Add keyed providers, logging, and update targets

Author: pwelter34

Directory.Packages.props

@@ -7,10 +7,10 @@
     <PackageVersion Include="AssemblyMetadata.Generators" Version="2.1.0" />
     <PackageVersion Include="Bogus" Version="35.6.5" />
     <PackageVersion Include="coverlet.collector" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.3" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.3.0" />
     <PackageVersion Include="MinVer" Version="7.0.0" />
-    <PackageVersion Include="Scalar.AspNetCore" Version="2.12.47" />
+    <PackageVersion Include="Scalar.AspNetCore" Version="2.12.48" />
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.1.4" />
     <PackageVersion Include="xunit" Version="2.9.3" />
     <PackageVersion Include="XUnit.Hosting" Version="4.0.0" />

samples/Sample.Middleware/Program.cs

@@ -30,16 +30,13 @@ public static void Main(string[] args)
         app.UseAuthorization();
 
         app.MapGet("/weather", () => WeatherFaker.Instance.Generate(5))
-            .WithName("GetWeatherForecast")
-            .WithOpenApi();
+            .WithName("GetWeatherForecast");
 
         app.MapGet("/users", () => UserFaker.Instance.Generate(10))
-            .WithName("GetUsers")
-            .WithOpenApi();
+            .WithName("GetUsers");
 
         app.MapGet("/addresses", () => AddressFaker.Instance.Generate(10))
-            .WithName("GetAddresses")
-            .WithOpenApi();
+            .WithName("GetAddresses");
 
         app.Run();
     }

src/AspNetCore.SecurityKey/AspNetCore.SecurityKey.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFrameworks>net6.0;net8.0;net9.0;net10.0</TargetFrameworks>
+    <TargetFrameworks>net8.0;net9.0;net10.0</TargetFrameworks>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
   </PropertyGroup>

src/AspNetCore.SecurityKey/AuthenticationBuilderExtensions.cs

@@ -1,5 +1,6 @@
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 
 namespace AspNetCore.SecurityKey;
 
@@ -27,7 +28,9 @@ public static AuthenticationBuilder AddSecurityKey(this AuthenticationBuilder bu
     /// <returns>
     /// The <see cref="AuthenticationBuilder"/> instance for chaining further authentication configuration.
     /// </returns>
-    public static AuthenticationBuilder AddSecurityKey(this AuthenticationBuilder builder, string authenticationScheme)
+    public static AuthenticationBuilder AddSecurityKey(
+        this AuthenticationBuilder builder,
+        string authenticationScheme)
         => builder.AddSecurityKey(authenticationScheme: authenticationScheme, displayName: null, configureOptions: null);
 
     /// <summary>
@@ -39,7 +42,9 @@ public static AuthenticationBuilder AddSecurityKey(this AuthenticationBuilder bu
     /// <returns>
     /// The <see cref="AuthenticationBuilder"/> instance for chaining further authentication configuration.
     /// </returns>
-    public static AuthenticationBuilder AddSecurityKey(this AuthenticationBuilder builder, Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
+    public static AuthenticationBuilder AddSecurityKey(
+        this AuthenticationBuilder builder,
+        Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
         => builder.AddSecurityKey(authenticationScheme: SecurityKeyAuthenticationDefaults.AuthenticationScheme, displayName: null, configureOptions: configureOptions);
 
     /// <summary>
@@ -51,7 +56,10 @@ public static AuthenticationBuilder AddSecurityKey(this AuthenticationBuilder bu
     /// <returns>
     /// The <see cref="AuthenticationBuilder"/> instance for chaining further authentication configuration.
     /// </returns>
-    public static AuthenticationBuilder AddSecurityKey(this AuthenticationBuilder builder, string authenticationScheme, Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
+    public static AuthenticationBuilder AddSecurityKey(
+        this AuthenticationBuilder builder,
+        string authenticationScheme,
+        Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
         => builder.AddSecurityKey(authenticationScheme: authenticationScheme, displayName: null, configureOptions: configureOptions);
 
