Authenticating a User

Authorization & Authentication

Authorizing users works by checking the email and hashed password against information in the database.

When a user submits the Sign In form from the UI, the following process occurs:

The AuthenticateAsync() method performs the following actions:

For this strategy to work correctly, the AuthenticateAsync() method must return an object which represents the user on successful login, or return null or an error if the credentials are incorrect.

Once a user is authorized a JWT token is generated (using the Auth0 JWT library) and passed back to the front-end to be used in the Authorization header until the user signs out or the token expires.

For authenticated users the application uses a pre-processor before() the routes to verify the authentication for each request, which is delegated to: AppUtils.handleAuthAndSetUser.

There the Authorization header is extracted and validated using the Auth0 JWT library. If that is successful the userId is set as a request attribute which can be accessed by the route implementation.

Implementing Authentication

To implement database authentication, you will modify the AuthenticateSync() method in the AuthService.

public Task<Dictionary<string, object>> AuthenticateAsync(string email, string plainPassword)
{
    if (email == "graphacademy@neo4j.com" && plainPassword == "letmein")
    {
        var exampleUser = new Dictionary<string, object>
        {
            ["identity"] = 1,
            ["properties"] = new Dictionary<string, object>
            {
                ["userId"] = 1,
                ["email"] = "graphacademy@neo4j.com",
                ["name"] = "Graph Academy"
            }
        };

        var safeProperties = SafeProperties(exampleUser["properties"] as Dictionary<string, object>);

        safeProperties.Add("token", JwtHelper.CreateToken(GetUserClaims(safeProperties)));

        return Task.FromResult(safeProperties);
    }

    return Task.FromResult<Dictionary<string,object>>(null);
}

Your challenge is to update the AuthenticateAsync() method to perform the following actions:

// Open a new session
using var session = _driver.AsyncSession();
// Do something with the session...

var cursor = await tx.RunAsync("MATCH (u: User {email: $email}) RETURN u", new { email });

if (!await cursor.FetchAsync())
{
    // no records
    return null;
}    

if (!BCryptNet.Verify(plainPassword, user["password"].As<string>()))
    return null;

var safeProperties = SafeProperties(user);
safeProperties.Add("token", JwtHelper.CreateToken(GetUserClaims(safeProperties)));
return safeProperties;    

Working Solution

public async Task<Dictionary<string, object>> AuthenticateAsync(string email, string plainPassword)
{
    await using var session = _driver.AsyncSession();
    var user = await session.ExecuteReadAsync(async tx =>
    {

        var cursor = await tx.RunAsync("MATCH (u: User {email: $email}) RETURN u", new { email });

        if (!await cursor.FetchAsync())
        {
            // no records
            return null;
        }    

        var record = cursor.Current;
        var userProperties = record["u"].As<INode>().Properties;
        return userProperties.ToDictionary(x => x.Key, x => x.Value);
    });

    if (user == null)
        return null;

    if (!BCryptNet.Verify(plainPassword, user["password"].As<string>()))
        return null;

    var safeProperties = SafeProperties(user);
    safeProperties.Add("token", JwtHelper.CreateToken(GetUserClaims(safeProperties)));
    return safeProperties;    
}

Testing

To test that this functionality has been correctly implemented, run the following code in a new terminal session:

dotnet test --logger "console;verbosity=detailed" --filter "Neoflix.Challenges._05_Authentication"

The test file is located at Neoflix.Challenges/05-Authentication.cs.

git checkout 05-authentication