feat: добавил отображение аватарки

backend/UniVerse.Infrastructure/ExternalServices/EntraTokenCacheStore.cs

@@ -0,0 +1,92 @@
+using System.Collections.Concurrent;
+using System.Security.Cryptography;
+using System.Text.Json;
+using Microsoft.Extensions.Configuration;
+
+namespace UniVerse.Infrastructure.ExternalServices;
+
+/// <summary>Зашифрованный кэш токенов MSAL. Ключ берётся только из конфигурации сервера.</summary>
+public sealed class EntraTokenCacheStore
+{
+    private readonly string _directory;
+    private readonly byte[]? _key;
+    private readonly ConcurrentDictionary<int, SemaphoreSlim> _locks = new();
+
+    public EntraTokenCacheStore(IConfiguration configuration)
+    {
+        _directory = configuration["AzureAd:TokenCacheDirectory"]
+            ?? Path.Combine(Path.GetTempPath(), "universe-entra-token-cache");
+        var encodedKey = configuration["AzureAd:TokenCacheKey"];
+        if (!string.IsNullOrWhiteSpace(encodedKey))
+        {
+            try { _key = Convert.FromBase64String(encodedKey); }
+            catch (FormatException ex) { throw new InvalidOperationException("AzureAd:TokenCacheKey must be a base64-encoded 32-byte key.", ex); }
+            if (_key.Length != 32)
+                throw new InvalidOperationException("AzureAd:TokenCacheKey must be a base64-encoded 32-byte key.");
+        }
+    }
+
+    public bool IsConfigured => _key is not null;
+
+    public async Task<T> LockedAsync<T>(int userId, Func<Task<T>> action)
+    {
+        var gate = _locks.GetOrAdd(userId, _ => new SemaphoreSlim(1, 1));
+        await gate.WaitAsync();
+        try { return await action(); }
+        finally { gate.Release(); }
+    }
+
+    public async Task SaveAsync(int userId, string accountId, byte[] cache, CancellationToken cancellationToken)
+    {
+        if (_key is null) return;
+        Directory.CreateDirectory(_directory);
+        if (!OperatingSystem.IsWindows())
+            File.SetUnixFileMode(_directory, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute);
+
+        var payload = JsonSerializer.SerializeToUtf8Bytes(new CachedTokens(accountId, cache));
+        var nonce = RandomNumberGenerator.GetBytes(12);
+        var ciphertext = new byte[payload.Length];
+        var tag = new byte[16];
+        using (var aes = new AesGcm(_key, tag.Length))
+            aes.Encrypt(nonce, payload, ciphertext, tag);
+        var encrypted = new byte[nonce.Length + tag.Length + ciphertext.Length];
+        nonce.CopyTo(encrypted, 0);
+        tag.CopyTo(encrypted, nonce.Length);
+        ciphertext.CopyTo(encrypted, nonce.Length + tag.Length);
+
+        var temporaryPath = Path.Combine(_directory, $".user-{userId}-{Guid.NewGuid():N}.tmp");
+        try
+        {
+            await File.WriteAllBytesAsync(temporaryPath, encrypted, cancellationToken);
+            if (!OperatingSystem.IsWindows())
+                File.SetUnixFileMode(temporaryPath, UnixFileMode.UserRead | UnixFileMode.UserWrite);
+            File.Move(temporaryPath, FilePath(userId), true);
+        }
+        finally
+        {
+            if (File.Exists(temporaryPath)) File.Delete(temporaryPath);
+        }
+    }
+
+    public async Task<CachedTokens?> ReadAsync(int userId, CancellationToken cancellationToken)
+    {
+        if (_key is null || !File.Exists(FilePath(userId))) return null;
+        var encrypted = await File.ReadAllBytesAsync(FilePath(userId), cancellationToken);
+        if (encrypted.Length < 28) throw new CryptographicException("Invalid Entra token cache data.");
+        var plaintext = new byte[encrypted.Length - 28];
+        using (var aes = new AesGcm(_key, 16))
+            aes.Decrypt(encrypted.AsSpan(0, 12), encrypted.AsSpan(28), encrypted.AsSpan(12, 16), plaintext);
+        return JsonSerializer.Deserialize<CachedTokens>(plaintext);
+    }
+
+    public Task RemoveAsync(int userId)
+    {
+        var path = FilePath(userId);
+        if (File.Exists(path)) File.Delete(path);
+        return Task.CompletedTask;
+    }
+
+    private string FilePath(int userId) => Path.Combine(_directory, $"user-{userId}.bin");
+
+    public sealed record CachedTokens(string AccountId, byte[] Cache);
+}