
+        var stored = await db.RefreshTokens.FirstOrDefaultAsync(r => r.Token == dto.RefreshToken, ct);
+        if (stored is null || stored.IsRevoked) return;
+
+        stored.IsRevoked = true;
+        await db.SaveChangesAsync(ct);
+    }
+
+    private async Task<LoginResponseDto> BuildResponseAsync(ApplicationUser user, CancellationToken ct)
+    {
+        var (token, expiresAt)               = tokenService.GenerateToken(user.Id, user.Email!, user.UserName!);
+        var (refreshToken, refreshExpiresAt) = tokenService.GenerateRefreshToken();
+
+        db.RefreshTokens.Add(new RefreshToken
+        {
+            UserId    = user.Id,
+            Token     = refreshToken,
+            ExpiresAt = refreshExpiresAt,
+        });
+        await db.SaveChangesAsync(ct);
+
+        return new LoginResponseDto(token, expiresAt, refreshToken, refreshExpiresAt, user.MustChangePassword);
+    }
+}

RT.Application/Services/Implementation/TokenService.cs

@@ -0,0 +1,43 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.Extensions.Configuration;
+using Microsoft.IdentityModel.Tokens;
+using RT.Application.Services.Contract;
+
+namespace RT.Application.Services.Implementation;
+
+public class TokenService(IConfiguration configuration) : ITokenService
+{
+    public (string token, DateTime expiresAt) GenerateToken(string userId, string email, string userName)
+    {
+        var key     = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["Jwt:Key"]!));
+        var creds   = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+        var expires = DateTime.UtcNow.AddMinutes(double.Parse(configuration["Jwt:ExpiresMinutes"] ?? "60"));
+
+        var claims = new[]
+        {
+            new Claim(JwtRegisteredClaimNames.Sub,   userId),
+            new Claim(JwtRegisteredClaimNames.Email, email),
+            new Claim(JwtRegisteredClaimNames.Name,  userName),
+            new Claim(JwtRegisteredClaimNames.Jti,   Guid.NewGuid().ToString()),
+        };
+
+        var token = new JwtSecurityToken(
+            issuer:   configuration["Jwt:Issuer"],
+            audience: configuration["Jwt:Audience"],
+            claims:   claims,
+            expires:  expires,
+            signingCredentials: creds);
+
+        return (new JwtSecurityTokenHandler().WriteToken(token), expires);
+    }
+
+    public (string token, DateTime expiresAt) GenerateRefreshToken()
+    {
+        var token   = Convert.ToBase64String(RandomNumberGenerator.GetBytes(64));
+        var expires = DateTime.UtcNow.AddDays(double.Parse(configuration["Jwt:RefreshExpiresDays"] ?? "7"));
+        return (token, expires);
+    }
+}