BuildFeed/MongoAuth/MongoMembershipProvider.cs

using MongoDB.Bson;
using MongoDB.Bson.Serialization.Attributes;
using MongoDB.Driver;
using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Web.Security;

namespace MongoAuth
{
    public class MongoMembershipProvider : MembershipProvider
    {
        private const string _CollectionName = "members";

        private bool _enablePasswordReset = true;
        private int _maxInvalidPasswordAttempts = 5;
        private int _minRequiredNonAlphanumericCharacters = 1;
        private int _minRequriedPasswordLength = 12;
        private int _passwordAttemptWindow = 60;
        private bool _requiresUniqueEmail = true;

        private MongoClient _dbClient;

        public override string ApplicationName { get; set; }

        public override bool EnablePasswordReset
        {
            get { return _enablePasswordReset; }
        }

        public override bool EnablePasswordRetrieval
        {
            get { return false; }
        }

        public override int MaxInvalidPasswordAttempts
        {
            get { return _maxInvalidPasswordAttempts; }
        }

        public override int MinRequiredNonAlphanumericCharacters
        {
            get { return _minRequiredNonAlphanumericCharacters; }
        }

        public override int MinRequiredPasswordLength
        {
            get { return _minRequriedPasswordLength; }
        }

        public override int PasswordAttemptWindow
        {
            get { return _passwordAttemptWindow; }
        }

        public override MembershipPasswordFormat PasswordFormat
        {
            get { return MembershipPasswordFormat.Hashed; }
        }

        public override string PasswordStrengthRegularExpression
        {
            get { return ""; }
        }

        public override bool RequiresQuestionAndAnswer
        {
            get { return false; }
        }

        public override bool RequiresUniqueEmail
        {
            get { return _requiresUniqueEmail; }
        }

        public override void Initialize(string name, NameValueCollection config)
        {
            if (config == null)
            {
                throw new ArgumentNullException("config");
            }

            base.Initialize(name, config);

            _enablePasswordReset = tryReadBool(config["enablePasswordReset"], _enablePasswordReset);
            _maxInvalidPasswordAttempts = tryReadInt(config["maxInvalidPasswordAttempts"], _maxInvalidPasswordAttempts);
            _minRequiredNonAlphanumericCharacters = tryReadInt(config["minRequiredNonAlphanumericCharacters"], _minRequiredNonAlphanumericCharacters);
            _minRequriedPasswordLength = tryReadInt(config["minRequriedPasswordLength"], _minRequriedPasswordLength);
            _passwordAttemptWindow = tryReadInt(config["passwordAttemptWindow"], _passwordAttemptWindow);
            _requiresUniqueEmail = tryReadBool(config["requiresUniqueEmail"], _requiresUniqueEmail);

            _dbClient = new MongoClient(new MongoClientSettings()
            {
                Server = new MongoServerAddress(DatabaseConfig.Host, DatabaseConfig.Port)
            });
        }

        public override bool ChangePassword(string username, string oldPassword, string newPassword)
        {
            bool isAuthenticated = ValidateUser(username, oldPassword);

            if (isAuthenticated)
            {
                var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);

                var mmTask = collection.Find(m => m.UserName.ToLower() == username.ToLower()).SingleOrDefaultAsync();
                mmTask.Wait();
                var mm = mmTask.Result;

                if (mm == null)
                {
                    return false;
                }

                byte[] salt = new byte[24];
                byte[] hash = calculateHash(newPassword, ref salt);

                mm.PassSalt = salt;
                mm.PassHash = hash;

                var replaceTask = collection.ReplaceOneAsync(m => m.Id == mm.Id, mm);
                replaceTask.Wait();

                if (replaceTask.IsCompleted)
                {
                    return true;
                }

                return false;
            }

            return false;
        }

        public override bool ChangePasswordQuestionAndAnswer(string username, string password, string newPasswordQuestion, string newPasswordAnswer)
        {
            throw new NotImplementedException();
        }

        public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
        {
            if (password.Length < MinRequiredPasswordLength)
            {
                status = MembershipCreateStatus.InvalidPassword;
                return null;
            }

            MembershipUser mu = null;

            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);

            var dupeUsers = collection.Find(m => m.UserName.ToLower() == username.ToLower()).CountAsync();
            var dupeEmails = collection.Find(m => m.EmailAddress.ToLower() == email.ToLower()).CountAsync();

            dupeUsers.Wait();
            dupeEmails.Wait();

            if (dupeUsers.Result > 0)
            {
                status = MembershipCreateStatus.DuplicateUserName;
            }
            else if (dupeEmails.Result > 0)
            {
                status = MembershipCreateStatus.DuplicateEmail;
            }
            else
            {
                byte[] salt = new byte[24];
                byte[] hash = calculateHash(password, ref salt);

