Add/Update: AdminPasswordAttribute and Login Logic

Author: CYHTF7

TcgPlatformApi/Controllers/BoosterController.cs

@@ -3,6 +3,7 @@
 using TcgPlatformApi.Services;
 using Microsoft.AspNetCore.Authorization;
 using System.Security.Claims;
+using TcgPlatformApi.FiltersAndAttributes;
 
 namespace TcgPlatformApi.Controllers
 {
@@ -19,6 +20,7 @@ public BoosterController(IBoosterService playerBoosterService)
         }
 
         [HttpPost("addboosters")]
+        [AdminPassword]
         public async Task<IActionResult> AddBoosterAsync([FromBody] List<BoosterRequest> requests)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
@@ -55,6 +57,7 @@ public async Task<IActionResult> GetPlayerBoostersAsync()
 
 
         [HttpPost("removeboosters")]
+        [AdminPassword]
         public async Task<IActionResult> RemoveBoosterAsync([FromBody] List<BoosterRequest> requests)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;

TcgPlatformApi/Controllers/CardController.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using System.Security.Claims;
+using TcgPlatformApi.FiltersAndAttributes;
 using TcgPlatformApi.Models;
 using TcgPlatformApi.Services;
 
@@ -19,6 +20,7 @@ public CardController(ICardService playerCardService)
         }
 
         [HttpPost("addcards")]
+        [AdminPassword]
         public async Task<IActionResult> AddCardsAsync([FromBody] List<CardRequest> requests)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
@@ -54,6 +56,7 @@ public async Task<IActionResult> GetPlayerCardsAsync()
         }
 
         [HttpPost("removecards")]
+        [AdminPassword]
         public async Task<IActionResult> RemoveCardsAsync([FromBody] List<CardRequest> requests)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;

TcgPlatformApi/Controllers/DeckCardController.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using System.Security.Claims;
+using TcgPlatformApi.FiltersAndAttributes;
 using TcgPlatformApi.Models;
 using TcgPlatformApi.Services;
 
@@ -19,6 +20,7 @@ public DeckCardController(IDeckCardService deckCardService)
         }
 
         [HttpPost("adddeckcard")]
+        [AdminPassword]
         public async Task<IActionResult> AddCardInDeckAsync([FromBody] DeckCardRequest request)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
@@ -34,6 +36,7 @@ public async Task<IActionResult> AddCardInDeckAsync([FromBody] DeckCardRequest r
         }
 
         [HttpPost("removedeckcard")]
+        [AdminPassword]
         public async Task<IActionResult> RemoveCardsAsync([FromBody] DeckCardRemoveRequest request)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
@@ -49,6 +52,7 @@ public async Task<IActionResult> RemoveCardsAsync([FromBody] DeckCardRemoveReque
         }
 
         [HttpPost("updatedeckcardsorder")]
+        [AdminPassword]
         public async Task<IActionResult> UpdateDeckCardOrderAsync([FromBody] List<DeckCardOrderRequest> requests)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;

TcgPlatformApi/Controllers/DeckController.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using System.Security.Claims;
+using TcgPlatformApi.FiltersAndAttributes;
 using TcgPlatformApi.Models;
 using TcgPlatformApi.Services;
 
@@ -19,6 +20,7 @@ public DeckController(IDeckService playerDeckService)
         }
 
         [HttpPost("addorupdatedecks")]
+        [AdminPassword]
         public async Task<IActionResult> AddorUpdateDecksAsync([FromBody] List<DeckRequest> requests)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
@@ -34,7 +36,7 @@ public async Task<IActionResult> AddorUpdateDecksAsync([FromBody] List<DeckReque
                 DeckName = r.DeckName,
                 PlayerId = parsedPlayerId,
                 Order = r.Order,
-                Cards = r.Cards.Select(c => new CardInDeck
+                Cards = r.Cards.Select(c => new DeckCardClient
                 {
                     CardId = c.CardId,
                     Quantity = c.Quantity
@@ -46,6 +48,7 @@ public async Task<IActionResult> AddorUpdateDecksAsync([FromBody] List<DeckReque
         }
 
