JiriUhlir
71 lines
3.2 KiB
C#
71 lines
3.2 KiB
C#
using Microsoft.OpenApi.Any;
|
|
using Microsoft.OpenApi.Models;
|
|
using Swashbuckle.AspNetCore.SwaggerGen;
|
|
using Csob.Controllers;
|
|
using Csob.Credentials;
|
|
|
|
namespace Csob.Infrastructure;
|
|
|
|
/// <summary>
|
|
/// Documents the per-request credential headers in Swagger. Metadata endpoints need none; the
|
|
/// OAuth helper needs the certificate + client id/secret; every other (AISP/PISP/consent) endpoint
|
|
/// needs the certificate + access token + API key + TPP name. Headers are marked optional at the
|
|
/// schema level (the service validates them at runtime) but the descriptions state what is required.
|
|
/// </summary>
|
|
public sealed class CredentialHeadersOperationFilter : IOperationFilter
|
|
{
|
|
public void Apply(OpenApiOperation operation, OperationFilterContext context)
|
|
{
|
|
var declaringType = context.MethodInfo.DeclaringType;
|
|
|
|
// Metadata endpoints (health/version/status) do not talk to ČSOB.
|
|
if (declaringType == typeof(MetaController))
|
|
{
|
|
return;
|
|
}
|
|
|
|
operation.Parameters ??= new List<OpenApiParameter>();
|
|
|
|
AddHeader(operation, CredentialConstants.CertificateHeader,
|
|
"eIDAS client certificate (QWAC) as a Base64-encoded PFX/PKCS#12 bundle incl. private key and chain. Used for mutual TLS to ČSOB. SENSITIVE — TLS only.");
|
|
AddHeader(operation, CredentialConstants.CertificatePasswordHeader,
|
|
"Passphrase protecting the PFX in X-CSOB-Certificate (omit if the PFX has no password). SENSITIVE.");
|
|
|
|
if (declaringType == typeof(OAuthController))
|
|
{
|
|
AddHeader(operation, CredentialConstants.ClientIdHeader,
|
|
"OAuth2 client id of the registered TPP application. Required.");
|
|
AddHeader(operation, CredentialConstants.ClientSecretHeader,
|
|
"OAuth2 client secret of the registered TPP application. Required for token/refresh. SENSITIVE.");
|
|
return;
|
|
}
|
|
|
|
AddHeader(operation, CredentialConstants.AccessTokenHeader,
|
|
"OAuth2 Bearer access token obtained for the PSU. Forwarded as 'Authorization: Bearer'. Required. SENSITIVE.");
|
|
AddHeader(operation, CredentialConstants.ApiKeyHeader,
|
|
"ČSOB application API key. Forwarded as 'APIKEY'. Required.");
|
|
AddHeader(operation, CredentialConstants.TppNameHeader,
|
|
"TPP organisation name. Forwarded as 'TPP-Name'. Required.");
|
|
AddHeader(operation, CredentialConstants.UserInvolvedHeader,
|
|
"Optional. 'true' if the PSU is online for this request (forwarded as 'User-Involved'). Defaults to false.", example: "false");
|
|
AddHeader(operation, CredentialConstants.UserIpAddressHeader,
|
|
"Optional. PSU IP address (forwarded as 'User-IP-Address').");
|
|
}
|
|
|
|
private static void AddHeader(OpenApiOperation operation, string name, string description, string? example = null)
|
|
{
|
|
operation.Parameters.Add(new OpenApiParameter
|
|
{
|
|
Name = name,
|
|
In = ParameterLocation.Header,
|
|
Required = false,
|
|
Description = description,
|
|
Schema = new OpenApiSchema
|
|
{
|
|
Type = "string",
|
|
Example = example is null ? null : new OpenApiString(example),
|
|
},
|
|
});
|
|
}
|
|
}
|