Validate external account state and identity

src/Exceptionless.AppHost/Program.cs

@@ -188,6 +188,7 @@
 
 #pragma warning disable ASPIREBROWSERLOGS001
     var app = builder.AddViteApp("App", "../Exceptionless.Web/ClientApp")
+        .WithNpm(install: !ciE2E) // CI already ran npm ci before starting the AppHost.
         .WithBrowserLogs()
         .WithReference(api)
         .WithEnvironment("PUBLIC_EXCEPTIONLESS_API_KEY", builder.Configuration["PUBLIC_EXCEPTIONLESS_API_KEY"])
@@ -216,10 +217,6 @@
             .WithEnvironment("API_HTTPS", worktreePorts.ApiHttpsUrl);
     }
 
-    // The e2e workflow runs npm ci before starting the AppHost, so it skips Aspire's second install.
-    if (ciE2E)
-        app.WithNpm(install: false);
-
     if (includeDevTools)
     {
 #pragma warning disable ASPIREDENO001

src/Exceptionless.Core/Extensions/UserExtensions.cs

@@ -64,34 +64,48 @@ public static bool HasValidPasswordResetTokenExpiration(this User user, TimeProv
 
     public static void AddOAuthAccount(this User user, string providerName, string providerUserId, string username, SettingsDictionary? data = null)
     {
-        var account = new OAuthAccount
+        var accounts = user.OAuthAccounts.Where(account => String.Equals(account.Provider, providerName, StringComparison.Ordinal)
+            && String.Equals(account.ProviderUserId, providerUserId, StringComparison.Ordinal)).ToArray();
+        var account = accounts.FirstOrDefault();
+        if (account is null)
+        {
+            account = new OAuthAccount
+            {
+                Provider = providerName,
+                ProviderUserId = providerUserId,
+                Username = username
+            };
+            user.OAuthAccounts.Add(account);
+        }
+        else
         {
-            Provider = providerName.ToLowerInvariant(),
-            ProviderUserId = providerUserId,
-            Username = username
-        };
+            account.Username = username;
+        }
 
         if (data is not null)
             account.ExtraData.Apply(data);
 
-        user.OAuthAccounts.Add(account);
+        foreach (var duplicate in accounts.Skip(1))
+            user.OAuthAccounts.Remove(duplicate);
     }
 
     public static bool RemoveOAuthAccount(this User user, string providerName, string providerUserId)
     {
-        var account = user.OAuthAccounts.FirstOrDefault(o =>
-            String.Equals(o.Provider, providerName, StringComparison.OrdinalIgnoreCase)
-            && String.Equals(o.ProviderUserId, providerUserId, StringComparison.Ordinal));
-        if (account is null)
+        var accounts = user.OAuthAccounts.Where(account => String.Equals(account.Provider, providerName, StringComparison.Ordinal)
+            && String.Equals(account.ProviderUserId, providerUserId, StringComparison.Ordinal)).ToArray();
+        if (accounts.Length is 0)
             return true;
 
         var activeOAuthAccounts = user.OAuthAccounts
-            .Where(o => !String.Equals(o.Provider, "facebook", StringComparison.OrdinalIgnoreCase)
-                && !String.Equals(o.Provider, "windowslive", StringComparison.OrdinalIgnoreCase))
+            .Where(account => !String.Equals(account.Provider, OAuthAccount.KnownProviders.Facebook, StringComparison.OrdinalIgnoreCase)
+                && !String.Equals(account.Provider, OAuthAccount.KnownProviders.WindowsLive, StringComparison.OrdinalIgnoreCase))
             .ToArray();
-        if (String.IsNullOrEmpty(user.Password) && activeOAuthAccounts.Length <= 1 && activeOAuthAccounts.Contains(account))
+        if (String.IsNullOrEmpty(user.Password) && activeOAuthAccounts.Length <= accounts.Length && activeOAuthAccounts.Contains(accounts[0]))
             return false;
 