     /// <summary>
@@ -67,7 +75,11 @@ public static AuthenticationBuilder AddSecurityKey(this AuthenticationBuilder bu
     /// <exception cref="ArgumentNullException">
     /// Thrown when <paramref name="builder"/> is <c>null</c>.
     /// </exception>
-    public static AuthenticationBuilder AddSecurityKey(this AuthenticationBuilder builder, string authenticationScheme, string? displayName, Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
+    public static AuthenticationBuilder AddSecurityKey(
+        this AuthenticationBuilder builder,
+        string authenticationScheme,
+        string? displayName,
+        Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
         => builder.AddSecurityKey<SecurityKeyValidator, SecurityKeyExtractor>(authenticationScheme, displayName, configureOptions);
 
     /// <summary>
@@ -91,7 +103,9 @@ public static AuthenticationBuilder AddSecurityKey<TValidator>(this Authenticati
     /// <returns>
     /// The <see cref="AuthenticationBuilder"/> instance for chaining further authentication configuration.
     /// </returns>
-    public static AuthenticationBuilder AddSecurityKey<TValidator>(this AuthenticationBuilder builder, string authenticationScheme)
+    public static AuthenticationBuilder AddSecurityKey<TValidator>(
+        this AuthenticationBuilder builder,
+        string authenticationScheme)
         where TValidator : class, ISecurityKeyValidator
         => builder.AddSecurityKey<TValidator, SecurityKeyExtractor>(authenticationScheme: authenticationScheme, displayName: null, configureOptions: null);
 
@@ -104,7 +118,9 @@ public static AuthenticationBuilder AddSecurityKey<TValidator>(this Authenticati
     /// <returns>
     /// The <see cref="AuthenticationBuilder"/> instance for chaining further authentication configuration.
     /// </returns>
-    public static AuthenticationBuilder AddSecurityKey<TValidator>(this AuthenticationBuilder builder, Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
+    public static AuthenticationBuilder AddSecurityKey<TValidator>(
+        this AuthenticationBuilder builder,
+        Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
         where TValidator : class, ISecurityKeyValidator
         => builder.AddSecurityKey<TValidator, SecurityKeyExtractor>(authenticationScheme: SecurityKeyAuthenticationDefaults.AuthenticationScheme, displayName: null, configureOptions: configureOptions);
 
@@ -132,7 +148,9 @@ public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(this
     /// <returns>
     /// The <see cref="AuthenticationBuilder"/> instance for chaining further authentication configuration.
     /// </returns>
-    public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(this AuthenticationBuilder builder, string authenticationScheme)
+    public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(
+        this AuthenticationBuilder builder,
+        string authenticationScheme)
         where TValidator : class, ISecurityKeyValidator
         where TExtractor : class, ISecurityKeyExtractor
         => builder.AddSecurityKey<TValidator, TExtractor>(authenticationScheme: authenticationScheme, displayName: null, configureOptions: null);
@@ -147,7 +165,9 @@ public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(this
     /// <returns>
     /// The <see cref="AuthenticationBuilder"/> instance for chaining further authentication configuration.
     /// </returns>
-    public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(this AuthenticationBuilder builder, Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
+    public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(
+        this AuthenticationBuilder builder,
+        Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
         where TValidator : class, ISecurityKeyValidator
         where TExtractor : class, ISecurityKeyExtractor
         => builder.AddSecurityKey<TValidator, TExtractor>(authenticationScheme: SecurityKeyAuthenticationDefaults.AuthenticationScheme, displayName: null, configureOptions: configureOptions);
@@ -167,15 +187,29 @@ public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(this
     /// <exception cref="ArgumentNullException">
     /// Thrown when <paramref name="builder"/> is <c>null</c>.
     /// </exception>
-    public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(this AuthenticationBuilder builder, string authenticationScheme, string? displayName, Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
+    public static AuthenticationBuilder AddSecurityKey<TValidator, TExtractor>(
+        this AuthenticationBuilder builder,
+        string authenticationScheme,
+        string? displayName,
+        Action<SecurityKeyAuthenticationSchemeOptions>? configureOptions)
         where TValidator : class, ISecurityKeyValidator
         where TExtractor : class, ISecurityKeyExtractor
     {
         ArgumentNullException.ThrowIfNull(builder);
 
-        builder.Services.AddOptions<SecurityKeyAuthenticationSchemeOptions>(authenticationScheme);
+        // Register default services
         builder.Services.AddSecurityKey<TValidator, TExtractor>();
 
