[FA-17] Update auth

FictionArchive.Service.Shared/Extensions/AuthenticationExtensions.cs

@@ -1,7 +1,9 @@
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
 using Microsoft.IdentityModel.Tokens;
+using FictionArchive.Service.Shared.Constants;
 using FictionArchive.Service.Shared.Models.Authentication;
 using System.Linq;
 
@@ -30,16 +32,59 @@ public static class AuthenticationExtensions
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidateIssuer = oidcConfig.ValidateIssuer,
+                    ValidIssuer = oidcConfig.ValidIssuer,
                     ValidateAudience = oidcConfig.ValidateAudience,
                     ValidateLifetime = oidcConfig.ValidateLifetime,
                     ValidateIssuerSigningKey = oidcConfig.ValidateIssuerSigningKey,
                     ClockSkew = TimeSpan.FromMinutes(5)
                 };
+
+                options.Events = CreateLoggingJwtBearerEvents();
             });
 
         return services;
     }
 
+    private static JwtBearerEvents CreateLoggingJwtBearerEvents(JwtBearerEvents? existingEvents = null)
+    {
+        return new JwtBearerEvents
+        {
+            OnMessageReceived = existingEvents?.OnMessageReceived ?? (_ => Task.CompletedTask),
+            OnAuthenticationFailed = context =>
+            {
+                var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>()
+                    .CreateLogger("JwtBearerAuthentication");
+
+                logger.LogWarning(context.Exception, "JWT authentication failed: {Message}", context.Exception.Message);
+
+                return existingEvents?.OnAuthenticationFailed?.Invoke(context) ?? Task.CompletedTask;
+            },
+            OnChallenge = context =>
+            {
+                var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>()
+                    .CreateLogger("JwtBearerAuthentication");
+
+                logger.LogDebug(
+                    "JWT challenge issued. Error: {Error}, ErrorDescription: {ErrorDescription}",
+                    context.Error,
+                    context.ErrorDescription);
+
+                return existingEvents?.OnChallenge?.Invoke(context) ?? Task.CompletedTask;
+            },
+            OnTokenValidated = context =>
+            {
+                var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>()
+                    .CreateLogger("JwtBearerAuthentication");
+
+                logger.LogDebug(
+                    "JWT token validated for subject: {Subject}",
+                    context.Principal?.FindFirst("sub")?.Value ?? "unknown");
+
+                return existingEvents?.OnTokenValidated?.Invoke(context) ?? Task.CompletedTask;
+            }
+        };
+    }
+
     public static IServiceCollection AddOidcCookieAuthentication(this IServiceCollection services, IConfiguration configuration, string cookieName = "fa_session")
     {
         var oidcConfig = configuration.GetSection("OIDC").Get<OidcConfiguration>();
@@ -58,7 +103,7 @@ public static class AuthenticationExtensions
                 options.Audience = oidcConfig.Audience;
                 options.RequireHttpsMetadata = !string.IsNullOrEmpty(oidcConfig.Authority) && oidcConfig.Authority.StartsWith("https://");
 
-                options.Events = new JwtBearerEvents
+                var cookieEvents = new JwtBearerEvents
                 {
                     OnMessageReceived = context =>
                     {
@@ -71,10 +116,12 @@ public static class AuthenticationExtensions
                         return Task.CompletedTask;
                     }
                 };
+                options.Events = CreateLoggingJwtBearerEvents(cookieEvents);
 
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidateIssuer = oidcConfig.ValidateIssuer,
+                    ValidIssuer = oidcConfig.ValidIssuer,
                     ValidateAudience = oidcConfig.ValidateAudience,
                     ValidateLifetime = oidcConfig.ValidateLifetime,
                     ValidateIssuerSigningKey = oidcConfig.ValidateIssuerSigningKey,
@@ -88,8 +135,8 @@ public static class AuthenticationExtensions
     public static IServiceCollection AddFictionArchiveAuthorization(this IServiceCollection services)
     {
         services.AddAuthorizationBuilder()
-            .AddPolicy("Admin", policy => policy.RequireRole("admin"))
-            .AddPolicy("User", policy => policy.RequireAuthenticatedUser());
+            .AddPolicy(AuthorizationConstants.Policies.Admin, policy => policy.RequireRole(AuthorizationConstants.Roles.Admin))
+            .AddPolicy(AuthorizationConstants.Policies.User, policy => policy.RequireAuthenticatedUser());
 
         return services;
     }