-        return user.OAuthAccounts.Remove(account);
+        foreach (var account in accounts)
+            user.OAuthAccounts.Remove(account);
+
+        return true;
     }
 }

src/Exceptionless.Core/Models/OAuthAccount.cs

@@ -1,10 +1,26 @@
-namespace Exceptionless.Core.Models;
+using System.ComponentModel.DataAnnotations;
+
+namespace Exceptionless.Core.Models;
 
 public record OAuthAccount
 {
+    public static class KnownProviders
+    {
+        public const string GitHub = "github";
+        public const string Google = "google";
+        public const string Microsoft = "microsoft";
+        public const string Facebook = "facebook";
+        public const string WindowsLive = "windowslive";
+    }
+
+    [Required]
+    [AllowedValues(KnownProviders.GitHub, KnownProviders.Google, KnownProviders.Microsoft, KnownProviders.Facebook, KnownProviders.WindowsLive,
+        ErrorMessage = "The provider name must be github, google, microsoft, facebook, or windowslive.")]
     public required string Provider { get; init; }
+
+    [Required]
     public required string ProviderUserId { get; init; }
-    public required string Username { get; init; }
+    public required string Username { get; set; }
 
     public SettingsDictionary ExtraData { get; init; } = new();
 

src/Exceptionless.Core/Models/User.cs

@@ -6,7 +6,7 @@
 
 namespace Exceptionless.Core.Models;
 
-public record User : IIdentity, IHaveDates, IValidatableObject
+public record User : IIdentity, IHaveDates, IVersioned, IValidatableObject
 {
     /// <summary>
     /// Unique id that identifies an user.
@@ -54,6 +54,12 @@ public record User : IIdentity, IHaveDates, IValidatableObject
     public string? VerifyEmailAddressToken { get; set; }
     public DateTime VerifyEmailAddressTokenExpiration { get; set; }
 
+    /// <summary>
+    /// Repository concurrency metadata used to reject stale writes, preserved in cached snapshots.
+    /// New users have an empty version until persisted.
+    /// </summary>
+    public string Version { get; set; } = String.Empty;
+
     /// <summary>
     /// Gets or sets the users active state.
     /// </summary>

src/Exceptionless.Core/Repositories/Interfaces/IUserRepository.cs

@@ -11,7 +11,7 @@ public interface IUserRepository : ISearchableRepository<User>
     Task<bool> SetSavedViewOrdersAsync(User user, CommandOptionsDescriptor<User>? options = null);
     Task<User?> GetByEmailAddressAsync(string emailAddress);
     Task<User?> GetByPasswordResetTokenAsync(string token);
-    Task<User?> GetUserByOAuthProviderAsync(string provider, string providerUserId);
+    Task<IReadOnlyCollection<User>> GetUsersByOAuthProviderAsync(string provider, string providerUserId, CancellationToken cancellationToken = default);
     Task<User?> GetByVerifyEmailAddressTokenAsync(string token);
     Task<FindResults<User>> GetByOrganizationIdAsync(string organizationId, CommandOptionsDescriptor<User>? options = null);
 }

src/Exceptionless.Core/Repositories/UserRepository.cs

@@ -123,14 +123,27 @@ public Task<bool> SetSavedViewOrdersAsync(User user, CommandOptionsDescriptor<Us
         return hit?.Document;
     }
 
-    public async Task<User?> GetUserByOAuthProviderAsync(string provider, string providerUserId)
+    public async Task<IReadOnlyCollection<User>> GetUsersByOAuthProviderAsync(string provider, string providerUserId, CancellationToken cancellationToken = default)
     {
+        cancellationToken.ThrowIfCancellationRequested();
         if (String.IsNullOrEmpty(provider) || String.IsNullOrEmpty(providerUserId))
-            return null;
-
-        provider = provider.ToLowerInvariant();
-        var results = (await FindAsync(q => q.FieldEquals(u => u.OAuthAccounts.First().ProviderUserId, providerUserId))).Documents;
-        return results.FirstOrDefault(u => u.OAuthAccounts.Any(o => o.Provider == provider));
+            return Array.Empty<User>();
+
+        // OAuth accounts are mapped as objects, so indexed fields cannot enforce matching within one account.
+        var results = await FindAsync(q => q.FieldEquals(u => u.OAuthAccounts.First().ProviderUserId, providerUserId)
+            .FieldEquals(u => u.OAuthAccounts.First().Provider, provider).SortAscending(u => u.Id),
+            o => o.SearchAfterPaging().PageLimit(100));
+        var matchingUsers = new List<User>();
+        do
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            matchingUsers.AddRange(results.Documents.Where(u => u.OAuthAccounts.Any(account =>
+                String.Equals(account.Provider, provider, StringComparison.Ordinal) &&
+                String.Equals(account.ProviderUserId, providerUserId, StringComparison.Ordinal))));
+        } while (!cancellationToken.IsCancellationRequested && await results.NextPageAsync());
+
+        cancellationToken.ThrowIfCancellationRequested();
+        return matchingUsers;
     }
 