+        // Add the authentication scheme options to the service collection to ensure they are available for post-configuration
+        builder.Services.AddOptions<SecurityKeyAuthenticationSchemeOptions>(authenticationScheme);
+
+        // Register the keyed provider services for the specified authentication scheme
+        builder.Services.TryAddKeyedScoped<ISecurityKeyValidator, TValidator>(authenticationScheme);
+        builder.Services.TryAddKeyedScoped<ISecurityKeyExtractor, TExtractor>(authenticationScheme);
+
+        // Post-configure the authentication scheme options to set the ProviderServiceKey after the keyed provider is registered
+        builder.Services.PostConfigure<SecurityKeyAuthenticationSchemeOptions>(authenticationScheme, options => options.ProviderServiceKey = authenticationScheme);
+
         return builder.AddScheme<SecurityKeyAuthenticationSchemeOptions, SecurityKeyAuthenticationHandler>(authenticationScheme, displayName, configureOptions);
     }
 }

src/AspNetCore.SecurityKey/DependencyInjectionExtensions.cs

@@ -1,4 +1,5 @@
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Logging;
 
 namespace AspNetCore.SecurityKey;
@@ -59,11 +60,11 @@ public static IServiceCollection AddSecurityKey<TValidator, TExtractor>(this ISe
         if (configure != null)
             services.Configure(configure);
 
-        services.AddSingleton<ISecurityKeyExtractor, TExtractor>();
-        services.AddSingleton<ISecurityKeyValidator, TValidator>();
+        services.TryAddSingleton<ISecurityKeyExtractor, TExtractor>();
+        services.TryAddSingleton<ISecurityKeyValidator, TValidator>();
 
         // used by SecurityKeyAttribute
-        services.AddSingleton<SecurityKeyAuthorizationFilter>();
+        services.TryAddSingleton<SecurityKeyAuthorizationFilter>();
 
         return services;
     }

src/AspNetCore.SecurityKey/ISecurityKeyValidator.cs

@@ -25,10 +25,11 @@ public interface ISecurityKeyValidator
     /// </summary>
     /// <param name="value">The security API key to authenticate. May be <c>null</c> if not provided in the request.</param>
     /// <param name="ipAddress">The IP address of the client making the request.</param>
+    /// <param name="scheme">The authentication scheme to use for the <see cref="ClaimsIdentity"/>. If <see langword="null"/>, the default scheme is used.</param>
     /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
     /// <returns>
     /// A <see cref="ValueTask{ClaimsIdentity}"/> representing the result of the authentication.
     /// The returned <see cref="ClaimsIdentity"/> should reflect the authenticated principal if the key is valid.
     /// </returns>
-    ValueTask<ClaimsIdentity> Authenticate(string? value, IPAddress? ipAddress = null, CancellationToken cancellationToken = default);
+    ValueTask<ClaimsIdentity> Authenticate(string? value, IPAddress? ipAddress = null, string? scheme = null, CancellationToken cancellationToken = default);
 }

src/AspNetCore.SecurityKey/SecurityKeyAuthenticationHandler.cs

@@ -2,6 +2,7 @@
 using System.Text.Encodings.Web;
 
 using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 
@@ -13,32 +14,20 @@ namespace AspNetCore.SecurityKey;
 /// </summary>
 public class SecurityKeyAuthenticationHandler : AuthenticationHandler<SecurityKeyAuthenticationSchemeOptions>
 {
-    private readonly ISecurityKeyExtractor _securityKeyExtractor;
-    private readonly ISecurityKeyValidator _securityKeyValidator;
+    private static readonly AuthenticateResult InvalidSecurityKey = AuthenticateResult.Fail("Invalid Security Key");
 
-#pragma warning disable CS0618 // allow ISystemClock for compatibility
     /// <summary>
     /// Initializes a new instance of the <see cref="SecurityKeyAuthenticationHandler"/> class.
     /// </summary>
     /// <param name="options">The options monitor for <see cref="SecurityKeyAuthenticationSchemeOptions"/>.</param>
     /// <param name="logger">The factory for creating <see cref="ILogger"/> instances.</param>
     /// <param name="encoder">The <see cref="UrlEncoder"/> for encoding URLs.</param>
-    /// <param name="clock">The <see cref="ISystemClock"/> for time-based operations.</param>
-    /// <param name="securityKeyExtractor">The service used to extract the security API key from the HTTP context.</param>
-    /// <param name="securityKeyValidator">The service used to validate and authenticate the security API key.</param>
     public SecurityKeyAuthenticationHandler(
         IOptionsMonitor<SecurityKeyAuthenticationSchemeOptions> options,
         ILoggerFactory logger,
-        UrlEncoder encoder,
-        ISystemClock clock,
-        ISecurityKeyExtractor securityKeyExtractor,
-        ISecurityKeyValidator securityKeyValidator)
-        : base(options, logger, encoder, clock)
-    {
-        _securityKeyExtractor = securityKeyExtractor;
-        _securityKeyValidator = securityKeyValidator;
-    }
-#pragma warning restore CS0618
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    { }
 
