public async Task <IActionResult> Register(UserAccountModel body)
{
try
{
if (body == null)
{
IActionResult actionResult = BadRequest(
"The client set the requested body to null before it was sent."
);
return(StatusCode(StatusCodes.Status400BadRequest, actionResult));
}
else
{
if (string.IsNullOrEmpty(body.firstName) || string.IsNullOrWhiteSpace(body.firstName))
{
IActionResult actionResult = customActionResult.FieldsRequired(
"The 'firstname' field has been sent from the client null, empty, or whitespaced."
);
return(StatusCode(StatusCodes.Status411LengthRequired, actionResult));
}
else if (string.IsNullOrEmpty(body.lastName) || string.IsNullOrWhiteSpace(body.lastName))
{
IActionResult actionResult = customActionResult.FieldsRequired(
"The 'firstname' field has been sent from the client null, empty, or whitespaced."
);
return(StatusCode(StatusCodes.Status411LengthRequired, actionResult));
}
else if (string.IsNullOrEmpty(body.userName) || string.IsNullOrWhiteSpace(body.userName))
{
IActionResult actionResult = customActionResult.FieldsRequired(
"The 'email' field has been sent from the client null, empty, or whitespaced."
);
return(StatusCode(StatusCodes.Status411LengthRequired, actionResult));
}
else if (string.IsNullOrEmpty(body.password) || string.IsNullOrWhiteSpace(body.password))
{
IActionResult actionResult = customActionResult.FieldsRequired(
"The 'password' field has been sent from the client null, empty, or whitespaced."
);
return(StatusCode(StatusCodes.Status411LengthRequired, actionResult));
}
else if (string.IsNullOrEmpty(body.role) || string.IsNullOrWhiteSpace(body.role))
{
IActionResult actionResult = customActionResult.FieldsRequired(
"The 'role' field has been sent from the client null, empty, or whitespaced."
);
return(StatusCode(StatusCodes.Status411LengthRequired, actionResult));
}
else
{
DynamicParameters selectParameters = new DynamicParameters();
selectParameters.Add("@userName", body.userName);
string selectQuery = @$ "SELECT [id], [userName] FROM [User] WHERE [userName] = @userName";
var resultQuery = await _db.SelectAsync <UserAccountModel, dynamic>(selectQuery, selectParameters);
if (resultQuery.Count > 0)
{
IActionResult actionResult = customActionResult.Conflict(
"The user account you are trying to create, already exists."
);
return(StatusCode(StatusCodes.Status409Conflict, actionResult));
}
else
{
byte[] salt = hashPassword.CreateSalt(10);
string hashedPassword = hashPassword.GenerateSHA256Hash(body.password, salt, false);
if (string.IsNullOrEmpty(hashedPassword) || string.IsNullOrWhiteSpace(hashedPassword))
{
IActionResult actionResult = customActionResult.Locked(
"The password failed to hash, so the account creation process been locked. Please Try Again."
);
return(StatusCode(StatusCodes.Status423Locked, actionResult));
}
else
{
DynamicParameters insertParameters = new DynamicParameters();
insertParameters.Add("@firstName", body.firstName);
insertParameters.Add("@lastName", body.lastName);
insertParameters.Add("@userName", body.userName);
insertParameters.Add("@role", body.role);
insertParameters.Add("@password", hashedPassword);
string insertQuery = @"
INSERT INTO [User] ([firstName], [lastName], [userName], [password], [role])
VALUES (@firstName, @lastName, @userName, @password, @role)
";
await _db.InsertAsync(insertQuery, insertParameters);
IActionResult actionResult = customActionResult.Created(
"The user account as been created successfully. "
);
return(StatusCode(StatusCodes.Status201Created, actionResult));
}
}
}
}
}
catch (Exception e)
{
return(StatusCode(StatusCodes.Status500InternalServerError, e.Message));
}
}
public async Task <IActionResult> ChangePassword(UserAccountModel body)
{
try
{
if (body == null)
{
IActionResult actionResult = BadRequest(
"The client set the requested body to null before it was sent."
);
return(StatusCode(StatusCodes.Status400BadRequest, actionResult));
}
else if (string.IsNullOrEmpty(body.password) || string.IsNullOrWhiteSpace(body.password))
{
IActionResult actionResult = customActionResult.FieldsRequired(
"The 'password' field has been sent from the client null, empty, or whitespaced."
);
return(StatusCode(StatusCodes.Status411LengthRequired, actionResult));
}
else if (string.IsNullOrEmpty(body.oldPassword) || string.IsNullOrWhiteSpace(body.oldPassword))
{
IActionResult actionResult = customActionResult.FieldsRequired(
"The 'old password' field has been sent from the client null, empty, or whitespaced."
);
return(StatusCode(StatusCodes.Status411LengthRequired, actionResult));
}
else
{
DynamicParameters selectPasswordByUserId_params = new DynamicParameters();
selectPasswordByUserId_params.Add("@userId", _claims.GetUserId());
string selectPasswordByUserId_string = $"SELECT [password] FROM [User] WHERE [id] = @userId";
var selectPasswordByUserId_results = await _db.SelectAsync <UserAccountModel, dynamic>(selectPasswordByUserId_string, selectPasswordByUserId_params);
if (selectPasswordByUserId_results.Count < 1)
{
IActionResult actionResult = customActionResult.NotFound(
"The user details provided do not exist in the database, try again."
);
return(StatusCode(StatusCodes.Status404NotFound, actionResult));
}
else
{
_user.oldPassword = selectPasswordByUserId_results[0].password;
bool comparePassword = new HashPassword().VerifyPassword(_user.oldPassword, body.oldPassword);
byte[] salt = hashPassword.CreateSalt(10);
string newPasswordHashed = hashPassword.GenerateSHA256Hash(body.password, salt, false);
if (comparePassword != true)
{
IActionResult actionResult = customActionResult.Unauthorized(
"The old password is wrong, so the access is denied."
);
return(StatusCode(StatusCodes.Status401Unauthorized, actionResult));
}
else if (string.IsNullOrEmpty(newPasswordHashed) || string.IsNullOrWhiteSpace(newPasswordHashed))
{
IActionResult actionResult = customActionResult.Locked(
"The new password failed to hash, so the process to change the password has been blocked. Please Try Again."
);
return(StatusCode(StatusCodes.Status423Locked, actionResult));
}
else
{
DynamicParameters updatePassword_params = new DynamicParameters();
updatePassword_params.Add("@userId", _claims.GetUserId());
updatePassword_params.Add("@newPassword", newPasswordHashed);
string updatePassword_string = @"UPDATE [User] SET [password] = @newPassword WHERE [id] = @userId";
await _db.UpdateAsync(updatePassword_string, updatePassword_params);
IActionResult actionResult = customActionResult.Ok(
"Password changed successfully. Be careful and don't give it to anyone."
);
return(StatusCode(StatusCodes.Status202Accepted, actionResult));
}
}
}
}
catch (Exception e)
{
return(StatusCode(StatusCodes.Status500InternalServerError, e.Message));
}
}
