Add sessionId to JWT and update session handling

The JwtService now includes sessionId in access tokens, and all usages have been updated to pass sessionId when generating tokens. UserSession now supports public encryption and signing keys. Tests and session management logic have been updated to reflect these changes, ensuring session-specific claims in JWTs and improved session tracking.

Govor.API/Controllers/Authentication/SessionKeysController.cs

@@ -0,0 +1,17 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Govor.API.Controllers.Authentication;
+
+[RequireHttps]
+[ApiController]
+[Route("api/session")]
+[Authorize(Roles = "Admin, User")]
+public class SessionKeysController : Controller
+{
+    // GET
+    public IActionResult Index()
+    {
+        return View();
+    }
+}

Govor.Application.Tests/Services/Authentication/JwtServiceTests.cs

@@ -56,23 +56,52 @@ public class JwtServiceTests
     }
 
     [Test]
-    public async Task GenerateJwtToken_ShouldReturnValidJwtString()
+    public async Task GenerateJwtToken_ShouldReturnValidJwtString_WithCorrectClaims()
     {
         // Arrange
         var user = _fixture.Create<User>();
+        var sessionId = Guid.NewGuid();
         var expectedRole = "User";
-        _invitesServiceMock.Setup(s => s.GetRoleAsync(user)).Returns(Task.FromResult(expectedRole));
+        _invitesServiceMock.Setup(s => s.GetRoleAsync(user)).ReturnsAsync(expectedRole);
+    
         // Act
-        var tokenString = await _jwtService.GenerateAccessTokenAsync(user);
+        var tokenString = await _jwtService.GenerateAccessTokenAsync(user, sessionId);
     
         // Assert
-        Assert.That(tokenString, Is.Not.Null.And.Not.Empty);
-        
-        // Attempt to parse the token to ensure it's a JWT
         var handler = new JwtSecurityTokenHandler();
-        Assert.DoesNotThrow(() => handler.ReadJwtToken(tokenString));
+        var jwt = handler.ReadJwtToken(tokenString);
+
+        var claims = jwt.Claims.ToDictionary(c => c.Type, c => c.Value);
+
+        Assert.That(claims["userId"], Is.EqualTo(user.Id.ToString()));
+        Assert.That(claims["sid"], Is.EqualTo(sessionId.ToString()));
+        Assert.That(claims[ClaimTypes.Role], Is.EqualTo(expectedRole));
+        Assert.That(jwt.ValidTo, Is.GreaterThan(DateTime.UtcNow));
     }
     
+    [Test]
+    public async Task GenerateAccessTokenAsync_ShouldIncludeSessionIdAndRole()
+    {
+        // Arrange
+        var user = new User { Id = Guid.NewGuid(), Username = "TestUser" };
+        var sessionId = Guid.NewGuid();
+        var role = "Admin";
+        _invitesServiceMock.Setup(s => s.GetRoleAsync(user)).ReturnsAsync(role);
+
+        // Act
+        var token = await _jwtService.GenerateAccessTokenAsync(user, sessionId);
+        var handler = new JwtSecurityTokenHandler();
+        var jwt = handler.ReadJwtToken(token);
+
+        // Assert
+        var sidClaim = jwt.Claims.FirstOrDefault(c => c.Type == "sid");
+        var roleClaim = jwt.Claims.FirstOrDefault(c => c.Type == ClaimTypes.Role);
+
+        Assert.That(sidClaim?.Value, Is.EqualTo(sessionId.ToString()));
+        Assert.That(roleClaim?.Value, Is.EqualTo(role));
+    }
+
+    
     [Test]
     public async Task GenerateRefreshTokenAsync_ReturnsValidRefreshToken()
     {

