keyant / webapitokenauthbootstrap Goto Github PK

/// <summary>
/// Handles all the account related actions - user registration, login and logout.
/// </summary>
public class AuthController : TokenAuthApiController
{
    // GET api/auth/login
    [ActionName("login")]
    [TokenAuthentication(AccessLevel.Anonymous)]
    public HttpResponseMessage PostLogin([FromBody]LoginViewModel user)
    {
        // Input validaiton.
        if (user == null || user.Username == null || user.Password == null)
        {
            return Error("Please enter username and password.");
        }

        // Retrieve the user data from the Data access layer.
        IDal dal = new ProGamersDal();
        var currentUser = dal.GetUser(user.Username, user.Password);

        // If not match found - return error.
        if (currentUser == null)
        {
            return Error("Bad username or password.");
        }

        // Cache username and user role at the client side as cookie - accessible by javascript at the client side as json object.
        // Note this data is not secured since the user can access the cookie. Don't store any sensitive information there.
        // In case you save login data in the client side as I did, Server-side validation is a MUST.
        UserData.username = "Dgandalf";
        UserData.role = (int) UserRole.User;

        // Creates an access token for this user, stores it in the configured TokenStorage (By default use in-memory storage).
        // You can set different TokenStorage at TokenAuthenticationConfiguration.TokenStorage in your Application_Start 
        // function inside theg lobal.asax file. Additionally, sends cookie with the generated access token to the user.
        return Login(1, "Dgandalf", UserRole.User);

    }

    // POST api/auth/logout
    [ActionName("logout")]
    [TokenAuthentication(AccessLevel.User)]
    public HttpResponseMessage PostLogout()
    {
        // Deletes the token and user-data cookies with the generated access token to the user.
        return Logout();
    }

    // POST api/auth/register
    [ActionName("register")]
    [TokenAuthentication(AccessLevel.Anonymous)]
    public HttpResponseMessage PostRegister(User user)
    {
        // Handle registration data here.

        // Returns OK response. You can also use Login() function instead, so the user will be logged in 
        // automaticly after a successful registration.
        return Ok();
    }
}