merge pull request #4 from https-richardy/refactor/03-avoid-user-db-lookup-in-principal-middleware

fix(#3): the middleware now directly uses the claims from the authenticated user's context eliminating the need to search for the user in the database

Author: https-richardy

Source/HttpsRichardy.Federation.WebApi/Middlewares/PrincipalMiddleware.cs

@@ -17,27 +17,29 @@ public async Task InvokeAsync(HttpContext context)
             return;
         }
 
-        var userCollection = context.RequestServices.GetRequiredService<IUserCollection>();
         var userIdClaim = context.User.FindFirst(ClaimTypes.NameIdentifier);
+        var preferredUsernameClaim = context.User.Claims.FirstOrDefault(claim => claim.Type == "preferred_username");
 
         if (userIdClaim == null || string.IsNullOrWhiteSpace(userIdClaim.Value))
         {
             await next(context);
             return;
         }
 
-        var filters = UserFilters.WithSpecifications()
-            .WithIdentifier(userIdClaim.Value)
-            .Build();
-
-        var users = await userCollection.GetUsersAsync(filters, context.RequestAborted);
-        var user = users.FirstOrDefault();
-
-        if (user is not null)
+        if (preferredUsernameClaim == null || string.IsNullOrWhiteSpace(preferredUsernameClaim.Value))
         {
-            principalProvider.SetPrincipal(user);
+            await next(context);
+            return;
         }
 
+        var principal = new User()
+        {
+            Id = userIdClaim.Value,
+            Username = preferredUsernameClaim.Value
+        };
+
+        principalProvider.SetPrincipal(principal);
+
         await next(context);
     }
 }