Govor.Application.Tests/Services/UserSessions/UserSessionOpenerTests.cs

@@ -1,5 +1,4 @@
 using Govor.Application.Services.UserSessions;
-using Govor.Core.Models;
 using Govor.Core.Models.Users;
 using Govor.Core.Repositories.UserSessionsRepository;
 using Microsoft.Extensions.Logging;
@@ -19,6 +18,7 @@ public class UserSessionOpenerTests
     private IOptions<JwtRefreshOption> _options;
     private UserSessionOpener _service;
     private User _user;
+    private Guid _sessionId;
     private const string DeviceInfo = "Chrome on Windows";
     private const string GeneratedToken = "new-refresh-token";
     private const string NewAccessToken = "new-access-token";
@@ -31,7 +31,8 @@ public class UserSessionOpenerTests
         _loggerMock = new Mock<ILogger<UserSessionOpener>>();
         _options = Options.Create(new JwtRefreshOption { RefreshTokenLifetimeDays = 30 });
         
-        // Инициализируем пользователя ДО моков, чтобы не было null в Setup
+        _sessionId = Guid.NewGuid();
+        
         _user = new User
         {
             Id = Guid.NewGuid(),
@@ -44,7 +45,7 @@ public class UserSessionOpenerTests
         };
 
         _jwtServiceMock.Setup(j => j.GenerateRefreshTokenAsync(_user)).ReturnsAsync(GeneratedToken);
-        _jwtServiceMock.Setup(j => j.GenerateAccessTokenAsync(_user)).ReturnsAsync(NewAccessToken);
+        _jwtServiceMock.Setup(j => j.GenerateAccessTokenAsync(_user, _sessionId)).ReturnsAsync(NewAccessToken);
 
         _service = new UserSessionOpener(
             _repositoryMock.Object,
@@ -60,6 +61,7 @@ public class UserSessionOpenerTests
         // Arrange 
         var session = new UserSession
         {
+            Id = _sessionId,
             UserId = _user.Id,
             DeviceInfo = DeviceInfo,
             RefreshToken = "valid-token",
@@ -87,6 +89,7 @@ public class UserSessionOpenerTests
         // Arrange 
         var session = new UserSession
         {
+            Id = _sessionId,
             UserId = _user.Id,
             DeviceInfo = DeviceInfo,
             RefreshToken = "old-token",
@@ -113,6 +116,7 @@ public class UserSessionOpenerTests
     {
         // Arrange 
         _repositoryMock.Setup(r => r.GetByUserIdAsync(_user.Id)).ReturnsAsync(new List<UserSession>());
+        _jwtServiceMock.Setup(j => j.GenerateAccessTokenAsync(_user, It.IsAny<Guid>())).ReturnsAsync(NewAccessToken);
         
         // Act 
         var result = await _service.OpenSessionAsync(_user, DeviceInfo);
@@ -134,6 +138,7 @@ public class UserSessionOpenerTests
         _repositoryMock
             .Setup(r => r.GetByUserIdAsync(_user.Id))
             .ThrowsAsync(new Govor.Data.Repositories.Exceptions.NotFoundByKeyException<Guid>(_user.Id, "userId"));
+        _jwtServiceMock.Setup(j => j.GenerateAccessTokenAsync(_user, It.IsAny<Guid>())).ReturnsAsync(NewAccessToken);
         
         // Act
         var result = await _service.OpenSessionAsync(_user, DeviceInfo);

Govor.Application.Tests/Services/UserSessions/UserSessionRefresherTests.cs

@@ -73,7 +73,7 @@ public class UserSessionRefresherTests
         // Arrange
         _sessionsRepoMock.Setup(r => r.GetByRefreshTokenAsync(OldRefreshToken)).ReturnsAsync(_session);
         _usersRepoMock.Setup(r => r.FindByIdAsync(_user.Id)).ReturnsAsync(_user);
-        _jwtServiceMock.Setup(j => j.GenerateAccessTokenAsync(_user)).ReturnsAsync(NewAccessToken);
+        _jwtServiceMock.Setup(j => j.GenerateAccessTokenAsync(_user, _session.Id)).ReturnsAsync(NewAccessToken);
         _jwtServiceMock.Setup(j => j.GenerateRefreshTokenAsync(_user)).ReturnsAsync(NewRefreshToken);
 
         // Act

Govor.Application/Interfaces/Authentication/IJwtService.cs

@@ -5,7 +5,7 @@ namespace Govor.Application.Interfaces.Authentication;
 
 public interface IJwtService
 {
-    Task<string> GenerateAccessTokenAsync(User user);
+    Task<string> GenerateAccessTokenAsync(User user, Guid sessionId);
     Task<string> GenerateRefreshTokenAsync(User user);
     ClaimsPrincipal GetPrincipalFromExpiredToken(string token);
 }