         [HttpPost("removedecks")]
+        [AdminPassword]
         public async Task<IActionResult> RemoveDeckAsync([FromBody] List<DeckRemoveRequest> requests) 
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
@@ -87,6 +90,7 @@ public async Task<IActionResult> GetAllDecksByPlayerIdAsync()
         }
 
         [HttpPost("updatedecksorder")]
+        [AdminPassword]
         public async Task<IActionResult> UpdateDeckCardOrderAsync([FromBody] List<DeckOrderRequest> requests)
         {
             var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;

TcgPlatformApi/Controllers/ProfileController.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using System.Security.Claims;
+using TcgPlatformApi.FiltersAndAttributes;
 using TcgPlatformApi.Models;
 using TcgPlatformApi.Services;
 
@@ -25,6 +26,7 @@ public async Task<IActionResult> GetProfile(int id)
         }
 
         [HttpPost("createprofile")]
+        [AdminPassword]
         public async Task<IActionResult> CreateProfile([FromBody] PlayerProfile newProfile)
         {
             var createProfile = await _profileService.CreateProfile(newProfile);
@@ -33,6 +35,7 @@ public async Task<IActionResult> CreateProfile([FromBody] PlayerProfile newProfi
 
         [Authorize]
         [HttpPost("updateprofile")]
+        [AdminPassword]
         public async Task<IActionResult> UpdateProfile([FromBody] PlayerProfileDTO updatedProfile) 
         {
             var profileId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;

TcgPlatformApi/Controllers/RegVerLogController.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
+using System.Security.Claims;
 using TcgPlatformApi.Models;
 using TcgPlatformApi.Services;
 
@@ -36,6 +37,20 @@ public async Task<IActionResult> Login([FromBody] PlayerProfileLogRequest reques
             return Ok(result);
         }
 
+        [HttpGet("getplayerprofile")]
+        public async Task<IActionResult> GetPlayerProfile()
+        {
+            var playerId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+
+            if (!int.TryParse(playerId, out int parsedPlayerId))
+            {
+                return BadRequest("Invalid playerId!");
+            }
+
+            var result = await _regVerLogService.GetPlayerProfile(parsedPlayerId);
+            return Ok(result);
+        }
+
         [HttpPost("resetpassword")]
         public async Task<IActionResult> ResetPassword([FromBody] RessPassRequest request)
         {

TcgPlatformApi/Data/AppDbContext.cs

@@ -1,4 +1,5 @@
-using Microsoft.EntityFrameworkCore;
+using Microsoft.AspNetCore.Http.HttpResults;
+using Microsoft.EntityFrameworkCore;
 using TcgPlatformApi.Models;
 
 namespace TcgPlatformApi.Data
@@ -24,4 +25,8 @@ protected override void OnModelCreating(ModelBuilder modelBuilder)
 
 //dotnet tool install --global dotnet-ef //first
 //dotnet ef migrations add AddRegistrationFields
-//dotnet ef database update
+//dotnet ef database update
+
+//CREATE INDEX idx_player_cards_playerid ON "PlayerCards" ("PlayerId");
+//CREATE INDEX idx_player_boosters_playerid ON "PlayerBoosters" ("PlayerId");
+//CREATE INDEX idx_player_decks_playerid ON "PlayerDecks" ("PlayerId");

TcgPlatformApi/FiltersAndAttributes/AdminPasswordAttribute.cs

@@ -0,0 +1,26 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+using TcgPlatformApi.Settings;
+
+namespace TcgPlatformApi.FiltersAndAttributes
+{
+    public class AdminPasswordAttribute : ActionFilterAttribute
+    {
+        public override void OnActionExecuting(ActionExecutingContext context)
+        {
+            var providedPassword = context.HttpContext.Request.Headers["Admin-Password"].FirstOrDefault();
+
+            var config = context.HttpContext.RequestServices.GetRequiredService<IOptions<AdminSettings>>();
+            var correctPassword = config.Value.Password;
+
+            if (string.IsNullOrEmpty(providedPassword) || providedPassword != correctPassword)
+            {
+                context.Result = new UnauthorizedObjectResult("Invalid admin password");
+                return;
+            }
+
+            base.OnActionExecuting(context);
+        }
+    }
+}