                MongoMember mm = new MongoMember()
                {
                    Id = Guid.NewGuid(),
                    UserName = username,
                    PassHash = hash,
                    PassSalt = salt,
                    EmailAddress = email,

                    IsApproved = false,
                    IsLockedOut = false,

                    CreationDate = DateTime.Now,
                    LastLoginDate = DateTime.MinValue,
                    LastActivityDate = DateTime.MinValue,
                    LastLockoutDate = DateTime.MinValue
                };

                var insertTask = collection.InsertOneAsync(mm);
                insertTask.Wait();

                if (insertTask.Status == TaskStatus.RanToCompletion)
                {

                    status = MembershipCreateStatus.Success;
                    mu = new MembershipUser(this.Name, mm.UserName, mm.Id, mm.EmailAddress, "", "", mm.IsApproved, mm.IsLockedOut, mm.CreationDate, mm.LastLoginDate, mm.LastActivityDate, DateTime.MinValue, mm.LastLockoutDate);
                }
                else
                {
                    status = MembershipCreateStatus.ProviderError;
                }
            }

            return mu;
        }

        public override bool DeleteUser(string username, bool deleteAllRelatedData)
        {
            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);

            var deleteTask = collection.DeleteOneAsync(m => m.UserName.ToLower() == m.UserName.ToLower());
            deleteTask.Wait();

            if (deleteTask.Result.IsAcknowledged && deleteTask.Result.DeletedCount == 1)
            {
                return true;
            }

            return false;
        }

        public override MembershipUserCollection FindUsersByEmail(string emailToMatch, int pageIndex, int pageSize, out int totalRecords)
        {
            throw new NotImplementedException();
        }

        public override MembershipUserCollection FindUsersByName(string usernameToMatch, int pageIndex, int pageSize, out int totalRecords)
        {
            throw new NotImplementedException();
        }

        public override MembershipUserCollection GetAllUsers(int pageIndex, int pageSize, out int totalRecords)
        {
            MembershipUserCollection muc = new MembershipUserCollection();

            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);

            var users = collection.Find(new BsonDocument());

            var totalRecordsTask = users.CountAsync();
            totalRecordsTask.Wait();
            totalRecords = Convert.ToInt32(totalRecordsTask.Result);

            users = users.Skip(pageIndex * pageSize).Limit(pageSize);

            var pageItemsTask = users.ToListAsync();
            pageItemsTask.Wait();

            foreach (var mm in pageItemsTask.Result)
            {
                muc.Add(new MembershipUser(this.Name, mm.UserName, mm.Id, mm.EmailAddress, "", "", mm.IsApproved, mm.IsLockedOut, mm.CreationDate, mm.LastLoginDate, mm.LastActivityDate, DateTime.MinValue, mm.LastLockoutDate));
            }

            return muc;

        }

        public override int GetNumberOfUsersOnline()
        {
            throw new NotImplementedException();
        }

        public override string GetPassword(string username, string answer)
        {
            throw new NotImplementedException();
        }

        public override MembershipUser GetUser(string username, bool userIsOnline)
        {
            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);

            var mmTask = collection.Find(f => f.UserName.ToLower() == username.ToLower()).FirstOrDefaultAsync();
            mmTask.Wait();

            var mm = mmTask.Result;

            return mm == null ? null : new MembershipUser(this.Name, mm.UserName, mm.Id, mm.EmailAddress, "", "", mm.IsApproved, mm.IsLockedOut, mm.CreationDate, mm.LastLoginDate, mm.LastActivityDate, DateTime.MinValue, mm.LastLockoutDate);
        }

        public override MembershipUser GetUser(object providerUserKey, bool userIsOnline)
        {
            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);

            var mmTask = collection.Find(f => f.Id == (Guid)providerUserKey).FirstOrDefaultAsync();
            mmTask.Wait();

            var mm = mmTask.Result;

            return mm == null ? null : new MembershipUser(this.Name, mm.UserName, mm.Id, mm.EmailAddress, "", "", mm.IsApproved, mm.IsLockedOut, mm.CreationDate, mm.LastLoginDate, mm.LastActivityDate, DateTime.MinValue, mm.LastLockoutDate);
        }

        public override string GetUserNameByEmail(string email)
        {
            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);

            var mmTask = collection.Find(f => f.EmailAddress.ToLower() == email.ToLower()).FirstOrDefaultAsync();
            mmTask.Wait();