Govor.Application/Services/Authentication/JwtService.cs

@@ -21,11 +21,12 @@ public class JwtService : IJwtService
         _invitesService = invitesService;
     }
     
-    public async Task<string> GenerateAccessTokenAsync(User user)
+    public async Task<string> GenerateAccessTokenAsync(User user, Guid sessionId)
     {
         var claims = new[]
         {
             new Claim("userId", user.Id.ToString()),
+            new Claim("sid", sessionId.ToString()),
             new Claim(ClaimTypes.Role, await _invitesService.GetRoleAsync(user), ClaimValueTypes.String)
         };
         

Govor.Application/Services/UserSessions/UserSessionOpener.cs

@@ -37,14 +37,12 @@ namespace Govor.Application.Services.UserSessions
                 var sessions = await _repository.GetByUserIdAsync(user.Id);
                 var session = sessions.FirstOrDefault(s => s.DeviceInfo == deviceInfo);
                 
-                var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
-                var accessToken = await _jwtService.GenerateAccessTokenAsync(user);
-            
-                var newExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays);
-
                 if (session is not null)
                 {
-                    // Всегда обновляем токен и дату
+                    var newExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays);
+                    var accessToken = await _jwtService.GenerateAccessTokenAsync(user, session.Id);
+                    var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
+                    
                     session.RefreshToken = newRefreshToken;
                     session.ExpiresAt = newExpiresAt;
                     session.CreatedAt = DateTime.UtcNow;
@@ -65,14 +63,17 @@ namespace Govor.Application.Services.UserSessions
         
             async Task<RefreshResult> OpenNewSession()
             {
-                var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
-                var accessToken = await _jwtService.GenerateAccessTokenAsync(user);
+                var sessionId = Guid.NewGuid(); 
+
+                var accessToken = await _jwtService.GenerateAccessTokenAsync(user, sessionId);
+                var refreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
 
                 var newSession = new UserSession
                 {
+                    Id = sessionId,
                     UserId = user.Id,
                     DeviceInfo = deviceInfo,
-                    RefreshToken = newRefreshToken,
+                    RefreshToken = refreshToken,
                     CreatedAt = DateTime.UtcNow,
                     ExpiresAt = DateTime.UtcNow.AddDays(_options.RefreshTokenLifetimeDays),
                     IsRevoked = false
@@ -80,10 +81,11 @@ namespace Govor.Application.Services.UserSessions
 
                 await _repository.AddAsync(newSession);
 
-                _logger.LogInformation($"Created new session for user {user.Id} on device '{deviceInfo}'");
+                _logger.LogInformation($"Created new session {sessionId} for user {user.Id} on device '{deviceInfo}'");
 
-                return new RefreshResult(newRefreshToken, accessToken);
+                return new RefreshResult(refreshToken, accessToken);
             }
+
         }
     }
 }

Govor.Application/Services/UserSessions/UserSessionRefresher.cs

@@ -48,7 +48,7 @@ public class UserSessionRefresher : IUserSessionRefresher
             var user = await _usersRepository.FindByIdAsync(session.UserId);
 
             // New tokens 
-            var newAccessToken = await _jwtService.GenerateAccessTokenAsync(user);
+            var newAccessToken = await _jwtService.GenerateAccessTokenAsync(user, session.Id);
             var newRefreshToken = await _jwtService.GenerateRefreshTokenAsync(user);
 
             // Opening new session 

Govor.Core/Models/Users/UserSession.cs

@@ -6,6 +6,8 @@ public class UserSession
     public Guid UserId { get; set; }
     public string RefreshToken { get; set; } = string.Empty;
     public string DeviceInfo { get; set; } = string.Empty; // "Chrome on Windows" 
+    public string PublicEncryptionKey { get; set; }
+    public string PublicSigningKey { get; set; }
     public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
     public DateTime ExpiresAt { get; set; }
     public bool IsRevoked { get; set; } = false;