LibraryWeb/Api/UserApi.cs

using Microsoft.AspNetCore.Mvc;

namespace Library.Api;

[Route( "Api/User/[action]/{id?}" )]
public class UserApi : APIController
{
	public UserApi( ILogger<UserApi> logger , IConfiguration configuration )
		: base( logger , configuration )
	{
	}

	[HttpPost]
	public IActionResult Login( string username , string password )
	{
		Trace( "/UserAPI/Login" );
		
		string? session_id = PrepareSQL( "EXECUTE [usp_user_login] @user , @pass" )
			.AddParameter( "@user" , username )
			.AddParameter( "@pass" , password )
			.ReadSingleString( );

		if ( string.IsNullOrWhiteSpace( session_id ) )
			return Error( "Невалидно потребителско име/парола" );

		SessionStart( session_id );

		return Success( session_id );
	}

	[HttpPost]
	public IActionResult EditDetails( int id , string? name , string? email )
	{
		Trace( "/UserAPI/EditDetails" );

		AssertID( id );
		AssertParameter( name , 2 );
		AssertEmail( email , false );
		AssertLogin( null );

		if ( id != GetUserData( )!.ID && !GetUserData( )!.IsAdmin )
			return Error( "Access denied" );

		if ( email == null )
		{
			PrepareSQL( "UPDATE [dom] SET [ime]=@name WHERE id=@id" )
				.AddParameter( "@name" , name )
				.AddParameter( "@id" , id )
				.ExecuteNonQuery( );
		}
		else
		{
			PrepareSQL( "UPDATE [dom] SET [ime]=@name,[mail]=@email WHERE id=@id" )
				.AddParameter( "@name" , name )
				.AddParameter( "@email" , email )
				.AddParameter( "@id" , id )
				.ExecuteNonQuery( );
		}

		return Success( );
	}

	[HttpPost]
	public IActionResult EditPassword( int id , string? password )
	{
		Trace( "/UserAPI/EditPassword" );

		AssertID( id );
		AssertParameter( password , 5 );
		AssertLogin( null );

		if ( id != GetUserData( )!.ID && !GetUserData( )!.IsAdmin )
			return Error( "Access denied" );

		PrepareSQL( "UPDATE [dom] SET [prl] = @new_pass WHERE id=@id" )
			.AddParameter( "@new_pass" , password )
			.AddParameter( "@id" , id )
			.ExecuteNonQuery( );

		return Success( );
	}

	[HttpGet]
	public IActionResult Activate( int id )
	{
		Trace( "/UserAPI/Activate" );

		AssertID( id );
		AssertAdmin( );

		PrepareSQL( "UPDATE [dom] SET [is_active]=1 WHERE id=@id" )
			.AddParameter( "@id" , id )
			.ExecuteNonQuery( );

		return Success( );
	}

	[HttpGet]
	public IActionResult Deactivate( int id )
	{
		Trace( "/UserAPI/Deactivate" );

		AssertID( id );
		AssertAdmin( );

		if ( id == GetUserData( )!.ID )
			return Error( "Не може да деактивирате себе си!" );

		PrepareSQL( "UPDATE [dom] SET [is_active]=0 WHERE id=@id" )
			.AddParameter( "@id" , id )
			.ExecuteNonQuery( );

		return Success( );
	}

	[HttpPost]
	public IActionResult Register( string? username , string? password , string? name )
	{
		Trace( "/UserAPI/Register" );

		AssertEmail( username , true );
		AssertParameter( password , 5 );
		AssertParameter( name , 2 );

		string? new_user_id = PrepareSQL( "INSERT INTO [dom] ([mail],[prl],[ime]) OUTPUT INSERTED.id VALUES (@user,@pass,@name)" )
			.AddParameter( "@user" , username )
			.AddParameter( "@pass" , password )
			.AddParameter( "@name" , name )
			.ReadSingleString( );

		if ( new_user_id == null )
			return Error( "Емайл адреса вече е регистриран" );

		string? session_id = PrepareSQL( "EXECUTE [usp_user_login] @user , @pass" )
			.AddParameter( "@user" , username )
			.AddParameter( "@pass" , password )
			.ReadSingleString( );

		if ( session_id == null )
			return Error( "Емайл адреса вече е регистриран" );

		SessionStart( session_id );

		return Success( session_id );
	}

	[HttpPost]
	public IActionResult Forgot( string ? username )
	{
		Trace( "/UserAPI/Forgot" );

		AssertEmail( username , true );

		string? password = PrepareSQL( "SELECT [prl] FROM [dom] WHERE [mail]=@user" )
			.AddParameter( "@user" , username )
			.ReadSingleString( );

		if ( string.IsNullOrWhiteSpace( password ) )
			return Error( "Невалидно потребителско име" );

		return Error( "Тук се очаква да се изпрати код за ресет на мейла. Засега ето това е паролата: " + password );
	}

	[HttpGet]
	public IActionResult Logout( )
	{
		Trace( "/UserAPI/Logout" );

		if ( GetUserData( ) != null )
		{
			PrepareSQL( "EXECUTE [usp_user_logout] @session_id" )
				.AddParameter( "@session_id" , GetUserData( )!.SessionID )
				.ExecuteNonQuery( );
		}
		SessionCancel( );
		return Success( "1" );
	}
}