44 hmute

[Hmute]

Implement Role-Based Access Control (RBAC) with JWT Authentication

Overview

This PR implements a comprehensive authentication and role-based access control (RBAC) system for the GoodBooks application, replacing the previous basic authentication with a dual security architecture using ASP.NET Core Identity and a custom application-level permission system.

Key Features

Authentication & Authorization:
Dual Security System: Integrated ASP.NET Core Identity (authentication) with custom application security (authorization)
JWT Token Authentication: API endpoints secured with Bearer token authentication
Cookie Authentication: MVC web application uses cookie-based sessions
Role-Based Access: Two roles implemented - SystemAdministrators and GeneralUsers

User Management:
Seeded Default Users:
Admin: [email protected] / P@ssword1 (SystemAdministrators role)
General User: [email protected] / P@ssword1 (GeneralUsers role)
Automatic Role Assignment: Users assigned to both Identity and application domain roles during seeding
Display Name Support: Security roles now include user-friendly display names (e.g., "System Administrators")

UI Improvements:
Role-Based Menu Visibility: Organization Settings and System Administration menus only visible to admins
Conditional Action Buttons: Create/Edit/Delete buttons hidden for general users on restricted pages (Taxes, etc.)
Null Model Handling: Admin pages (Roles, Groups, Trial Balance) now gracefully handle unauthorized access with user-friendly messages
User Role Display: Users page correctly shows role names instead of "null"

Technical Changes

Database Seeding (DatabaseSeeder.cs)
Create roles in both Identity and application domain
Seed admin and general users with proper role assignments
Repair existing roles missing DisplayName values

Security Service (SecurityService.cs)
AddRole() method enhanced to automatically generate display names from role names
Supports both creating new roles and updating existing ones

API Controllers
AdministrationController: Class-level [Authorize(Roles = "SystemAdministrators")]
GetUser endpoint: [AllowAnonymous] to permit any authenticated user to retrieve their info

Views
_Layout.cshtml: Role-based menu visibility
Taxes.cshtml: Conditional action buttons
Roles.cshtml, Groups.cshtml, TrialBalance.cshtml: Null model handling with informative messages

Testing
Admin user can log in and access all features
General user can log in with restricted access
Menu items properly hidden based on roles
API endpoints enforce authorization correctly
No NullReferenceException when unauthorized users access admin pages

Security Considerations
Passwords stored using Identity's secure hashing
JWT tokens include role claims for API authorization
Separation of authentication (Identity) and authorization (application domain)
All admin endpoints properly protected
Migration Notes
For existing deployments:

Database will auto-seed roles and default users on first run
Existing roles will have DisplayName populated automatically
No manual intervention required
Closes: N/A (New feature implementation)
Related Issues: Authentication, Authorization, RBAC

Future Improvements

High Priority
Password Reset: Implement "Forgot Password" with email verification
Account Lockout: Auto-lock accounts after failed login attempts
Audit Logging: Track all auth events, role changes, and sensitive operations
Fine-Grained Permissions: Move from role-based to claims-based for granular control
Email Verification: Require email confirmation for new accounts

Medium Priority
Multi-Factor Authentication: Add 2FA support (TOTP/SMS)
Token Refresh: Implement refresh tokens to extend sessions
Dynamic Role Management: UI for creating roles and assigning permissions without code
Custom 403 Page: Dedicated unauthorized access page instead of null data messages
Permission Caching: Cache user permissions to reduce DB queries

Lower Priority
API Key Auth: Support for service-to-service authentication
SSO Integration: Connect with Azure AD, Google, etc.
User Activity Tracking: Log last login, IP addresses, actions
Role Templates: Predefined roles (Accountant, Viewer, Manager)
Bulk User Operations: CSV import/export, bulk role assignments

Testing & Monitoring
Unit & Integration Tests: Comprehensive auth flow testing
Security Dashboard: Monitor failed logins and suspicious activity
API Documentation: Document role requirements in Swagger
Immediate Next Steps: Password reset, account lockout, and audit logging would provide the most value with minimal effort.