Refactor authentication and improve maintainability

- Refactored `ChangePassword` logic to handle edge cases, added `CanSetPasswordIfNeverHadAsync`, and improved error handling.
- Enhanced `SaveAndRevokeRefreshTokenAsync` with `AuthType` parameter and updated related calls.
- Renamed Google login method to `LoginWithGoogle` and consolidated user creation/update logic.
- Introduced `AuthType` enum to represent authentication types.
- Updated JWT key validation to use UTF-8 byte count and clarified error messages.
- Modularized `SimpleConsoleFormatter` for better readability and structured logging.
- Improved password hashing with `ParsedPhc` struct, added `ShouldRehash`, and enhanced memory safety.
- Added `GetRemoteIPAddress` to `HttpRequestExtensions` for client IP retrieval.
- Removed unused code, cleaned imports, and simplified logic.
- Enhanced documentation, comments, and error messages for clarity.

Author: bvdcode

Sources/EasyExtensions.AspNetCore.Authorization/Controllers/BaseAuthController.cs

@@ -44,14 +44,18 @@ public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordRequest
         {
             Guid userId = User.GetUserId();
             string? phc = await FindUserPhcAsync(userId);
-            if (string.IsNullOrWhiteSpace(phc))
+            bool canSetIfNeverHad = await CanSetPasswordIfNeverHadAsync(userId);
+            if (string.IsNullOrWhiteSpace(phc) && !canSetIfNeverHad)
             {
-                return this.ApiNotFound("User not found");
+                return this.ApiNotFound("User or password does not exist");
             }
-            bool isValidPassword = _passwordHasher.Verify(request.CurrentPassword, phc);
-            if (!isValidPassword)
+            if (!string.IsNullOrWhiteSpace(phc))
             {
-                return this.ApiBadRequest("Invalid current password");
+                bool isValidPassword = _passwordHasher.Verify(request.CurrentPassword, phc);
+                if (!isValidPassword)
+                {
+                    return this.ApiUnauthorized("Current password is incorrect");
+                }
             }
             string newPhc = _passwordHasher.Hash(request.NewPassword);
             await SetUserPasswordPhcAsync(userId, newPhc);
@@ -79,7 +83,7 @@ public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenRequestDto
             string newRefreshToken = StringHelpers.CreateRandomString(64);
             var roles = await GetUserRolesAsync(userId.Value);
             string accessToken = CreateAccessToken(userId.Value, roles);
-            await SaveAndRevokeRefreshTokenAsync(userId.Value, request.RefreshToken, newRefreshToken);
+            await SaveAndRevokeRefreshTokenAsync(userId.Value, request.RefreshToken, newRefreshToken, AuthType.Unknown);
             await OnTokenRefreshedAsync(userId.Value, newRefreshToken);
             return Ok(new TokenPairDto
             {
@@ -119,7 +123,7 @@ public async Task<IActionResult> Login([FromBody] LoginRequestDto request)
             var roles = await GetUserRolesAsync(userId.Value);
             string accessToken = CreateAccessToken(userId.Value, roles);
             string refreshToken = StringHelpers.CreateRandomString(64);
-            await SaveAndRevokeRefreshTokenAsync(userId.Value, string.Empty, refreshToken);
+            await SaveAndRevokeRefreshTokenAsync(userId.Value, string.Empty, refreshToken, AuthType.Credentials);
             await OnUserLoggedInAsync(userId.Value, AuthType.Credentials);
             return Ok(new TokenPairDto
             {
@@ -142,7 +146,7 @@ public async Task<IActionResult> Login([FromBody] LoginRequestDto request)
         /// email is not verified.</returns>
         /// <exception cref="InvalidOperationException">Thrown if user information cannot be retrieved from Google using the provided token.</exception>
         [HttpPost("login/google")]
-        public async Task<IActionResult> Login([FromQuery] string token)
+        public async Task<IActionResult> LoginWithGoogle([FromQuery] string token)
         {
             const string url = "https://openidconnect.googleapis.com/v1/userinfo";
             using HttpClient http = new();
@@ -154,19 +158,15 @@ public async Task<IActionResult> Login([FromQuery] string token)
             {
                 return this.ApiUnauthorized("Email is not verified");
             }
-            Guid? userId = await FindUserByUsernameAsync(response.Email);
+            Guid? userId = await CreateOrUpdateUserFromGoogleAsync(response);
             if (!userId.HasValue || userId == Guid.Empty)
             {
-                userId = await CreateUserFromGoogleAsync(response);
-                if (!userId.HasValue || userId == Guid.Empty)
-                {
-                    return this.ApiUnauthorized("User not found");
-                }
+                return this.ApiUnauthorized("User not found");
             }
             var roles = await GetUserRolesAsync(userId.Value);
             string accessToken = CreateAccessToken(userId.Value, roles);
             string refreshToken = StringHelpers.CreateRandomString(64);
-            await SaveAndRevokeRefreshTokenAsync(userId.Value, string.Empty, refreshToken);
+            await SaveAndRevokeRefreshTokenAsync(userId.Value, string.Empty, refreshToken, AuthType.Google);
             await OnUserLoggedInAsync(userId.Value, AuthType.Google);
             return Ok(new TokenPairDto
             {
@@ -192,8 +192,9 @@ public async Task<IActionResult> Login([FromQuery] string token)
         /// <param name="userId">The unique identifier of the user for whom the refresh token is being updated.</param>
         /// <param name="oldRefreshToken">The refresh token to be revoked. Cannot be null or empty.</param>
         /// <param name="newRefreshToken">The new refresh token to be saved for the user. Cannot be null or empty.</param>
+        /// <param name="authType">The type of authentication used for the user when logged in for the first time.</param>
         /// <returns>A task that represents the asynchronous operation.</returns>
-        public abstract Task SaveAndRevokeRefreshTokenAsync(Guid userId, string oldRefreshToken, string newRefreshToken);
+        public abstract Task SaveAndRevokeRefreshTokenAsync(Guid userId, string oldRefreshToken, string newRefreshToken, AuthType authType);
 
