public TokenControllerTests()
{
Thread.CurrentPrincipal = new TestPrincipalWrapper(new Claim(ClaimTypes.Email, _properEmail));
_externalLoginInfoInstance = new ExternalLoginInfo((ClaimsPrincipal)Thread.CurrentPrincipal, "Facebook", "providers_key", "some_display_name");
_returnedResponseTokenModel = new TokenResponseViewModel()
{
DisplayName = "foo1",
Email = "foo2",
RefreshToken = "foo3",
Role = "foo4",
Token = "foo5",
User = "******"
};
_properRevokeTokenModel = new RevokeTokenRequestViewModel()
{
UserName = _properName,
Token = _properToken,
RefreshToken = _properToken
};
_properRefreshTokenModel = new RefreshTokenRequestViewModel()
{
Email = _properEmail,
RefreshToken = _properToken
};
_properTokenRequestModel = new TokenRequestViewModel()
{
Email = _properEmail,
Password = _properPassword,
};
_properUser = new AppUser()
{
Email = _properEmail
};
DefaultHttpContext httpContext = new DefaultHttpContext();
TempDataDictionary tempData = new TempDataDictionary(httpContext, Mock.Of <ITempDataProvider>())
{
{ "requestIp", "127.0.0.1" }
};
_tokenServiceMock = new Mock <ITokenService>();
_userServiceMock = new Mock <IUserService>();
_userServiceMock.Setup(mock => mock.GetIpAddress(It.IsAny <DefaultHttpContext>())).Returns("127.0.0.1");
_userServiceMock.Setup(mock => mock.FindUserByEmail(_properEmail)).ReturnsAsync(_properUser);
_userServiceMock.Setup(mock => mock.FindUserByEmail(_wrongEmail)).ReturnsAsync((AppUser)null);
_userServiceMock.Setup(mock => mock.VerifyUsersPassword(It.IsAny <AppUser>(), It.IsAny <string>())).ReturnsAsync(true);
_userServiceMock.Setup(mock => mock.GetUserRoleAsync(It.IsAny <AppUser>())).ReturnsAsync("User");
_userServiceMock.Setup(mock => mock.GetExternalLogin()).ReturnsAsync(_externalLoginInfoInstance);
_userServiceMock.Setup(mock => mock.CreateUserAsync(It.IsAny <UserRegisterViewModel>())).ReturnsAsync(true);
_tokenServiceMock.Setup(mock => mock.GenerateTokenResponse(It.IsAny <AppUser>(), It.IsAny <string>(), It.IsAny <string>())).Returns(_returnedResponseTokenModel);
_tokenServiceMock.Setup(mock => mock.VerifyRefreshToken(It.IsAny <string>(), It.IsAny <string>(), It.IsAny <string>())).Returns(true);
_tokenServiceMock.Setup(mock => mock.RevokeTokens(_properRevokeTokenModel)).Returns(true);
_controller = new TokenController(_tokenServiceMock.Object, _userServiceMock.Object)
{
TempData = tempData
};
}
public IActionResult RevokeToken([FromBody] RevokeTokenRequestViewModel model)
{
if (!_tokenService.RevokeTokens(model))
{
return(new ObjectResult("There was a problem logging the user out correctly.")
{
StatusCode = 500
});
}
return(Ok());
}
public bool RevokeTokens(RevokeTokenRequestViewModel model)
{
try
{
_tokenRepo.DeleteRefreshToken(model.UserName);
CleanUpBlacklistedTokens();
_tokenRepo.AddBlacklistedToken(model.Token);
return(true);
}
catch
{
return(false);
}
}
public IActionResult RevokeToken(RevokeTokenRequestViewModel model)
{
// accept token from request body or cookie
var token = model.Token ?? Request.Cookies["refreshToken"];
if (string.IsNullOrEmpty(token))
{
return(BadRequest(new { message = "Token is required" }));
}
// users can revoke their own tokens and admins can revoke any tokens
if (!Account.OwnsToken(token) && Account.Role != Role.Admin)
{
return(Unauthorized(new { message = "Unauthorized" }));
}
_accountService.RevokeToken(token, ipAddress());
return(Ok(new { message = "Token revoked" }));
}