Added Authentication with user-auth and apikey-auth

watcher-monitoring/Attributes/ApiKeyAuthAttribute.cs

@@ -0,0 +1,58 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.EntityFrameworkCore;
+using watcher_monitoring.Data;
+
+namespace watcher_monitoring.Attributes;
+
+[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+public class ApiKeyAuthAttribute : Attribute, IAsyncActionFilter
+{
+    private const string ApiKeyHeaderName = "X-API-Key";
+
+    public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
+    {
+        if (!context.HttpContext.Request.Headers.TryGetValue(ApiKeyHeaderName, out var extractedApiKey))
+        {
+            context.Result = new UnauthorizedObjectResult(new { error = "API-Key fehlt im Header" });
+            return;
+        }
+
+        var apiKeyString = extractedApiKey.ToString();
+
+        var dbContext = context.HttpContext.RequestServices.GetRequiredService<WatcherDbContext>();
+        var logger = context.HttpContext.RequestServices.GetRequiredService<ILogger<ApiKeyAuthAttribute>>();
+
+        var apiKey = await dbContext.ApiKeys
+            .FirstOrDefaultAsync(k => k.Key == apiKeyString);
+
+        if (apiKey == null)
+        {
+            logger.LogWarning("Ungültiger API-Key verwendet: {ApiKey}", apiKeyString);
+            context.Result = new UnauthorizedObjectResult(new { error = "Ungültiger API-Key" });
+            return;
+        }
+
+        if (!apiKey.IsActive)
+        {
+            logger.LogWarning("Inaktiver API-Key verwendet: {Name}", apiKey.Name);
+            context.Result = new UnauthorizedObjectResult(new { error = "API-Key ist deaktiviert" });
+            return;
+        }
+
+        if (apiKey.IsExpired)
+        {
+            logger.LogWarning("Abgelaufener API-Key verwendet: {Name}", apiKey.Name);
+            context.Result = new UnauthorizedObjectResult(new { error = "API-Key ist abgelaufen" });
+            return;
+        }
+
+        // Letzten Verwendungszeitpunkt aktualisieren
+        apiKey.LastUsedAt = DateTime.UtcNow;
+        await dbContext.SaveChangesAsync();
+
+        logger.LogInformation("API-Zugriff mit Key: {Name}", apiKey.Name);
+
+        await next();
+    }
+}