cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat/Update_Controllers_to_Allow_for_Premium_Membership

Browse Source
This commit is contained in:
cesnimda
2026-08-03 09:17:28 +02:00
parent de937d25dc
commit c3f4a57195
187 changed files with 26062 additions and 991 deletions
Download Patch File Download Diff File Expand all files Collapse all files
JobTrackerApi/Services/LocalSessionValidator.cs
+5 -3
View File
@@ -8,16 +8,18 @@ namespace JobTrackerApi.Services;
// of Program.cs so it's unit-testable without standing up a full TestServer/HTTP pipeline.
public static class LocalSessionValidator
{
public static async Task<bool> IsValidAsync(JobTrackerContext db, ClaimsPrincipal? principal, DateTimeOffset now, CancellationToken cancellationToken = default)
public static async Task<bool> IsValidAsync(JobTrackerContext db, ClaimsPrincipal? principal, DateTimeOffset now, bool requireConfirmedEmail = false, CancellationToken cancellationToken = default)
{
var sid = principal?.FindFirst("sid")?.Value;
var userId = principal is null ? null : LocalAuthIdentity.GetRequiredUserId(principal);
// Fail closed: see the comment on the OnTokenValidated wiring in Program.cs for why a
// missing sid is rejected rather than grandfathered in.
if (string.IsNullOrWhiteSpace(sid)) return false;
if (string.IsNullOrWhiteSpace(sid) || string.IsNullOrWhiteSpace(userId)) return false;
var session = await db.UserSessions.IgnoreQueryFilters()
.FirstOrDefaultAsync(x => x.Id == sid, cancellationToken);
.FirstOrDefaultAsync(x => x.Id == sid && x.UserId == userId, cancellationToken);
if (session is null || session.RevokedAtUtc is not null || session.ExpiresAtUtc <= now) return false;
if (requireConfirmedEmail && !await db.Users.IgnoreQueryFilters().AnyAsync(x => x.Id == userId && x.EmailConfirmed, cancellationToken)) return false;
if (now - session.LastSeenAtUtc > TimeSpan.FromMinutes(5))
{