     /// <summary>
     /// Handles authentication for the current request by extracting and validating the security API key.
@@ -49,17 +38,32 @@ public SecurityKeyAuthenticationHandler(
     /// </returns>
     protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
     {
-        var securityKey = _securityKeyExtractor.GetKey(Context);
+        // Resolve provider when configured; otherwise use the default registration.
+        var keyExtractor = string.IsNullOrEmpty(Options.ProviderServiceKey)
+            ? Context.RequestServices.GetRequiredService<ISecurityKeyExtractor>()
+            : Context.RequestServices.GetRequiredKeyedService<ISecurityKeyExtractor>(Options.ProviderServiceKey);
+
+        // Extract the security key from the request using the configured extractor
+        var securityKey = keyExtractor.GetKey(Context);
 
         // If no security key is provided, return no result
         if (string.IsNullOrEmpty(securityKey))
             return AuthenticateResult.NoResult();
 
-        var ipAddress = _securityKeyExtractor.GetRemoteAddress(Context);
+        var ipAddress = keyExtractor.GetRemoteAddress(Context);
+
+        // Resolve provider when configured; otherwise use the default registration.
+        var keyValidator = string.IsNullOrEmpty(Options.ProviderServiceKey)
+            ? Context.RequestServices.GetRequiredService<ISecurityKeyValidator>()
+            : Context.RequestServices.GetRequiredKeyedService<ISecurityKeyValidator>(Options.ProviderServiceKey);
 
-        var identity = await _securityKeyValidator.Authenticate(securityKey, ipAddress);
+        // Authenticate the security key and get the claims identity
+        var identity = await keyValidator.Authenticate(securityKey, ipAddress, Scheme.Name, Context.RequestAborted);
         if (!identity.IsAuthenticated)
-            return AuthenticateResult.Fail("Invalid Security Key");
+        {
+            Logger.LogWarning("Invalid security key {SecurityKey} from IP {IPAddress}", securityKey, ipAddress);
+            return InvalidSecurityKey;
+        }
 
         // create a user claim for the security key
         var principal = new ClaimsPrincipal(identity);

src/AspNetCore.SecurityKey/SecurityKeyAuthenticationSchemeOptions.cs

@@ -10,5 +10,9 @@ namespace AspNetCore.SecurityKey;
 /// <seealso cref="Microsoft.AspNetCore.Authentication.AuthenticationSchemeOptions" />
 public class SecurityKeyAuthenticationSchemeOptions : AuthenticationSchemeOptions
 {
-
+    /// <summary>
+    /// The service key used to resolve a custom <see cref="ISecurityKeyExtractor"/> and <see cref="ISecurityKeyValidator"/> from the
+    /// dependency injection container. When set, the keyed service registered under this key is used instead of the default provider.
+    /// </summary>
+    public string? ProviderServiceKey { get; set; }
 }

src/AspNetCore.SecurityKey/SecurityKeyEndpointFilter.cs

@@ -56,6 +56,7 @@ public SecurityKeyEndpointFilter(
         if (await _securityKeyValidator.Validate(securityKey, ipAddress))
             return await next(context);
 
+        _logger.LogWarning("Invalid security key {SecurityKey} from IP {IPAddress}", securityKey, ipAddress);
         return Results.Unauthorized();
     }
 }

src/AspNetCore.SecurityKey/SecurityKeyMiddleware.cs

@@ -62,6 +62,7 @@ public async Task InvokeAsync(HttpContext context)
             return;
         }
 
+        _logger.LogWarning("Invalid security key {SecurityKey} from IP {IPAddress}", securityKey, ipAddress);
         context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
     }
 }