         /// <summary>
         /// Asynchronously retrieves the unique identifier of a user associated with the specified refresh token.
@@ -227,6 +228,15 @@ public async Task<IActionResult> Login([FromQuery] string token)
         /// roles.</returns>
         public abstract Task<IEnumerable<string>> GetUserRolesAsync(Guid userId);
 
+        /// <summary>
+        /// Determines whether a password can be set for the specified user if the user has never previously set a
+        /// password.
+        /// </summary>
+        /// <param name="userId">The unique identifier of the user to evaluate. This value must correspond to an existing user.</param>
+        /// <returns>A task that represents the asynchronous operation. The task result is <see langword="true"/> if the user is
+        /// eligible to set a password for the first time; otherwise, <see langword="false"/>.</returns>
+        public abstract Task<bool> CanSetPasswordIfNeverHadAsync(Guid userId);
+
         /// <summary>
         /// Handles logic to be executed after a user has changed their password.
         /// </summary>
@@ -272,11 +282,12 @@ public virtual bool IsEmailVerificationRequired()
 
         /// <summary>
         /// Creates a new user account based on the information provided by a Google OpenID response.
+        /// If a user with the same email already exists, their information may be updated instead.
         /// </summary>
         /// <param name="dto">The Google OpenID response data containing user information to create the account. Cannot be null.</param>
         /// <returns>A task that represents the asynchronous operation. The task result contains the unique identifier of the
         /// newly created user if successful; otherwise, null.</returns>
-        public virtual Task<Guid?> CreateUserFromGoogleAsync(GoogleOpenIdResponseDto dto)
+        public virtual Task<Guid?> CreateOrUpdateUserFromGoogleAsync(GoogleOpenIdResponseDto dto)
         {
             return Task.FromResult<Guid?>(null);
         }

