[KrzysztofPajak]

Part of the work on keeping ASP.NET Core out of Business (after #943)
Type: feature

Issue

ExternalAuthenticationService was the only Grand.Business.* user of IGrandAuthenticationService, and it and IExternalAuthenticationService returned IActionResult (using Microsoft.AspNetCore.Mvc in Grand.Business.Core). Signing in through a cookie and picking a redirect are HTTP concerns, so the domain part (find the associated customer, associate the account, register, raise the events) could not be used without MVC.

Reproduce: grep -rln -E 'IGrandAuthenticationService|Microsoft.AspNetCore.Mvc' src/Business --include=*.cs lists ExternalAuthenticationService.cs, IExternalAuthenticationService.cs and IGrandAuthenticationService.cs.

Solution

• IExternalAuthenticationService.Authenticate(parameters, customer, store, language) returns ExternalAuthResult (Grand.Business.Core.Utilities.Authentication, same shape as OidcLoginResult): Status, Customer, Errors. Statuses: LoggedIn, Registered, Associated (the account is, or now is, linked to the customer already signed in), AwaitingApproval, AlreadyAssigned, RegistrationDisabled, Error. The service no longer signs in and no longer takes returnUrl; CustomerLoggedInEvent / CustomerRegisteredEvent are still published there.
• New IExternalSignInService / ExternalSignInService in Grand.Web.Common.Security.Authentication: calls the Business service, signs in on LoggedIn / Registered (after the event, as before) and maps the result to the same redirects as before (HomePage or returnUrl, RegisterResult Standard / AdminApproval, Common/ExternalAuthenticationError with the errors). Its Authenticate keeps the old signature.
• IGrandAuthenticationService has no Business user left and moves to Grand.Web.Common.Security.Authentication, next to CookieAuthenticationService. Call sites change only their using.
• Facebook and Google login controllers call IExternalSignInService.Authenticate; they still use IExternalAuthenticationService for AuthenticationProviderIsAvailable.

The grep above now returns nothing. Grand.Business.Authentication still depends on ASP.NET Core through its StartupApplication and the JWT services; that is a separate step.

Breaking changes

• IExternalAuthenticationService.Authenticate returns Task<ExternalAuthResult> instead of Task<IActionResult> and has no returnUrl parameter. External login plugins call IExternalSignInService.Authenticate (same arguments as the old method) instead.
• ExternalAuthenticationService: the constructor no longer takes IGrandAuthenticationService; the protected virtual helpers return ExternalAuthResult and lost returnUrl; Error(...) moved to ExternalSignInService.
• Namespace of IGrandAuthenticationService: Grand.Business.Core.Interfaces.Authentication → Grand.Web.Common.Security.Authentication, assembly Grand.Web.Common.

Testing

Automated: the solution builds. Grand.Business.Authentication.Tests (299), Grand.Web.Common.Tests (545), Grand.Web.Tests (152), Grand.Web.Admin.Tests (1578) and Grand.Modules.Tests (379) pass. New tests cover every ExternalAuthStatus in the Business service and the sign-in / redirect mapping in ExternalSignInServiceTests.

Manual (not run yet), with the Google or Facebook login plugin configured:

1. As a guest, log in with an account already linked to a customer → signed in, redirected to returnUrl or the home page, guest cart merged.
2. As a guest, log in with a new account (registration Standard) → customer registered, signed in, "registration completed" page. With AdminApproval → not signed in, "awaiting approval" page. With registration disabled → external authentication error page.
3. Signed in, link a new external account → redirected back, account visible on the customer info page. Link an account that belongs to another customer → external authentication error page.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.