c68b49eda0
Adds three layers of account-security hardening, all gated behind the existing SignInWithAppSessionAsync-equivalent (now AppSessionIssuer) so every sign-in path -- local, Google, Microsoft -- goes through the same lockout/2FA checks: - Per-account lockout: Identity's built-in lockout store (columns already provisioned, previously unused) is now wired up in AuthController.Login via IsLockedOutAsync/AccessFailedAsync/ResetAccessFailedCountAsync, 5 failed attempts / 15 min, same generic 401 as wrong-password to avoid enumeration. - RFC 6238 TOTP 2FA (Otp.NET) with QR-code setup (QRCoder, fully local/ offline) on a new TwoFactorController: setup requires password re-confirmation and returns a pending (unconfirmed) secret + QR; the secret is only persisted as active once verify-setup checks a real code. Secrets are encrypted at rest via the same IDataProtector pattern already used for Gmail/Microsoft OAuth refresh tokens. - Login/OAuth exchange now checks TwoFactorEnabled before issuing a real session. If enabled, it hands back an opaque, server-side (IMemoryCache) pending token via a new ITwoFactorPendingTokenService -- deliberately NOT a JWT, so it can never be presented as a bearer token to bypass the 2FA check on any other endpoint. Only POST /api/auth/2fa/challenge can redeem it, rate-limited at 5/5min (tighter than password login, since a 6-digit space is far more brute-forceable). - One-time recovery codes (10 per enable/regenerate, SHA-256-hashed at rest, shown once in plaintext) accepted in the same challenge endpoint as an alternative to a TOTP code. Schema: AspNetUsers gains TotpSecretEncrypted / TotpPendingSecretEncrypted / TotpEnabledAtUtc, plus a new TwoFactorRecoveryCodes table, added to both the SQLite and MySQL dialect blocks in the startup schema reconciler. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
157 lines
6.8 KiB
C#
157 lines
6.8 KiB
C#
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using JobTrackerApi.Models;
|
|
|
|
namespace JobTrackerApi.Data
|
|
{
|
|
public class JobTrackerContext : IdentityDbContext<ApplicationUser>
|
|
{
|
|
public string? CurrentUserId { get; }
|
|
|
|
public JobTrackerContext(DbContextOptions<JobTrackerContext> options, JobTrackerApi.Services.ICurrentUserService currentUser) : base(options)
|
|
{
|
|
CurrentUserId = currentUser.UserId;
|
|
}
|
|
|
|
public DbSet<Company> Companies => Set<Company>();
|
|
public DbSet<JobApplication> JobApplications => Set<JobApplication>();
|
|
public DbSet<Correspondence> Correspondences => Set<Correspondence>();
|
|
public DbSet<GmailConnection> GmailConnections => Set<GmailConnection>();
|
|
public DbSet<GmailReviewDecision> GmailReviewDecisions => Set<GmailReviewDecision>();
|
|
public DbSet<MicrosoftGraphConnection> MicrosoftGraphConnections => Set<MicrosoftGraphConnection>();
|
|
public DbSet<ImapConnection> ImapConnections => Set<ImapConnection>();
|
|
public DbSet<Attachment> Attachments => Set<Attachment>();
|
|
public DbSet<RuleSettings> RuleSettings => Set<RuleSettings>();
|
|
public DbSet<UserRuleSettings> UserRuleSettings => Set<UserRuleSettings>();
|
|
public DbSet<SystemEmailSettings> SystemEmailSettings => Set<SystemEmailSettings>();
|
|
public DbSet<JobEvent> JobEvents => Set<JobEvent>();
|
|
public DbSet<CvUploadArtifact> CvUploadArtifacts => Set<CvUploadArtifact>();
|
|
public DbSet<CvExtractionRun> CvExtractionRuns => Set<CvExtractionRun>();
|
|
public DbSet<TailoredCvDraft> TailoredCvDrafts => Set<TailoredCvDraft>();
|
|
public DbSet<TwoFactorRecoveryCode> TwoFactorRecoveryCodes => Set<TwoFactorRecoveryCode>();
|
|
|
|
protected override void OnModelCreating(ModelBuilder modelBuilder)
|
|
{
|
|
base.OnModelCreating(modelBuilder);
|
|
|
|
modelBuilder.Entity<Company>()
|
|
.HasQueryFilter(c => CurrentUserId != null && c.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<JobApplication>()
|
|
.HasQueryFilter(j => CurrentUserId != null && j.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<UserRuleSettings>()
|
|
.HasKey(x => x.OwnerUserId);
|
|
|
|
modelBuilder.Entity<UserRuleSettings>()
|
|
.HasQueryFilter(x => CurrentUserId != null && x.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<RuleSettings>()
|
|
.HasData(new RuleSettings { Id = 1 });
|
|
|
|
modelBuilder.Entity<JobApplication>()
|
|
.HasOne(j => j.Company)
|
|
.WithMany(c => c.Jobs)
|
|
.HasForeignKey(j => j.CompanyId)
|
|
.OnDelete(DeleteBehavior.Cascade);
|
|
|
|
modelBuilder.Entity<JobApplication>()
|
|
.HasIndex(j => j.OwnerUserId);
|
|
|
|
// Owner-prefixed composite indexes for the tenant-scoped hot paths. Every
|
|
// JobApplication query is scoped by the OwnerUserId global filter first, then
|
|
// filtered by IsDeleted (list/board/stats/analytics) or FollowUpAt (reminders).