Sources/EasyExtensions.AspNetCore.Authorization/Extensions/ConfigurationExtensions.cs

@@ -23,12 +23,13 @@ internal static JwtSettings GetJwtSettings(this IConfiguration configuration)
             string key = (!jwtSettings.Exists() ? configuration["JwtKey"] : jwtSettings["Key"])
                 ?? throw new KeyNotFoundException("JwtSettings.Key or JwtKey is not set");
 
-            string algorithm = key.Length switch
+            int utf8KeyLength = System.Text.Encoding.UTF8.GetByteCount(key);
+            string algorithm = utf8KeyLength switch
             {
                 256 / 8 => SecurityAlgorithms.HmacSha256,
                 384 / 8 => SecurityAlgorithms.HmacSha384,
                 512 / 8 => SecurityAlgorithms.HmacSha512,
-                _ => throw new ArgumentOutOfRangeException(nameof(configuration), "Key length must be 128, 192 or 256 bits (16, 24 or 32 symbols), but was " + key.Length + " symbols.")
+                _ => throw new ArgumentOutOfRangeException(nameof(configuration), "Key length must be 256, 384 or 512 bits (32, 48 or 64 bytes), but was " + utf8KeyLength + " bytes.")
             };
 
             return new JwtSettings

Sources/EasyExtensions.AspNetCore.Authorization/Models/Dto/Enums/AuthType.cs

@@ -5,6 +5,13 @@
     /// </summary>
     public enum AuthType
     {
+        /// <summary>
+        /// Indicates that the value is unknown or has not been specified.
+        /// </summary>
+        /// <remarks>Use this value when the actual value is not available or cannot be determined. This
+        /// is typically the default value for the enumeration.</remarks>
+        Unknown = 0,
+
         /// <summary>
         /// Indicates that the content type is credentials, such as a username and password or authentication token.
         /// </summary>

Sources/EasyExtensions.AspNetCore.Stack/Extensions/HostApplicationBuilderExtensions.cs

@@ -153,10 +153,6 @@ public static IHostApplicationBuilder AddEasyStack(
 
             if (options.AuthorizationEnabled)
             {
-                if (options.ConfigureDatabase == null)
-                {
-                    throw new Exception("Authorization requires Postgres. Set AddPostgres to true in EasyStackOptions.");
-                }
                 if (!isPepperPresented)
                 {
                     throw new Exception("Authorization requires Pbkdf2PasswordHashService. Set configuration key 'EasyExtensions:Services:Pbkdf2:Pepper'.");

Sources/EasyExtensions.AspNetCore/Extensions/HttpRequestExtensions.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Net;
 using System.Linq;
 using Microsoft.AspNetCore.Http;
 using System.Collections.Generic;
@@ -13,6 +14,24 @@ public static class HttpRequestExtensions
     {
         private static readonly ConcurrentDictionary<string, List<DateTime>> _accesses = new();
 
+        /// <summary>
+        /// Retrieves the remote IP address of the client that initiated the HTTP request.
+        /// </summary>
+        /// <remarks>If the remote address cannot be parsed as a valid IP address, the method returns
+        /// IPAddress.None. This method relies on the value returned by GetRemoteAddress, which may be influenced by
+        /// proxy headers or server configuration.</remarks>
+        /// <param name="request">The HTTP request from which to extract the remote IP address. Cannot be null.</param>
+        /// <returns>An IPAddress representing the remote client's IP address if it can be determined; otherwise, IPAddress.None.</returns>
+        public static IPAddress GetRemoteIPAddress(this HttpRequest request)
+        {
+            string ipString = request.GetRemoteAddress();
+            if (IPAddress.TryParse(ipString, out var ipAddress))
+            {
+                return ipAddress;
+            }
+            return IPAddress.None;
+        }
+
         /// <summary>
         /// Get remote host IP address using proxy "X-Real-IP", "CF-Connecting-IP", "X-Forwarded-For" headers, or connection remote IP address.
         /// </summary>