     public async Task<User?> GetByVerifyEmailAddressTokenAsync(string token)

src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs

@@ -28,6 +28,7 @@ public static IEndpointRouteBuilder MapAuthEndpoints(this IEndpointRouteBuilder
         .Accepts<Login>("application/json", "application/*+json")
         .Produces<TokenResult>()
         .ProducesProblem(StatusCodes.Status401Unauthorized)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
         .WithSummary("Login")
         .WithDescription("""
@@ -86,6 +87,7 @@ headers api_key input box.
         .Produces<TokenResult>()
         .ProducesProblem(StatusCodes.Status401Unauthorized)
         .ProducesProblem(StatusCodes.Status403Forbidden)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
         .WithSummary("Sign up")
         .WithMetadata(new EndpointDocumentation {
@@ -104,13 +106,17 @@ headers api_key input box.
         .AllowAnonymous()
         .Accepts<ExternalAuthInfo>("application/json", "application/*+json")
         .Produces<TokenResult>()
+        .ProducesProblem(StatusCodes.Status401Unauthorized)
         .ProducesProblem(StatusCodes.Status403Forbidden)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
         .WithSummary("Sign in with GitHub")
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
+                ["401"] = "Unauthorized",
                 ["403"] = "Account Creation is currently disabled",
+                ["409"] = "The account changed while the request was being processed.",
                 ["422"] = "Validation error",
             }
         });
@@ -122,13 +128,17 @@ headers api_key input box.
         .AllowAnonymous()
         .Accepts<ExternalAuthInfo>("application/json", "application/*+json")
         .Produces<TokenResult>()
+        .ProducesProblem(StatusCodes.Status401Unauthorized)
         .ProducesProblem(StatusCodes.Status403Forbidden)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
         .WithSummary("Sign in with Google")
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
+                ["401"] = "Unauthorized",
                 ["403"] = "Account Creation is currently disabled",
+                ["409"] = "The account changed while the request was being processed.",
                 ["422"] = "Validation error",
             }
         });
@@ -140,31 +150,41 @@ headers api_key input box.
         .AllowAnonymous()
         .Accepts<ExternalAuthInfo>("application/json", "application/*+json")
         .Produces<TokenResult>()
+        .ProducesProblem(StatusCodes.Status401Unauthorized)
         .ProducesProblem(StatusCodes.Status403Forbidden)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
         .WithSummary("Sign in with Microsoft")
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
+                ["401"] = "Unauthorized",
                 ["403"] = "Account Creation is currently disabled",
+                ["409"] = "The account changed while the request was being processed.",
                 ["422"] = "Validation error",
             }
         });
 
-        group.MapPost("unlink/{providerName:minlength(1)}", async (string providerName, IMediator mediator, IMediatorResultMapper<HttpIResult> resultMapper, HttpContext httpContext, [FromBody] ValueFromBody<string> providerUserId)
-            => (await mediator.InvokeAsync<Result<TokenResult>>(new AuthMessages.RemoveExternalLogin(providerName, providerUserId, httpContext))).ToHttpResult(resultMapper))
+        group.MapPost("unlink/{providerName:minlength(1)}", async ([AsParameters] RemoveExternalLoginRequest request, IMediator mediator, IMediatorResultMapper<HttpIResult> resultMapper, HttpContext httpContext)
+            => (await mediator.InvokeAsync<Result<TokenResult>>(new AuthMessages.RemoveExternalLogin(request.ProviderName, request.ProviderUserId?.Value, httpContext))).ToHttpResult(resultMapper))
         .Accepts<ValueFromBody<string>>("application/json", "application/*+json")
         .Produces<TokenResult>()
         .ProducesProblem(StatusCodes.Status400BadRequest)
+        .ProducesProblem(StatusCodes.Status401Unauthorized)
+        .ProducesProblem(StatusCodes.Status409Conflict)
+        .ProducesValidationProblem(StatusCodes.Status422UnprocessableEntity)
         .WithSummary("Removes an external login provider from the account")
         .WithMetadata(new EndpointDocumentation {
             RequestBodyDescription = "The provider user id.",
             ParameterDescriptions = new() {
-                ["providerName"] = "The provider name.",
+                ["providerName"] = "The provider name: github, google, microsoft, facebook, or windowslive (case sensitive).",
             },
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
-                ["400"] = "Invalid provider name.",
+                ["400"] = "Invalid provider user id, or the account would have no sign-in method.",
+                ["401"] = "Unauthorized",
+                ["409"] = "The account changed while the request was being processed.",
+                ["422"] = "Validation error",
             }
         });
 
