Changes between Version 21 and Version 22 of P9

Timestamp:

06/23/26 00:01:06 (4 days ago)

Author:

211099

Comment:

--

P9

@@ -767 +767 @@
 
 Two new indexes were created for this scenario: idx_story_created_user and idx_genre_covering. Combined with indexes from previous scenarios, 8 indexes are used naturally in the execution plan without any forcing flags. Average execution time: 25.720 ms without indexes vs 25.813 ms with indexes. The indexes are kept and will deliver measurable improvements as data volume grows.
+
+
+= Security measures 
+== Authentication and Authorization
+===  User Authentication with JWT
+ChapterX uses JSON Web Tokens (JWT) for authentication. The architecture is fully stateless so that means that no session is stored on the server between requests, so each request carries its own proof of identity in the token. After a successful login, the token is returned to the client in the JSON response body; the client is responsible for storing and attaching it to subsequent requests via the Authorization Bearer token header.
+Login flow:
+{{{
+var user = await _userRepository.GetByEmailAsync(request.Email, cancellationToken)
+    ?? throw new UnauthorizedAccessException("Invalid email or password.");
+
+if (!BCrypt.Net.BCrypt.Verify(request.Password, user.Password))
+    throw new UnauthorizedAccessException("Invalid email or password.");
+
+var token = _jwtTokenService.GenerateToken(user);
+return new LoginResponse(token, user.Id, user.Username, user.Email, user.Name, user.Surname, role);
+}}}
+The identical error message for both a missing user and a wrong password prevents email enumeration attacks, because an attacker cannot distinguish between the two failure modes.
+=== Access Token 
+The access token is generated by JwtTokenService. It is a signed, self-contained token that embeds the user's identity and role directly in its payload, eliminating the need for a database lookup on every authenticated request.
+Token generation:
+{{{
+public string GenerateToken(User user)
+{
+    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["Jwt:Key"]!));
+    var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+
+    var role = user.Admin != null ? "Admin"
+        : user.Writer != null ? "Writer"
+        : "RegularUser";
+
+    var claims = new[]
+    {
+        new Claim(JwtRegisteredClaimNames.Sub, user.Id.ToString()),   // subject: user ID
+        new Claim(JwtRegisteredClaimNames.Email, user.Email),         // user email
+        new Claim(JwtRegisteredClaimNames.UniqueName, user.Username), // username
+        new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()), // unique token ID
+        new Claim(ClaimTypes.Role, role)                              // role claim
+    };
+
+    var token = new JwtSecurityToken(
+        issuer: _configuration["Jwt:Issuer"],
+        audience: _configuration["Jwt:Audience"],
+        claims: claims,
+        expires: DateTime.UtcNow.AddDays(7),
+        signingCredentials: credentials
+    );
+
+    return new JwtSecurityTokenHandler().WriteToken(token);
+}
+}}}
+The token is signed with HMAC-SHA256 using a symmetric key loaded from configuration. This ensures that any modification to the token payload after issuance will invalidate the signature, making it impossible for a client to forge or tamper with claims. The token expires after 7 days.
+===  JWT Validation
+ASP.NET Core's built-in JwtBearer middleware intercepts every incoming HTTP request and validates the token before any controller action runs.
+{{{
+builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(options =>
+    {
+        options.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidateAudience = true,
+            ValidateLifetime = true,
+            ValidateIssuerSigningKey = true,
+            ValidIssuer = builder.Configuration["Jwt:Issuer"],
+            ValidAudience = builder.Configuration["Jwt:Audience"],
+            IssuerSigningKey = new SymmetricSecurityKey(
+                Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!))
+        };
+    });
+}}}
+=== Security Filter Chain
+ASP.NET Core processes requests through an ordered middleware pipeline. Authentication and authorization are placed after CORS and exception handling, and before controller mapping, which means the token is validated on every request regardless of which controller handles it.
+=== Role-Based Access Control
+The system defines three roles, derived at login time from the user's related entities in the database and embedded as a ClaimTypes.Role claim in the JWT.
+{{{
+var role = user.Admin != null ? "Admin"
+    : user.Writer != null ? "Writer"
+    : "RegularUser";
+}}}