            var mm = mmTask.Result;

            return mm.UserName;
        }

        public override string ResetPassword(string username, string answer)
        {
            throw new NotImplementedException();
        }

        public void ChangeApproval(Guid Id, bool newStatus)
        {
            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);
            var task = collection.UpdateOneAsync(
                        Builders<MongoMember>.Filter.Eq(u => u.Id, Id),
                        Builders<MongoMember>.Update.Set(u => u.IsApproved, newStatus)
                        );
            task.Wait();
        }

        public void ChangeLockStatus(Guid Id, bool newStatus)
        {
            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);


            var updateDefinition = new List<UpdateDefinition<MongoMember>>();
            updateDefinition.Add(Builders<MongoMember>.Update.Set(u => u.IsLockedOut, newStatus));

            if (newStatus)
            {
                updateDefinition.Add(Builders<MongoMember>.Update.Set(u => u.LastLockoutDate, DateTime.Now));
            }
            else
            {
                updateDefinition.Add(Builders<MongoMember>.Update.Set(u => u.LockoutWindowAttempts, 0));
                updateDefinition.Add(Builders<MongoMember>.Update.Set(u => u.LastLockoutDate, DateTime.MinValue));
            }

            var task = collection.UpdateOneAsync(
                        Builders<MongoMember>.Filter.Eq(u => u.Id, Id),
                        Builders<MongoMember>.Update.Combine(updateDefinition)
                        );
            task.Wait();
        }

        public override bool UnlockUser(string userName)
        {
            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);
            var updTask = collection.UpdateOneAsync(Builders<MongoMember>.Filter.Eq(m => m.UserName.ToLower(), userName.ToLower()), Builders<MongoMember>.Update.Set(m => m.IsLockedOut, false));

            updTask.Wait();

            return updTask.Result.IsAcknowledged && updTask.Result.ModifiedCount == 1;
        }

        public override void UpdateUser(MembershipUser user)
        {
            throw new NotImplementedException();
        }

        public override bool ValidateUser(string username, string password)
        {
            var collection = _dbClient.GetDatabase(DatabaseConfig.Database).GetCollection<MongoMember>(_CollectionName);

            var mmTask = collection.Find(f => f.UserName.ToLower() == username.ToLower()).FirstOrDefaultAsync();
            mmTask.Wait();

            var mm = mmTask.Result;


            if (mm == null || !(mm.IsApproved && !mm.IsLockedOut))
            {
                return false;
            }

            byte[] salt = mm.PassSalt;
            byte[] hash = calculateHash(password, ref salt);

            bool isFail = false;

            for (int i = 0; i > hash.Length; i++)
            {
                isFail |= (hash[i] != mm.PassHash[i]);
            }

            if (isFail)
            {
                // increment failed counter and lock out if required.
            }
            else
            {
                // reset failed counter
            }

            return !isFail;
        }

        private static byte[] calculateHash(string password, ref byte[] salt)
        {
            if (!salt.Any(v => v != 0))
            {
                RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
                rng.GetBytes(salt);
            }

            byte[] passwordBytes = Encoding.UTF8.GetBytes(password);

            byte[] hashPlaintext = new byte[salt.Length + passwordBytes.Length];

            passwordBytes.CopyTo(hashPlaintext, 0);
            salt.CopyTo(hashPlaintext, passwordBytes.Length);

            SHA512CryptoServiceProvider sha = new SHA512CryptoServiceProvider();
            byte[] hash = sha.ComputeHash(hashPlaintext);

            return hash;
        }

        private static bool tryReadBool(string config, bool defaultValue)
        {
            bool temp = false;
            bool success = bool.TryParse(config, out temp);
            return success ? temp : defaultValue;
        }

        private static int tryReadInt(string config, int defaultValue)
        {
            int temp = 0;
            bool success = int.TryParse(config, out temp);
            return success ? temp : defaultValue;
        }
    }

    public class MongoMember
    {
        [BsonId]
        public Guid Id { get; set; }

        public string UserName { get; set; }
        public byte[] PassHash { get; set; }
        public byte[] PassSalt { get; set; }
        public string EmailAddress { get; set; }

        public bool IsApproved { get; set; }
        public bool IsLockedOut { get; set; }

        public DateTime CreationDate { get; set; }
        public DateTime LastActivityDate { get; set; }
        public DateTime LastLockoutDate { get; set; }
        public DateTime LastLoginDate { get; set; }

        public DateTime LockoutWindowStart { get; set; }
        public int LockoutWindowAttempts { get; set; }
    }

}