@@ -175,10 +195,12 @@ headers api_key input box.
         .Accepts<ChangePasswordModel>("application/json", "application/*+json")
         .Produces<TokenResult>()
         .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .WithSummary("Change password")
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
+                ["409"] = "The account changed while the request was being processed.",
                 ["422"] = "Validation error",
             }
         });
@@ -212,10 +234,12 @@ headers api_key input box.
         .Accepts<ResetPasswordModel>("application/json", "application/*+json")
         .Produces(StatusCodes.Status200OK)
         .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .WithSummary("Reset password")
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "Password reset email was sent.",
+                ["409"] = "The account changed while the request was being processed.",
                 ["422"] = "Invalid reset password model.",
             }
         });
@@ -231,6 +255,7 @@ headers api_key input box.
         .AllowAnonymous()
         .Produces(StatusCodes.Status200OK)
         .ProducesProblem(StatusCodes.Status400BadRequest)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .WithSummary("Cancel reset password")
         .WithMetadata(new EndpointDocumentation {
             ParameterDescriptions = new() {
@@ -239,6 +264,7 @@ headers api_key input box.
             ResponseDescriptions = new() {
                 ["200"] = "Password reset email was cancelled.",
                 ["400"] = "Invalid password reset token.",
+                ["409"] = "The account changed while the request was being processed.",
             }
         });
 

src/Exceptionless.Web/Api/Endpoints/OrganizationEndpoints.cs

@@ -75,6 +75,7 @@ public static IEndpointRouteBuilder MapOrganizationEndpoints(this IEndpointRoute
         .Accepts<NewOrganization>("application/json", "application/*+json")
         .Produces<ViewOrganization>(StatusCodes.Status201Created)
         .ProducesProblem(StatusCodes.Status400BadRequest)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .ProducesProblem(StatusCodes.Status422UnprocessableEntity)
         .WithSummary("Create")
         .WithMetadata(new EndpointDocumentation {
@@ -190,6 +191,7 @@ public static IEndpointRouteBuilder MapOrganizationEndpoints(this IEndpointRoute
         .Produces<WorkInProgressResult>(StatusCodes.Status202Accepted)
         .ProducesProblem(StatusCodes.Status400BadRequest)
         .ProducesProblem(StatusCodes.Status404NotFound)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .ProducesProblem(StatusCodes.Status500InternalServerError)
         .WithSummary("Remove")
         .WithMetadata(new EndpointDocumentation {
@@ -281,6 +283,7 @@ public static IEndpointRouteBuilder MapOrganizationEndpoints(this IEndpointRoute
             => (await mediator.InvokeAsync<Result<User>>(new OrganizationMessages.AddOrganizationUser(id, email, httpContext))).ToHttpResult(resultMapper))
         .Produces<User>()
         .ProducesProblem(StatusCodes.Status404NotFound)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .ProducesProblem(StatusCodes.Status426UpgradeRequired)
         .WithSummary("Add user")
         .WithMetadata(new EndpointDocumentation {
@@ -299,6 +302,7 @@ public static IEndpointRouteBuilder MapOrganizationEndpoints(this IEndpointRoute
         .Produces(StatusCodes.Status200OK)
         .ProducesProblem(StatusCodes.Status400BadRequest)
         .ProducesProblem(StatusCodes.Status404NotFound)
+        .ProducesProblem(StatusCodes.Status409Conflict)
         .WithSummary("Remove user")
         .WithMetadata(new EndpointDocumentation {
             ParameterDescriptions = new() {