AuthConfig.cs

using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using System.Net;
using System.Security.Claims;

namespace SchoolHelpdesk;

public static class AuthConfig
{
  public static void ConfigureAuth(this WebApplicationBuilder builder)
  {
    ArgumentNullException.ThrowIfNull(builder);
    builder.Services
      .AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
      .AddCookie(o =>
      {
        o.Cookie.Path = "/";
        o.Cookie.HttpOnly = true;
        o.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        o.Cookie.SameSite = SameSiteMode.Lax;
        o.LoginPath = "/login";
        o.LogoutPath = "/logout";
        o.ExpireTimeSpan = TimeSpan.FromDays(60);
        o.SlidingExpiration = true;
        o.ReturnUrlParameter = "path";
        o.Events = new()
        {
          OnRedirectToAccessDenied = context =>
          {
            context.Response.StatusCode = 403;
            return Task.CompletedTask;
          },
          OnValidatePrincipal = async context =>
          {
            var issued = context.Properties.IssuedUtc;
            if (issued.HasValue && issued.Value > DateTimeOffset.UtcNow.AddDays(-1))
            {
              return;
            }
            var email = context.Principal.Identity.Name;
            if (TryCreatePrincipal(email, out var principal))
            {
              context.ReplacePrincipal(principal);
              context.ShouldRenew = true;
            }
            else
            {
              context.RejectPrincipal();
              await context.HttpContext.SignOutAsync();
            }
          }
        };
      })
      .AddOpenIdConnect("Microsoft", o =>
      {
        o.Authority = $"https://login.microsoftonline.com/{builder.Configuration["MicrosoftTenantId"]}/v2.0/";
        o.ClientId = builder.Configuration["MicrosoftClientId"];
        o.ClientSecret = builder.Configuration["MicrosoftClientSecret"];
        o.ResponseType = OpenIdConnectResponseType.Code;
        o.ResponseMode = OpenIdConnectResponseMode.Query;
        o.MapInboundClaims = false;
        o.Scope.Clear();
        o.Scope.Add("openid");
        o.Scope.Add("profile");
        o.Events = new()
        {
          OnTicketReceived = context =>
          {
            var email = context.Principal.FindFirstValue("upn")?.ToLowerInvariant();
            if (TryCreatePrincipal(email, out var principal))
            {
              context.Principal = principal;
            }
            else
            {
              context.Fail("Unauthorised");
              context.Response.Redirect("/denied");
              context.HandleResponse();
            }
            return Task.CompletedTask;
          }
        };
      });

    builder.Services.AddAuthorizationBuilder().SetFallbackPolicy(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build());
  }

  private static bool TryCreatePrincipal(string email, out ClaimsPrincipal principal)
  {
    if (email is null || !School.Instance.StaffByEmail.TryGetValue(email, out var staff))
    {
      principal = null;
      return false;
    }
    var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);
    identity.AddClaim(new Claim(ClaimTypes.Name, staff.Email));

    var isAdmin = School.Instance.Admins.Contains(email, StringComparer.OrdinalIgnoreCase);
    var isManager = isAdmin || School.Instance.Managers.Contains(email, StringComparer.OrdinalIgnoreCase);
    var isDispatcher = isManager || School.Instance.Dispatchers.Contains(email, StringComparer.OrdinalIgnoreCase);

    if (isAdmin) identity.AddClaim(new Claim(ClaimTypes.Role, AuthConstants.Administrator));
    if (isManager) identity.AddClaim(new Claim(ClaimTypes.Role, AuthConstants.Manager));
    if (isDispatcher) identity.AddClaim(new Claim(ClaimTypes.Role, AuthConstants.Dispatcher));

    principal = new ClaimsPrincipal(identity);
    return true;
  }

  private static readonly string[] authenticationSchemes = ["Microsoft"];

  public static void MapAuthPaths(this WebApplication app)
  {
    app.MapGet("/login/challenge", [AllowAnonymous] ([FromQuery] string path) =>
    {
      var redirectUri = path is null ? "/tickets/" : WebUtility.UrlDecode(path);
      var authProperties = new AuthenticationProperties { RedirectUri = redirectUri, AllowRefresh = true, IsPersistent = true };
      return Results.Challenge(authProperties, authenticationSchemes);
    });

    app.MapGet("/logout", async (HttpContext context) =>
    {
      await context.SignOutAsync();
      return Results.Redirect("/login");
    });
  }
}

public static class AuthConstants
{
  public const string Administrator = nameof(Administrator);
  public const string Manager = nameof(Manager);
  public const string Dispatcher = nameof(Dispatcher);
}