GM.Identity 1.0.0

<p align="center"> <img src="https://raw.githubusercontent.com/gmetskhvarishvili/GM.Identity/master/icon.png" alt="GM.Identity" width="140" height="140" /> </p>

GM.Identity

Identity and access building blocks for GM-based ASP.NET Core apps: PBKDF2 password hashing, secure token generation, claims extraction from the current request, and a rich EF Core domain model for users, roles, permissions, scopes, clients, and sessions. Targets .NET 10.

Packages

The four packages version and release together (lockstep):

dotnet add package GM.Identity

Quick start

Register

GM.Identity needs the ASP.NET Core HTTP context accessor so ClaimsExtractor can read the current user. Register it once at startup:

using GM.Identity;

builder.Services.AddHttpContextAccessor();
builder.Services.AddGMIdentity();

Hash and verify passwords

PasswordHasher uses PBKDF2 (SHA-256, 100 000 iterations by default) with a per-password random salt, and verifies in constant time.

var (hash, salt) = PasswordHasher.Hash("correct horse battery staple");

// store hash + salt on the user, then later:
bool ok = PasswordHasher.Verify(attempt, hash, salt);

Generate and hash tokens

TokenGenerator produces cryptographically random 64-byte tokens and a SHA-256 hash you can persist instead of the raw token (e.g. for refresh tokens or one-time links).

string token  = TokenGenerator.Generate();  // give this to the client
string stored = TokenGenerator.Hash(token);  // keep this in the database

Read the current identity

Once AddGMIdentity() has run, ClaimsExtractor reads the ambient HttpContext:

Guid?   userId    = ClaimsExtractor.GetUserId();     // ClaimTypes.NameIdentifier
string? username  = ClaimsExtractor.GetUsername();   // ClaimTypes.Name
Guid?   sessionId = ClaimsExtractor.GetSessionId();  // "session_id" claim

Each getter returns null when the claim is absent or malformed, so callers never deal with parse exceptions.

The domain model

GM.Identity.Domain models a full RBAC + client/scope system on top of GM.EntityFramework's SoftDeletableEntity<T> base. The entities are generic (CRTP) so your application closes them with its own concrete types and can extend each one:

• Users, roles, permissions — GMUser, GMRole, GMPermission, joined by GMUserRole and GMRolePermission. Users carry password hash/salt, email & phone confirmation, lockout, and block state, all mutated through intent-revealing methods (ConfirmEmail(), Block(), IncreaseAccessFailedCount(...), …).
• Clients, scopes, operations — GMClient, GMScope, GMOperation, joined by GMClientScope and GMScopeOperation, for OAuth-style client/scope authorization.
• Sessions & two-factor — GMUserSession, GMClientSession, GMTwoFactorAuthType, GMUserTwoFactorAuthType.

GM.Identity.Persistence provides matching IEntityTypeConfiguration<T> classes (schema identity) that you apply from your DbContext once you've closed the generics.

Repository layout

GM.Identity/
├── GM.Identity/              # runtime primitives (hashing, tokens, claims, DI)
├── GM.Identity.Domain/       # EF Core domain model (users, roles, scopes, clients, sessions)
├── GM.Identity.Persistence/  # EF Core entity configurations (PostgreSQL)
├── GM.Identity.Gateway/      # reserved gateway/composition layer (empty for now)
└── tests/GM.Identity.Tests/  # xUnit tests for the runtime primitives

Building & testing

dotnet build -c Release
dotnet test  -c Release

Releasing

Versioning is automated from Conventional Commits — see CONTRIBUTING.md. All four packages share one version (Directory.Build.props) and publish together to nuget.org on each release.

License

MIT — see LICENSE.