|
|
// Status is intentionally excluded from the index because Pomelo maps the
|
|
// unbounded string column to longtext, which MariaDB cannot index without a
|
|
// prefix length. The actual index DDL is applied idempotently in
|
|
// StartupInitializationExtensions (this repo provisions schema via that
|
|
// reconciler, not via the EF ModelSnapshot, which is stale).
|
|
modelBuilder.Entity<JobApplication>()
|
|
.HasIndex(j => new { j.OwnerUserId, j.IsDeleted });
|
|
|
|
modelBuilder.Entity<JobApplication>()
|
|
.HasIndex(j => new { j.OwnerUserId, j.FollowUpAt });
|
|
|
|
modelBuilder.Entity<Company>()
|
|
.HasIndex(c => c.OwnerUserId);
|
|
|
|
modelBuilder.Entity<Correspondence>()
|
|
.HasQueryFilter(c => CurrentUserId != null && c.JobApplication.OwnerUserId == CurrentUserId)
|
|
.HasOne(c => c.JobApplication)
|
|
.WithMany(j => j.Messages)
|
|
.HasForeignKey(c => c.JobApplicationId)
|
|
.OnDelete(DeleteBehavior.Cascade);
|
|
|
|
modelBuilder.Entity<GmailConnection>()
|
|
.HasQueryFilter(x => CurrentUserId != null && x.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<GmailReviewDecision>()
|
|
.HasQueryFilter(x => CurrentUserId != null && x.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Ignore<CorrespondenceAttachmentMetadata>();
|
|
|
|
modelBuilder.Entity<GmailConnection>()
|
|
.HasIndex(x => new { x.OwnerUserId, x.GmailAddress })
|
|
.IsUnique();
|
|
|
|
modelBuilder.Entity<GmailConnection>()
|
|
.HasIndex(x => x.OwnerUserId);
|
|
|
|
modelBuilder.Entity<Attachment>()
|
|
.HasOne(a => a.JobApplication)
|
|
.WithMany(j => j.Attachments)
|
|
.HasForeignKey(a => a.JobApplicationId)
|
|
.OnDelete(DeleteBehavior.Cascade);
|
|
|
|
modelBuilder.Entity<JobEvent>()
|
|
.HasQueryFilter(x => CurrentUserId != null && x.JobApplication.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<JobEvent>()
|
|
.HasOne(e => e.JobApplication)
|
|
.WithMany(j => j.Events)
|
|
.HasForeignKey(e => e.JobApplicationId)
|
|
.OnDelete(DeleteBehavior.Cascade);
|
|
|
|
modelBuilder.Entity<CvUploadArtifact>()
|
|
.HasQueryFilter(x => CurrentUserId != null && x.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<CvUploadArtifact>()
|
|
.HasIndex(x => new { x.OwnerUserId, x.UploadedAtUtc });
|
|
|
|
modelBuilder.Entity<CvExtractionRun>()
|
|
.HasQueryFilter(x => CurrentUserId != null && x.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<CvExtractionRun>()
|
|
.HasIndex(x => new { x.OwnerUserId, x.StartedAtUtc });
|
|
|
|
modelBuilder.Entity<CvExtractionRun>()
|
|
.HasOne(x => x.Artifact)
|
|
.WithMany()
|
|
.HasForeignKey(x => x.ArtifactId)
|
|
.OnDelete(DeleteBehavior.SetNull);
|
|
|
|
modelBuilder.Entity<TailoredCvDraft>()
|
|
.HasQueryFilter(x => CurrentUserId != null && x.OwnerUserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<TailoredCvDraft>()
|
|
.HasIndex(x => new { x.OwnerUserId, x.JobApplicationId })
|
|
.IsUnique();
|
|
|
|
modelBuilder.Entity<TailoredCvDraft>()
|
|
.HasOne(x => x.JobApplication)
|
|
.WithOne(j => j.TailoredCvDraft)
|
|
.HasForeignKey<TailoredCvDraft>(x => x.JobApplicationId)
|
|
.OnDelete(DeleteBehavior.Cascade);
|
|
|
|
// No FK to AspNetUsers: the login-time challenge endpoint reads these rows before a
|
|
// session (and thus CurrentUserId) exists, via IgnoreQueryFilters() -- same convention
|
|
// as AdminAuditController's cross-cutting queries.
|
|
modelBuilder.Entity<TwoFactorRecoveryCode>()
|
|
.HasQueryFilter(x => CurrentUserId != null && x.UserId == CurrentUserId);
|
|
|
|
modelBuilder.Entity<TwoFactorRecoveryCode>()
|
|
.HasIndex(x => new { x.UserId, x.UsedAtUtc });
|
|
}
|
|
}
|
|
}
|